Commit faba19a9 authored by Wolfgang Knopki's avatar Wolfgang Knopki
Browse files

fix salting error in routes.js

parent d2539c5d
...@@ -3,8 +3,9 @@ const SamlStrategy = require('passport-saml').Strategy ...@@ -3,8 +3,9 @@ const SamlStrategy = require('passport-saml').Strategy
const dbconn = require('./dbconn') const dbconn = require('./dbconn')
const methods = require('./methods') const methods = require('./methods')
// pwd encryption // pwd encryption
const bcrypt = require('bcryptjs') const bcrypt = require('bcryptjs');
const saltRounds = 10 const saltRounds = 10;
const salt = 64; // salt length
// forgot pwd // forgot pwd
const async = require('async') const async = require('async')
const crypto = require('crypto') const crypto = require('crypto')
...@@ -254,57 +255,14 @@ module.exports = function (app, config, passport) { ...@@ -254,57 +255,14 @@ module.exports = function (app, config, passport) {
var currPwd = req.body.inputCurrPwd var currPwd = req.body.inputCurrPwd
var newPwd = req.body.inputNewPwd var newPwd = req.body.inputNewPwd
var retypePwd = req.body.inputConfirm var retypePwd = req.body.inputConfirm
<<<<<<< 718d94b9d7028442893b0b248c85cffd5195be05
methods.getUserIdByEmail(req.user.email, function(userId, err) { methods.getUserIdByEmail(req.user.email, function(userId, err) {
if (!err) { if (!err) {
// Load hashed passwd from DB // Load hashed passwd from DB
dbconn.user.query('SELECT password FROM credential WHERE user_id='+userId, function (err, rows, fields) { dbconn.user.query('SELECT password FROM credential WHERE user_id='+userId, function (err, rows, fields) {
if (err) { if (err) {
res.redirect('/500') res.redirect('/account/500')
throw err throw err
=======
// Load hashed passwd from DB.
dbconn.user.query('SELECT password FROM user WHERE email="'+req.user.email+'"', function (err, rows, fields) {
if (err) {
res.redirect('/account/500')
throw err
}
var userPwd = rows[0].password
// check if the password is correct
bcrypt.compare(currPwd, userPwd, function(err, isMatch) {
if (err) {
res.redirect('/account/500')
throw err
}
else if (!isMatch) {
req.flash('error', "Sorry, your password was incorrect. Please double-check your password.")
res.redirect('/account/security')
} else {
if ( newPwd != retypePwd ) {
req.flash('error', "Passwords do no match. Please make sure you re-type your new password correctly.")
res.redirect('/account/security')
}
else {
// update password
bcrypt.genSalt(saltRounds, function(err, salt) {
bcrypt.hash(newPwd, salt, function(err, hash) {
methods.updatePassword(hash, req.user.email, function(err){
if (err) {
req.flash('error', "Database error: Password cannot be modified.")
throw err
}
else {
req.flash('success', "Pasword updated!")
console.log('pasword updated!')
}
res.redirect('/account/security')
})
});
});
>>>>>>> changed redirect paths relative to account
} }
var userPwd = rows[0].password var userPwd = rows[0].password
...@@ -348,17 +306,11 @@ module.exports = function (app, config, passport) { ...@@ -348,17 +306,11 @@ module.exports = function (app, config, passport) {
} }
}) })
}) })
<<<<<<< 718d94b9d7028442893b0b248c85cffd5195be05
} }
}) })
} }
else { else {
res.redirect('/login');
=======
})
} else {
res.redirect('/account/login'); res.redirect('/account/login');
>>>>>>> changed redirect paths relative to account
} }
}); });
...@@ -474,7 +426,6 @@ module.exports = function (app, config, passport) { ...@@ -474,7 +426,6 @@ module.exports = function (app, config, passport) {
res.redirect('/account/login') res.redirect('/account/login')
}); });
<<<<<<< 718d94b9d7028442893b0b248c85cffd5195be05
// todo: user registration with captcha // todo: user registration with captcha
app.get('/registration', function(req, res) { app.get('/registration', function(req, res) {
res.render('registration') res.render('registration')
...@@ -496,11 +447,6 @@ module.exports = function (app, config, passport) { ...@@ -496,11 +447,6 @@ module.exports = function (app, config, passport) {
industry: req.body.inputIndustry, industry: req.body.inputIndustry,
speciality: req.body.inputSpeciality, speciality: req.body.inputSpeciality,
createdDate: curDate.toISOString().slice(0,10) createdDate: curDate.toISOString().slice(0,10)
=======
app.get('/logout', function (req, res) {
if (req.user == null) {
return res.redirect('/account/');
>>>>>>> changed redirect paths relative to account
} }
// encrypt password // encrypt password
bcrypt.genSalt(saltRounds, function(err, salt) { bcrypt.genSalt(saltRounds, function(err, salt) {
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment