Skip to content
This repository has been archived by the owner on Aug 30, 2021. It is now read-only.

Password is being stored in clear text if length is 6 #829

Closed
tmfelwu opened this issue Aug 20, 2015 · 1 comment · Fixed by #830
Closed

Password is being stored in clear text if length is 6 #829

tmfelwu opened this issue Aug 20, 2015 · 1 comment · Fixed by #830
Milestone

Comments

@tmfelwu
Copy link

tmfelwu commented Aug 20, 2015

Password is being stored in clear text if length is 6, just an equal sign is required here, or make sure min length for password is 7

/**
 * Hook a pre save method to hash the password
 */
UserSchema.pre('save', function (next) {
  if (this.password && this.isModified('password') && this.password.length >6) {
    this.salt = crypto.randomBytes(16).toString('base64');
    this.password = this.hashPassword(this.password);
  }

  next();
});
@codydaig
Copy link
Member

@sparshy I will look into this and verify on my end.

@lirantal lirantal modified the milestones: 0.4.0, 0.4.x Aug 20, 2015
lirantal added a commit that referenced this issue Aug 21, 2015
[fix] Was storing a 6 char password in plain text [fixes #829]
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants