diff options
| author | Dylan William Hardison <dylan@hardison.net> | 2015-07-28 22:21:26 +0200 |
|---|---|---|
| committer | Dylan William Hardison <dylan@hardison.net> | 2015-07-28 22:22:46 +0200 |
| commit | d373bb13a51a74ef77cf800fdc77a30ab9ac9d17 (patch) | |
| tree | 9ae31b14571bd333aebe2c89da85717f69af954e /Bugzilla | |
| parent | 19a2ebacc37a7b3990e5bfd0288a1f7d332a665f (diff) | |
| download | bugzilla-d373bb13a51a74ef77cf800fdc77a30ab9ac9d17.tar.gz bugzilla-d373bb13a51a74ef77cf800fdc77a30ab9ac9d17.tar.xz | |
Bug 1179856 - Increase length of logincookie value for greater security
r=gerv,a=sgreen
Diffstat (limited to 'Bugzilla')
| -rw-r--r-- | Bugzilla/DB/Schema.pm | 4 | ||||
| -rw-r--r-- | Bugzilla/Install/DB.pm | 6 | ||||
| -rw-r--r-- | Bugzilla/Token.pm | 7 |
3 files changed, 14 insertions, 3 deletions
diff --git a/Bugzilla/DB/Schema.pm b/Bugzilla/DB/Schema.pm index 3d904ba8b..5d5d52508 100644 --- a/Bugzilla/DB/Schema.pm +++ b/Bugzilla/DB/Schema.pm @@ -1148,7 +1148,7 @@ use constant ABSTRACT_SCHEMA => { logincookies => { FIELDS => [ - cookie => {TYPE => 'varchar(16)', NOTNULL => 1, + cookie => {TYPE => 'varchar(22)', NOTNULL => 1, PRIMARYKEY => 1}, userid => {TYPE => 'INT3', NOTNULL => 1, REFERENCES => {TABLE => 'profiles', @@ -1190,7 +1190,7 @@ use constant ABSTRACT_SCHEMA => { COLUMN => 'userid', DELETE => 'CASCADE'}}, issuedate => {TYPE => 'DATETIME', NOTNULL => 1} , - token => {TYPE => 'varchar(16)', NOTNULL => 1, + token => {TYPE => 'varchar(22)', NOTNULL => 1, PRIMARYKEY => 1}, tokentype => {TYPE => 'varchar(16)', NOTNULL => 1} , eventdata => {TYPE => 'TINYTEXT'}, diff --git a/Bugzilla/Install/DB.pm b/Bugzilla/Install/DB.pm index 5761d1963..26f68aab0 100644 --- a/Bugzilla/Install/DB.pm +++ b/Bugzilla/Install/DB.pm @@ -739,6 +739,12 @@ sub update_table_definitions { $dbh->bz_add_column('keyworddefs', 'is_active', {TYPE => 'BOOLEAN', NOTNULL => 1, DEFAULT => 'TRUE'}); + # 2015-07-25 dylan@mozilla.com - Bug 1179856 + $dbh->bz_alter_column('tokens', 'token', + {TYPE => 'varchar(22)', NOTNULL => 1, PRIMARYKEY => 1}); + $dbh->bz_alter_column('logincookies', 'cookie', + {TYPE => 'varchar(22)', NOTNULL => 1, PRIMARYKEY => 1}); + ################################################################ # New --TABLE-- changes should go *** A B O V E *** this point # ################################################################ diff --git a/Bugzilla/Token.pm b/Bugzilla/Token.pm index 1f8e7bc17..67a201b53 100644 --- a/Bugzilla/Token.pm +++ b/Bugzilla/Token.pm @@ -29,6 +29,11 @@ use parent qw(Exporter); check_token_data delete_token issue_hash_token check_hash_token); +# 128 bits password: +# 128 * log10(2) / log10(62) = 21.49, round up to 22. +# 62 = 0-9, a-z, A-Z. +use constant TOKEN_LENGTH => 22; + ################################################################################ # Public Functions ################################################################################ @@ -289,7 +294,7 @@ sub GenerateUniqueToken { if ($tries > 100) { ThrowCodeError("token_generation_error"); } - $token = generate_random_password(); + $token = generate_random_password(TOKEN_LENGTH); $sth->execute($token); $duplicate = $sth->fetchrow_array; } |