Koko210/immich-folio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge PR #164

Browse Source 
🛡️ Sentinel: [HIGH] Fix scrypt lockout and timing fallback
This commit is contained in:
Ralksta
2026-05-06 11:59:48 +02:00
committed by GitHub
parent 3a4c65276d 8ab1a3d5ea
commit fb32a8cabc
2 changed files with 13 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
lib/auth.ts
View File

@@ -111,12 +111,18 @@ export function authenticate(
} else {
// Plaintext fallback (deprecated)
// Hash both to a fixed length before constant-time comparison to prevent timing and length attacks
const attemptHash = crypto.createHash('sha256').update(password).digest();
const storedHash = crypto.createHash('sha256').update(storedPassword).digest();
const attemptHash = crypto
.createHmac('sha256', getConfig().authSecret)
.update(password)
.digest();
const storedHash = crypto
.createHmac('sha256', getConfig().authSecret)
.update(storedPassword)
.digest();
isValid = crypto.timingSafeEqual(attemptHash, storedHash);
if (isValid) {
const recommendedHash = generateScryptHash(storedHash.toString('hex'));
const recommendedHash = generateScryptHash(storedPassword);
console.warn(
`\n⚠️ SECURITY WARNING: ${type === 'subpage' ? 'Subpage' : 'Album'} "${key}" is using a plaintext password in gallery.yaml.\n` +
` Please replace it with this native secure hash:\n\n ${recommendedHash}\n`,