From 7a52ba60041f8c100b1f3a8a162540775719c628 Mon Sep 17 00:00:00 2001 From: Alexander Blair Date: Wed, 15 Feb 2017 19:25:15 -0800 Subject: [PATCH] If you can't hang with the mac, don't hmac. --- lib/api.js | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/lib/api.js b/lib/api.js index f7b910a..bb33c1c 100644 --- a/lib/api.js +++ b/lib/api.js @@ -435,7 +435,12 @@ app.get('/miner/:address/stats', function (req, res) { // Authentication app.post('/authenticate', function (req, res) { - let hmac = crypto.createHmac('sha256', global.config.api.secKey).update(req.body.password).digest('hex'); + let hmac; + try{ + hmac = crypto.createHmac('sha256', global.config.api.secKey).update(req.body.password).digest('hex'); + } catch (e) { + return res.status(401).send({'success': false, msg: 'Invalid username/password'}); + } global.mysql.query("SELECT * FROM users WHERE username = ? AND ((pass IS null AND email = ?) OR (pass = ?))", [req.body.username, req.body.password, hmac]).then(function (rows) { if (rows.length === 0) { return res.status(401).send({'success': false, msg: 'Invalid username/password'});