From abd3ba537e5c1ff923ad9af085bff1ca1070e471 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Lebleu?=
 <jeromelebleu@users.noreply.github.com>
Date: Tue, 26 Jan 2021 17:24:33 +0100
Subject: [PATCH] Add MD5-CRYPT to the fallback password schemes

Password should never be stored in plain-text. As Dovecot could be
installed on another host, this adds MD5-CRYPT as a weak but common
scheme and as an alternative to PLAIN.
---
 modoboa/core/password_hashers/__init__.py |  2 +-
 modoboa/core/tests/test_authentication.py | 16 ++++++++++++----
 2 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/modoboa/core/password_hashers/__init__.py b/modoboa/core/password_hashers/__init__.py
index dbb399731..23982d4f3 100644
--- a/modoboa/core/password_hashers/__init__.py
+++ b/modoboa/core/password_hashers/__init__.py
@@ -43,6 +43,6 @@ def get_dovecot_schemes():
                              for scheme in schemes.split()]
 
     if not supported_schemes:
-        supported_schemes = ['{PLAIN}']
+        supported_schemes = ['{MD5-CRYPT}', '{PLAIN}']
 
     return supported_schemes
diff --git a/modoboa/core/tests/test_authentication.py b/modoboa/core/tests/test_authentication.py
index 567edc01a..d08e1421b 100644
--- a/modoboa/core/tests/test_authentication.py
+++ b/modoboa/core/tests/test_authentication.py
@@ -19,9 +19,9 @@ from modoboa.core.password_hashers import (
 from modoboa.lib.tests import NO_SMTP, ModoTestCase
 from .. import factories, models
 
+DOVEADM_TEST_PATH = "{}/doveadm".format(os.path.dirname(__file__))
+
 
-@override_settings(
-    DOVEADM_LOOKUP_PATH=["{}/doveadm".format(os.path.dirname(__file__))])
 class AuthenticationTestCase(ModoTestCase):
     """Validate authentication scenarios."""
 
@@ -89,6 +89,7 @@ class AuthenticationTestCase(ModoTestCase):
         self.assertEqual(response.status_code, 302)
         self.assertTrue(response.url.endswith(reverse("core:dashboard")))
 
+    @override_settings(DOVEADM_LOOKUP_PATH=[DOVEADM_TEST_PATH])
     def test_password_schemes(self):
         """Validate password scheme changes."""
         username = "user@test.com"
@@ -130,6 +131,7 @@ class AuthenticationTestCase(ModoTestCase):
         self.assertTrue(user.password.startswith(pw_hash.scheme))
 
     @skipUnless(argon2, "argon2-cffi not installed")
+    @override_settings(DOVEADM_LOOKUP_PATH=[DOVEADM_TEST_PATH])
     def test_password_argon2_parameter_change(self):
         """Validate hash parameter update on login works with argon2."""
         username = "user@test.com"
@@ -169,8 +171,9 @@ class AuthenticationTestCase(ModoTestCase):
         self.assertEqual(parameters.memory_cost, 1000)
         self.assertEqual(parameters.parallelism, 2)
 
-    def test_supported_schemes(self):
-        """Validate dovecot supported schemes."""
+    @override_settings(DOVEADM_LOOKUP_PATH=[DOVEADM_TEST_PATH])
+    def test_dovecot_supported_schemes(self):
+        """Validate dovecot supported schemes with fake output."""
         supported_schemes = get_dovecot_schemes()
         self.assertEqual(supported_schemes,
                          ["{MD5}",
@@ -204,6 +207,11 @@ class AuthenticationTestCase(ModoTestCase):
                           "{SHA256-CRYPT}",
                           "{SHA512-CRYPT}"])
 
+    def test_dovecot_default_schemes(self):
+        """Check default scheme if doveadm is not found."""
+        supported_schemes = get_dovecot_schemes()
+        self.assertEqual(supported_schemes, ["{MD5-CRYPT}", "{PLAIN}"])
+
 
 class PasswordResetTestCase(ModoTestCase):
     """Test password reset service."""