a14be197eb
- The current architecture is inherently insecure, because you can construct the 'secret' cookie value with values that are available in the database. Thus provides zero protection when a database is dumped/leaked. - This patch implements a new architecture that's inspired from: [Paragonie Initiative](https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence#secure-remember-me-cookies). - Integration testing is added to ensure the new mechanism works. - Removes a setting, because it's not used anymore. (cherry picked from commiteff097448b) [GITEA] rework long-term authentication (squash) add migration Reminder: the migration is run via integration tests as explained in the commit "[DB] run all Forgejo migrations in integration tests" (cherry picked from commit4accf7443c)
37 lines
812 B
Go
37 lines
812 B
Go
// Copyright 2022 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package util
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestCopyFile(t *testing.T) {
|
|
testContent := []byte("hello")
|
|
|
|
tmpDir := os.TempDir()
|
|
now := time.Now()
|
|
srcFile := fmt.Sprintf("%s/copy-test-%d-src.txt", tmpDir, now.UnixMicro())
|
|
dstFile := fmt.Sprintf("%s/copy-test-%d-dst.txt", tmpDir, now.UnixMicro())
|
|
|
|
_ = os.Remove(srcFile)
|
|
_ = os.Remove(dstFile)
|
|
defer func() {
|
|
_ = os.Remove(srcFile)
|
|
_ = os.Remove(dstFile)
|
|
}()
|
|
|
|
err := os.WriteFile(srcFile, testContent, 0o777)
|
|
assert.NoError(t, err)
|
|
err = CopyFile(srcFile, dstFile)
|
|
assert.NoError(t, err)
|
|
dstContent, err := os.ReadFile(dstFile)
|
|
assert.NoError(t, err)
|
|
assert.Equal(t, testContent, dstContent)
|
|
}
|