Merge branch 'master' of github.com:modoboa/modoboa

modoboa/core/password_hashers/__init__.py

@@ -7,7 +7,7 @@ from django.utils.encoding import smart_text
 
 from modoboa.core.password_hashers.advanced import (  # NOQA:F401
     BLFCRYPTHasher, MD5CRYPTHasher, SHA256CRYPTHasher, SHA512CRYPTHasher,
-    ARGON2IDHasher
+    ARGON2IDHasher, SSHAHasher
 )
 from modoboa.core.password_hashers.base import (  # NOQA:F401
     CRYPTHasher, MD5Hasher, PLAINHasher, SHA256Hasher

modoboa/core/password_hashers/advanced.py

@@ -4,7 +4,7 @@ Advanced (ie. stronger) password hashers.
 This module relies on `passlib` to provide more secure hashers.
 """
 
-from passlib.hash import bcrypt, md5_crypt, sha256_crypt, sha512_crypt
+from passlib.hash import bcrypt, md5_crypt, sha256_crypt, sha512_crypt, ldap_salted_sha1
 
 try:
     from argon2 import PasswordHasher as argon2_hasher
@@ -113,6 +113,25 @@ class SHA512CRYPTHasher(PasswordHasher):
         return sha512_crypt.verify(clearvalue, hashed_value)
 
 
+class SSHAHasher(PasswordHasher):
+    """
+    Salted SHA1 password hasher.
+    """
+    _weak = True
+
+    @property
+    def scheme(self):
+        return "{SSHA}"
+
+    def _encrypt(self, clearvalue, salt=None):
+        # We have to remove the {SSHA} at the beginning of the string
+        return ldap_salted_sha1.hash(clearvalue)[6:]
+
+    def verify(self, clearvalue, hashed_value):
+        # We have to add the scheme for the hashed_value to be validated
+        return ldap_salted_sha1.verify(clearvalue, f'{{SSHA}}{hashed_value}')
+
+
 if argon2_hasher is not None:
     class ARGON2IDHasher(PasswordHasher):
         """

modoboa/core/tests/test_authentication.py

@@ -110,6 +110,12 @@ class AuthenticationTestCase(ModoTestCase):
         user.refresh_from_db()
         self.assertTrue(user.password.startswith("{SHA256}"))
 
+        self.client.logout()
+        self.set_global_parameter("password_scheme", "ssha")
+        self.client.post(reverse("core:login"), data)
+        user.refresh_from_db()
+        self.assertTrue(user.password.startswith("{SSHA}"))
+
         if argon2 is not None:
             self.client.logout()
             self.set_global_parameter("password_scheme", "argon2id")
@@ -176,7 +182,7 @@ class AuthenticationTestCase(ModoTestCase):
         """Validate Dovecot supported schemes with fake command output."""
         exec_cmd_mock.return_value = (
             0,
-            "MD5 MD5-CRYPT SHA SHA1 SHA256 SHA512 SMD5 SSHA SSHA256 SSHA512 "
+            "MD5 MD5-CRYPT SHA SHA1 SSHA SHA256 SHA512 SMD5 SSHA SSHA256 SSHA512 "
             "PLAIN CLEAR CLEARTEXT PLAIN-TRUNC CRAM-MD5 SCRAM-SHA-1 HMAC-MD5 "
             "DIGEST-MD5 PLAIN-MD4 PLAIN-MD5 LDAP-MD5 LANMAN NTLM OTP SKEY RPA "
             "PBKDF2 CRYPT SHA256-CRYPT SHA512-CRYPT"
@@ -187,6 +193,7 @@ class AuthenticationTestCase(ModoTestCase):
                           "{MD5-CRYPT}",
                           "{SHA}",
                           "{SHA1}",
+                          "{SSHA}",
                           "{SHA256}",
                           "{SHA512}",
                           "{SMD5}",