Initial version of password strength enforcement
diff --git a/src/couch_passwords.erl b/src/couch_passwords.erl
index b06a584..4b3e07b 100644
--- a/src/couch_passwords.erl
+++ b/src/couch_passwords.erl
@@ -23,6 +23,7 @@
%% legacy scheme, not used for new passwords.
-spec simple(binary(), binary()) -> binary().
simple(Password, Salt) when is_binary(Password), is_binary(Salt) ->
+ validate_password(Password),
?l2b(couch_util:to_hex(crypto:sha(<<Password/binary, Salt/binary>>))).
%% CouchDB utility functions
@@ -78,6 +79,7 @@
is_integer(Iterations),
Iterations > 0,
is_integer(DerivedLength) ->
+ validate_password(Password),
L = ceiling(DerivedLength / ?SHA1_OUTPUT_LENGTH),
<<Bin:DerivedLength/binary,_/binary>> =
iolist_to_binary(pbkdf2(Password, Salt, Iterations, L, 1, [])),
@@ -127,6 +129,16 @@
end;
verify(_X, _Y) -> false.
+validate_password(Password) when is_binary(Password) ->
+ MinLength = config:get_integer("passwords", "min_length", 3),
+ case byte_size(Password) < MinLength of
+ true ->
+ throw({forbidden, "Password is too short"});
+ false ->
+ ok
+ end.
+
+
-spec ceiling(number()) -> integer().
ceiling(X) ->
T = erlang:trunc(X),
diff --git a/src/couch_users_db.erl b/src/couch_users_db.erl
index 6f7b9af..822ec45 100644
--- a/src/couch_users_db.erl
+++ b/src/couch_users_db.erl
@@ -54,6 +54,8 @@
% If newDoc.password == null || newDoc.password == undefined:
% ->
% noop
+% Else If password is weak:
+% throw forbidden
% Else -> // calculate password hash server side
% newDoc.password_sha = hash_pw(newDoc.password + salt)
% newDoc.salt = salt
