From cbb4b03d664d8f8ee4b21d04d2ace695374d22b4 Mon Sep 17 00:00:00 2001 From: Jeena Date: Thu, 19 Mar 2026 04:17:42 +0000 Subject: [PATCH] fix: Adapt FreshRSS login to reversed challenge order FreshRSS upstream commit 476e57b reversed the concatenation order of the bcrypt hash and nonce in the login challenge for safer password evaluation. Update our challenge computation to match the new hash+nonce order. --- check_updates.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/check_updates.py b/check_updates.py index dd03b38..8fab39b 100644 --- a/check_updates.py +++ b/check_updates.py @@ -400,7 +400,7 @@ def authenticate_service(service: ServiceConfig, timeout: float, user_agent: str if len(password_bytes) > 72: password_bytes = password_bytes[:72] first_hash = bcrypt.hashpw(password_bytes, salt1.encode("utf-8")) - combined = (nonce + first_hash.decode("utf-8")).encode("utf-8") + combined = (first_hash.decode("utf-8") + nonce).encode("utf-8") if len(combined) > 72: combined = combined[:72] challenge = bcrypt.hashpw(combined, bcrypt.gensalt(rounds=4))