[freeside-commits] branch master updated. ec4b7d78854b287347eb08a8f99d18c5d41065f5

[Jonathan Prykop]

The branch, master has been updated
       via  ec4b7d78854b287347eb08a8f99d18c5d41065f5 (commit)
      from  0c66f548fe3c1a2e880c6672ff28a5c2da353057 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit ec4b7d78854b287347eb08a8f99d18c5d41065f5
Author: Jonathan Prykop <jonathan at freeside.biz>
Date:   Tue Dec 1 20:51:33 2015 -0600

    RT#29354: Password Security in Email [password_svc_check and aspell requirement]

diff --git a/FS/FS/Password_Mixin.pm b/FS/FS/Password_Mixin.pm
index bcad546..3129366 100644
--- a/FS/FS/Password_Mixin.pm
+++ b/FS/FS/Password_Mixin.pm
@@ -61,14 +61,9 @@ sub is_password_allowed {
   $error = 'Invalid password - ' . $error if $error;
   return $error if $error;
 
-  #check against known usernames
-  my @disallowed_names = $self->password_disallowed_names;
-  foreach my $noname (@disallowed_names) {
-    if ($password =~ /$noname/i) {
-      #keeping message ambiguous to avoid leaking personal info
-      return 'Password contains a disallowed word';
-    }
-  }
+  #check against service fields
+  $error = $self->password_svc_check($password);
+  return $error if $error;
 
   return '' unless $self->get($self->primary_key); # for validating new passwords pre-insert
 
@@ -107,15 +102,15 @@ sub is_password_allowed {
   '';
 }
 
-=item password_disallowed_names
+=item password_svc_check
 
-Override to return a list additional words (eg usernames) not
-to be used by passwords on this service.
+Override to run additional service-specific password checks.
 
 =cut
 
-sub password_disallowed_names {
-  return ();
+sub password_svc_check {
+  my ($self, $password) = @_;
+  return '';
 }
 
 =item password_history_key
diff --git a/FS/FS/svc_acct.pm b/FS/FS/svc_acct.pm
index e7ec4a2..38cebc1 100644
--- a/FS/FS/svc_acct.pm
+++ b/FS/FS/svc_acct.pm
@@ -2676,29 +2676,22 @@ sub virtual_maildir {
   $self->domain. '/maildirs/'. $self->username. '/';
 }
 
-=item password_disallowed_names
+=item password_svc_check
 
 Override, for L<FS::Password_Mixin>.  Not really intended for other use.
 
 =cut
 
-sub password_disallowed_names {
-  my $self = shift;
-  my $dbh = dbh;
-  my $results = {};
-  foreach my $field ( qw( username finger ) ) {
-    my $sql = 'SELECT DISTINCT '.$field.' FROM svc_acct';
-    my $sth = $dbh->prepare($sql)
-      or die "Error preparing $sql: ". $dbh->errstr;
-    $sth->execute()
-      or die "Error executing $sql: ". $sth->errstr;
-    foreach my $row (@{$sth->fetchall_arrayref}, $self->get($field)) {
-      foreach my $word (split(/\s+/,$$row[0])) {
-        $results->{lc($word)} = 1;
+sub password_svc_check {
+  my ($self, $password) = @_;
+  foreach my $field ( qw(username finger) ) {
+    foreach my $word (split(/\W+/,$self->get($field))) {
+      if ($password =~ /$word/i) {
+        return qq(Password contains account information '$word');
       }
     }
   }
-  return keys %$results;
+  return '';
 }
 
 =back
diff --git a/debian/control b/debian/control
index cc908d8..2ac603c 100644
--- a/debian/control
+++ b/debian/control
@@ -22,7 +22,7 @@ Description: Billing and trouble ticketing for service providers
 
 Package: freeside-lib
 Architecture: all
-Depends: gnupg,ghostscript,gsfonts,gzip,latex-xcolor,
+Depends: aspell-en,gnupg,ghostscript,gsfonts,gzip,latex-xcolor,
  libbusiness-creditcard-perl,libcache-cache-perl,
  libcache-simple-timedexpiry-perl,libchart-perl,libclass-container-perl,
  libclass-data-inheritable-perl,libclass-returnvalue-perl,libcolor-scheme-perl,

-----------------------------------------------------------------------

Summary of changes:
 FS/FS/Password_Mixin.pm |   21 ++++++++-------------
 FS/FS/svc_acct.pm       |   23 ++++++++---------------
 debian/control          |    2 +-
 3 files changed, 17 insertions(+), 29 deletions(-)