Skip to content
This repository has been archived by the owner on Aug 30, 2021. It is now read-only.

Commit

Permalink
[fix] Was storing a 6 char password in plain text [fixes #829]
Browse files Browse the repository at this point in the history
  • Loading branch information
codydaig committed Aug 20, 2015
1 parent 72067fd commit 5c287f5
Show file tree
Hide file tree
Showing 2 changed files with 28 additions and 1 deletion.
2 changes: 1 addition & 1 deletion modules/users/server/models/user.server.model.js
Original file line number Diff line number Diff line change
Expand Up @@ -107,7 +107,7 @@ var UserSchema = new Schema({
* Hook a pre save method to hash the password
*/
UserSchema.pre('save', function (next) {
if (this.password && this.isModified('password') && this.password.length > 6) {
if (this.password && this.isModified('password') && this.password.length >= 6) {
this.salt = crypto.randomBytes(16).toString('base64');
this.password = this.hashPassword(this.password);
}
Expand Down
27 changes: 27 additions & 0 deletions modules/users/tests/server/user.server.model.tests.js
Original file line number Diff line number Diff line change
Expand Up @@ -155,6 +155,33 @@ describe('User Model Unit Tests:', function () {

});

it('should not save the password in plain text', function (done) {
var _user = new User(user);
var passwordBeforeSave = _user.password;
_user.save(function (err) {
should.not.exist(err);
_user.password.should.not.equal(passwordBeforeSave);
_user.remove(function(err) {
should.not.exist(err);
done();
});
});
});

it('should not save the password in plain text (6 char password)', function (done) {
var _user = new User(user);
_user.password = '123456';
var passwordBeforeSave = _user.password;
_user.save(function (err) {
should.not.exist(err);
_user.password.should.not.equal(passwordBeforeSave);
_user.remove(function(err) {
should.not.exist(err);
done();
});
});
});

describe("User E-mail Validation Tests", function() {
it('should not allow invalid email address - "123"', function (done) {
var _user = new User(user);
Expand Down

0 comments on commit 5c287f5

Please sign in to comment.