From 910b336dc7e07165d87c4c45277e2c4f2a069d46 Mon Sep 17 00:00:00 2001 From: Antoine Nguyen Date: Tue, 3 Jul 2012 11:06:26 +0200 Subject: [PATCH] Increased salt size. fixes #286 --- modoboa/admin/models.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/modoboa/admin/models.py b/modoboa/admin/models.py index caf304e79..e04e3bc02 100644 --- a/modoboa/admin/models.py +++ b/modoboa/admin/models.py @@ -118,7 +118,9 @@ class User(DUser): # (b) supports passwords lengths of more than 8 characters (all except # "crypt"). elif scheme == "md5crypt": - salt = "".join(Random().sample(string.letters + string.digits, 2)) + # The salt may vary from 12 to 48 bits. (Using all six bytes here + # with a subset of characters means we get only 35 random bits.) + salt = "".join(Random().sample(string.letters + string.digits, 6)) result = md5crypt(raw_value, salt) prefix = "" # the result already has $1$ prepended to it to signify what this is elif scheme == "sha256":