public
nobgit
read
NobMail
Based on mailcow: dockerized
Languages
Repository composition by tracked source files.
PHP
49%
JavaScript
35%
HTML
9%
CSS
4%
Shell
2%
Python
1%
Lua
0%
Perl
0%
Ruby
0%
SCSS
0%
Create file
Wiki Documentation
Clone
https://nobgit.com/orgs/nobgit/nobmail.git
ssh://[email protected]:2222/orgs/nobgit/nobmail.git
Commit
fix: Password for mobileconfig that conforms to password-complexity policy
70101d11
data/web/inc/functions.inc.php | 36 ++++++++++++++++++++++++++++++++++++
data/web/mobileconfig.php | 11 ++++++-----
2 files changed, 42 insertions(+), 5 deletions(-)Diff
diff --git a/data/web/inc/functions.inc.php b/data/web/inc/functions.inc.php
index 1947ec46..23b8d701 100644
--- a/data/web/inc/functions.inc.php
+++ b/data/web/inc/functions.inc.php
@@ -205,6 +205,42 @@ function password_complexity($_action, $_data = null) {
break;
}
}
+
+function password_generate(){
+ $password_complexity = password_complexity('get');
+ $min_length = max(16, intval($password_complexity['length']));
+
+ $lowercase = range('a', 'z');
+ $uppercase = range('A', 'Z');
+ $digits = range(0, 9);
+ $special_chars = str_split('!@#$%^&*()?=');
+
+ $password = [
+ $lowercase[random_int(0, count($lowercase) - 1)],
+ $uppercase[random_int(0, count($uppercase) - 1)],
+ $digits[random_int(0, count($digits) - 1)],
+ $special_chars[random_int(0, count($special_chars) - 1)],
+ ];
+
+ $all = array_merge($lowercase, $uppercase, $digits, $special_chars);
+
+ while (count($password) < $min_length) {
+ $password[] = $all[random_int(0, count($all) - 1)];
+ }
+
+ // Cryptographically secure shuffle using Fisher-Yates algorithm
+ $count = count($password);
+ for ($i = $count - 1; $i > 0; $i--) {
+ $j = random_int(0, $i);
+ $temp = $password[$i];
+ $password[$i] = $password[$j];
+ $password[$j] = $temp;
+ }
+
+ return implode('', $password);
+
+}
+
function password_check($password1, $password2) {
$password_complexity = password_complexity('get');
diff --git a/data/web/mobileconfig.php b/data/web/mobileconfig.php
index 44aaa30a..7c0ead7f 100644
--- a/data/web/mobileconfig.php
+++ b/data/web/mobileconfig.php
@@ -34,15 +34,15 @@ catch(PDOException $e) {
if (isset($_GET['only_email'])) {
$onlyEmailAccount = true;
- $description = 'IMAP';
+ $description = 'IMAP';
} else {
$onlyEmailAccount = false;
- $description = 'IMAP, CalDAV, CardDAV';
+ $description = 'IMAP, CalDAV, CardDAV';
}
if (isset($_GET['app_password'])) {
$app_password = true;
$description .= ' with application password';
-
+
if (strpos($_SERVER['HTTP_USER_AGENT'], 'iPad') !== FALSE)
$platform = 'iPad';
elseif (strpos($_SERVER['HTTP_USER_AGENT'], 'iPhone') !== FALSE)
@@ -51,8 +51,9 @@ if (isset($_GET['app_password'])) {
$platform = 'Mac';
else
$platform = $_SERVER['HTTP_USER_AGENT'];
-
- $password = bin2hex(openssl_random_pseudo_bytes(16));
+
+ $password = password_generate();
+
$attr = array(
'app_name' => $platform,
'app_passwd' => $password,