Revize 4ab7f824

#5 Replace MD5 password encryption by some secure algo

- BCrypt password encryption is used instead of MD5.
- Algorithm is from springframework.security package

sources/create_table.sql

@@ -17 +17 @@
   `id` int(11) NOT NULL AUTO_INCREMENT,
   `nick` varchar(50) COLLATE utf8_czech_ci NOT NULL,
   `name` varchar(255) COLLATE utf8_czech_ci NOT NULL DEFAULT '',
-  `psw` varchar(32) COLLATE utf8_czech_ci NOT NULL,
+  `psw` varchar(60) COLLATE utf8_czech_ci NOT NULL,
   `session` varchar(50) COLLATE utf8_czech_ci NOT NULL,
   `active` tinyint(1) NOT NULL,
   `created` datetime NOT NULL,

sources/pom.xml

@@ -74 +74 @@
 
 
 
+        <!-- https://mvnrepository.com/artifact/org.springframework.security/spring-security-core -->
+        <dependency>
+            <groupId>org.springframework.security</groupId>
+            <artifactId>spring-security-core</artifactId>
+            <version>5.1.2.RELEASE</version>
+        </dependency>
         <!-- https://mvnrepository.com/artifact/commons-fileupload/commons-fileupload -->
         <dependency>
             <groupId>commons-fileupload</groupId>

sources/src/main/java/cz/zcu/kiv/offscreen/user/User.java

@@ -1 +1 @@
 package cz.zcu.kiv.offscreen.user;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
+import org.springframework.security.crypto.bcrypt.BCrypt;
 
 import java.sql.PreparedStatement;
 import java.sql.ResultSet;
@@ -46 +47 @@
 	 * 		   false - login failed
 	 */
 	public boolean login(String nick, String psw){
-		String qy = "SELECT * FROM user WHERE nick LIKE ? AND psw LIKE ? AND active = '1' LIMIT 1";
+		String qy = "SELECT * FROM user WHERE nick LIKE ? AND active = '1' LIMIT 1";
 
 		try{
 			PreparedStatement pst = db.getPreparedStatement(qy, false);
 			pst.setString(1, nick);
-			pst.setString(2, Util.MD5(psw));
 			ResultSet rs = db.executeQuery(pst);
 
 			if ( rs != null && rs.next() ) {
-				if(rs.getInt("id") > 0){
+				if(rs.getInt("id") > 0 && BCrypt.checkpw(psw, rs.getString("psw"))){
 					this.id = rs.getInt("id");
 					return true;
 				}
 			}
-		} catch (SQLException e) {
+		} catch (SQLException | IllegalArgumentException e) {
 			logger.error("Can not login user: ", e);
 		}
 
@@ -85 +85 @@
 				pst.setInt(2, 1);
 				pst.setString(3, param.get("nick"));
 				pst.setString(4, param.get("name"));
-				pst.setString(5, Util.MD5(param.get("password")));
+				pst.setString(5, BCrypt.hashpw(param.get("password"), BCrypt.gensalt()));
 				pst.setString(6, param.get("session"));
 				pst.setString(7, param.get("email"));
 

sources/src/main/java/cz/zcu/kiv/offscreen/user/Util.java

@@ -5 +5 @@
 
 class Util {
 
-	/**
-	 *	Method do a hash code from string.
-	 *
-	 * @param md5 - String to hash
-	 * @return String - hashcode 
-	 */
-	static String MD5(String md5) {
-		   try {
-		        java.security.MessageDigest md = java.security.MessageDigest.getInstance("MD5");
-		        byte[] array = md.digest(md5.getBytes());
-		        StringBuffer sb = new StringBuffer();
-		        for (int i = 0; i < array.length; ++i) {
-		          sb.append(Integer.toHexString((array[i] & 0xFF) | 0x100).substring(1,3));
-		       }
-		        return sb.toString();
-		    } catch (java.security.NoSuchAlgorithmException e) {
-		    }
-		    return null;
-	}
 
 	static String formatDate(String date){
 		String pattern = "(\\d{4})-(\\d{2})-(\\d{2}) (\\d{2}):(\\d{2}):(\\d{2}).*";