From ab45d85e7815fd504bd35e44fcd98906a18e7a10 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Krier?= <ced@b2ck.com>
Date: Wed, 29 Jul 2009 16:27:18 +0200
Subject: [PATCH] Add salt to sha of password

---
 CHANGELOG           |  1 +
 trytond/res/user.py | 12 ++++++++++--
 trytond/security.py | 12 +++++++-----
 trytond/server.py   |  8 ++++++--
 4 files changed, 24 insertions(+), 9 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index b30dd66651..cddf7a087e 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,4 @@
+* Add salt to sha of password
 * Add strftime to ir.lang to handle locale's format
 * Add sqlite backend
 * Add validate test for required and size
diff --git a/trytond/res/user.py b/trytond/res/user.py
index 064076d64d..355dba695d 100644
--- a/trytond/res/user.py
+++ b/trytond/res/user.py
@@ -7,6 +7,8 @@ from trytond.wizard import Wizard
 from lxml import etree
 from trytond.tools import Cache
 from trytond.backend import TableHandler
+import string
+import random
 
 
 class User(ModelSQL, ModelView):
@@ -16,6 +18,7 @@ class User(ModelSQL, ModelView):
     name = fields.Char('Name', required=True, select=1, translate=True)
     login = fields.Char('Login', required=True)
     password = fields.Sha('Password')
+    salt = fields.Char('Salt', size=8)
     signature = fields.Text('Signature')
     active = fields.Boolean('Active')
     action = fields.Many2One('ir.action', 'Home Action')
@@ -114,8 +117,13 @@ class User(ModelSQL, ModelView):
         if 'menu' in vals:
             vals['menu'] = action_obj.get_action_id(cursor, user,
                     vals['menu'], context=context)
-        if 'password' in vals and vals['password'] == 'x' * 10:
-            del vals['password']
+        if 'password' in vals:
+            if vals['password'] == 'x' * 10:
+                del vals['password']
+            else:
+                vals['salt'] = ''.join(random.sample(
+                    string.letters + string.digits, 8))
+                vals['password'] += vals['salt']
         return vals
 
     def create(self, cursor, user, vals, context=None):
diff --git a/trytond/security.py b/trytond/security.py
index ad19072995..a3eb3730b6 100644
--- a/trytond/security.py
+++ b/trytond/security.py
@@ -18,11 +18,7 @@ def login(dbname, loginname, password, cache=True):
     _USER_TRY.setdefault(dbname, {})
     database = Database(dbname).connect()
     cursor = database.cursor()
-    if hashlib:
-        password_sha = hashlib.sha1(password).hexdigest()
-    else:
-        password_sha = sha.new(password).hexdigest()
-    cursor.execute('SELECT id, password, active FROM res_user '
+    cursor.execute('SELECT id, password, active, salt FROM res_user '
         'WHERE login = %s', (loginname,))
     res = cursor.fetchone()
     if res:
@@ -31,6 +27,12 @@ def login(dbname, loginname, password, cache=True):
         if user_id == 0:
             return False
         _USER_TRY[dbname].setdefault(user_id, 0)
+        # Add salt
+        password += res[3] or ''
+        if hashlib:
+            password_sha = hashlib.sha1(password).hexdigest()
+        else:
+            password_sha = sha.new(password).hexdigest()
         if res[1] == password_sha and res[2]:
             _USER_TRY[dbname][user_id] = 0
             if cache:
diff --git a/trytond/server.py b/trytond/server.py
index a2fa7e1ddf..725a12b4ad 100644
--- a/trytond/server.py
+++ b/trytond/server.py
@@ -27,6 +27,8 @@ except ImportError:
     import sha
 import threading
 from pool import Pool
+import string
+import random
 
 
 class TrytonServer(object):
@@ -128,13 +130,15 @@ class TrytonServer(object):
 
                 database = Database(db_name).connect()
                 cursor = database.cursor()
+                salt = ''.join(random.sample(string.letters + string.digits, 8))
+                password += salt
                 if hashlib:
                     password = hashlib.sha1(password).hexdigest()
                 else:
                     password = sha.new(password).hexdigest()
                 cursor.execute('UPDATE res_user ' \
-                        'SET password = %s ' \
-                        'WHERE login = \'admin\'', (password,))
+                        'SET password = %s, salt = %s ' \
+                        'WHERE login = \'admin\'', (password, salt))
                 cursor.commit()
                 cursor.close()