51988ef52b
- The current architecture is inherently insecure, because you can
construct the 'secret' cookie value with values that are available in
the database. Thus provides zero protection when a database is
dumped/leaked.
- This patch implements a new architecture that's inspired from: [Paragonie Initiative](https://paragonie.com/blog/2015/04/secure-authentication-php-with-long-term-persistence#secure-remember-me-cookies).
- Integration testing is added to ensure the new mechanism works.
- Removes a setting, because it's not used anymore.
(cherry-pick from eff097448b)
Conflicts:
modules/context/context_cookie.go
trivial context conflicts
routers/web/web.go
ctx.GetSiteCookie(setting.CookieRememberName) moved from services/auth/middleware.go
37 lines
812 B
Go
37 lines
812 B
Go
// Copyright 2022 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package util
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestCopyFile(t *testing.T) {
|
|
testContent := []byte("hello")
|
|
|
|
tmpDir := os.TempDir()
|
|
now := time.Now()
|
|
srcFile := fmt.Sprintf("%s/copy-test-%d-src.txt", tmpDir, now.UnixMicro())
|
|
dstFile := fmt.Sprintf("%s/copy-test-%d-dst.txt", tmpDir, now.UnixMicro())
|
|
|
|
_ = os.Remove(srcFile)
|
|
_ = os.Remove(dstFile)
|
|
defer func() {
|
|
_ = os.Remove(srcFile)
|
|
_ = os.Remove(dstFile)
|
|
}()
|
|
|
|
err := os.WriteFile(srcFile, testContent, 0o777)
|
|
assert.NoError(t, err)
|
|
err = CopyFile(srcFile, dstFile)
|
|
assert.NoError(t, err)
|
|
dstContent, err := os.ReadFile(dstFile)
|
|
assert.NoError(t, err)
|
|
assert.Equal(t, testContent, dstContent)
|
|
}
|