jeena/service-update-alerts
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: Adapt FreshRSS login to reversed challenge order

Browse source 
FreshRSS upstream commit 476e57b reversed the concatenation order
of the bcrypt hash and nonce in the login challenge for safer
password evaluation. Update our challenge computation to match
the new hash+nonce order.
This commit is contained in:
Jeena 2026-03-19 04:17:42 +00:00
parent f34e2f2d08
commit cbb4b03d66
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
check_updates.py
View file

@ -400,7 +400,7 @@ def authenticate_service(service: ServiceConfig, timeout: float, user_agent: str
if len(password_bytes) > 72: if len(password_bytes) > 72:
password_bytes = password_bytes[:72] password_bytes = password_bytes[:72]
first_hash = bcrypt.hashpw(password_bytes, salt1.encode("utf-8")) first_hash = bcrypt.hashpw(password_bytes, salt1.encode("utf-8"))
combined = (nonce + first_hash.decode("utf-8")).encode("utf-8") combined = (first_hash.decode("utf-8") + nonce).encode("utf-8")
if len(combined) > 72: if len(combined) > 72:
combined = combined[:72] combined = combined[:72]
challenge = bcrypt.hashpw(combined, bcrypt.gensalt(rounds=4)) challenge = bcrypt.hashpw(combined, bcrypt.gensalt(rounds=4))