github/hedgedoc
1
0
Fork 0
mirror of https://github.com/hedgedoc/hedgedoc.git synced 2024-10-18 21:30:15 -04:00
Code Issues Projects Releases Packages Wiki Activity

refactor(backend): don't create local user if password is too weak

Browse source 
This prevents the previous problem that the backend created a user that was then not correctly removed again

Signed-off-by: Philip Molares <philip.molares@udo.edu>
This commit is contained in:
Philip Molares 2023-01-08 20:45:07 +01:00 committed by David Mehren
parent 45e70434c4
commit 47d1765b12
2 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
backend/src/api/private/auth/auth.controller.ts
View file

@ -58,6 +58,7 @@ export class AuthController {
@Req() request: RequestWithSession, @Req() request: RequestWithSession,
@Body() registerDto: RegisterDto, @Body() registerDto: RegisterDto,
): Promise<void> { ): Promise<void> {
await this.identityService.checkPasswordStrength(registerDto.password);
const user = await this.usersService.createUser( const user = await this.usersService.createUser(
registerDto.username, registerDto.username,
registerDto.displayName, registerDto.displayName,

4
backend/src/identity/identity.service.ts
View file

@ -1,5 +1,5 @@
/* /*
* SPDX-FileCopyrightText: 2022 The HedgeDoc developers (see AUTHORS file) * SPDX-FileCopyrightText: 2023 The HedgeDoc developers (see AUTHORS file)
* *
* SPDX-License-Identifier: AGPL-3.0-only * SPDX-License-Identifier: AGPL-3.0-only
*/ */
@ -197,7 +197,7 @@ export class IdentityService {
* @param {string} password - the password to check * @param {string} password - the password to check
* @throws {PasswordTooWeakError} the password is too weak * @throws {PasswordTooWeakError} the password is too weak
*/ */
private async checkPasswordStrength(password: string): Promise<void> { async checkPasswordStrength(password: string): Promise<void> {
const result = await zxcvbnAsync(password); const result = await zxcvbnAsync(password);
if (result.score < this.authConfig.local.minimalPasswordStrength) { if (result.score < this.authConfig.local.minimalPasswordStrength) {
throw new PasswordTooWeakError(); throw new PasswordTooWeakError();