Many hyperlinks are disabled.
Use anonymous login
to enable hyperlinks.
Overview
| Comment: | Improved comment on the db_obscure() routine. No functional code changes. |
|---|---|
| Downloads: | Tarball | ZIP archive |
| Timelines: | family | ancestors | descendants | both | trunk |
| Files: | files | file ages | folders |
| SHA3-256: |
aa1a0b31e200a7feb18b5ead30fbfc7a |
| User & Date: | drh 2022-12-30 21:12:38.313 |
Context
|
2022-12-30
| ||
| 22:18 | Correct mis-pluralization of 'new ticketss' in the timeline, per report in [forum:e711cb860a|forum post e711cb860a]. check-in: 7c2c445796 user: stephan tags: trunk | |
| 21:12 | Improved comment on the db_obscure() routine. No functional code changes. check-in: aa1a0b31e2 user: drh tags: trunk | |
| 20:54 | Security enhancement: Do not store the passwords for remote URLs directly, but instead store the sha1_shared_secret() encoding of those passwords. It is the SHA1 encoding that gets transmitted to the server anyhow, so we might as well just store that. The SHA1 encoding cannot be used to log in. The password is still protected using obscure() even though it is now a SHA1 hash. check-in: 41ba6ea7db user: drh tags: trunk | |
Changes
Changes to src/db.c.
| ︙ | ︙ | |||
1379 1380 1381 1382 1383 1384 1385 1386 1387 1388 1389 1390 1391 1392 |
**
** Note that user.pw uses a different obscuration algorithm, but
** you don't need to use 'fossil sql' for that anyway. Just call
**
** fossil user pass monkey123
**
** to change the local user entry's password in the same way.
*/
void db_obscure(
sqlite3_context *context,
int argc,
sqlite3_value **argv
){
const unsigned char *zIn = sqlite3_value_text(argv[0]);
| > > > > > > | 1379 1380 1381 1382 1383 1384 1385 1386 1387 1388 1389 1390 1391 1392 1393 1394 1395 1396 1397 1398 |
**
** Note that user.pw uses a different obscuration algorithm, but
** you don't need to use 'fossil sql' for that anyway. Just call
**
** fossil user pass monkey123
**
** to change the local user entry's password in the same way.
**
** 2022-12-30: If the user-data pointer is not NULL, then operate
** as unobscure() rather than obscure(). The obscure() variant of
** this routine is commonly available. But unobscure is (currently)
** only registered by the "fossil remote config-data --show-passwords"
** command.
*/
void db_obscure(
sqlite3_context *context,
int argc,
sqlite3_value **argv
){
const unsigned char *zIn = sqlite3_value_text(argv[0]);
|
| ︙ | ︙ |