1 files changed, 199 insertions, 91 deletions
diff --git a/Emby.Server.Implementations/Library/DefaultAuthenticationProvider.cs b/Emby.Server.Implementations/Library/DefaultAuthenticationProvider.cs
index 4013ac0c8..2ac3ef424 100644
--- a/Emby.Server.Implementations/Library/DefaultAuthenticationProvider.cs
+++ b/Emby.Server.Implementations/Library/DefaultAuthenticationProvider.cs
@@ -1,104 +1,212 @@
-using System;
-using System.Text;
-using System.Threading.Tasks;
-using MediaBrowser.Controller.Authentication;
-using MediaBrowser.Controller.Entities;
-using MediaBrowser.Model.Cryptography;
-
-namespace Emby.Server.Implementations.Library
-{
-    public class DefaultAuthenticationProvider : IAuthenticationProvider, IRequiresResolvedUser
-    {
-        private readonly ICryptoProvider _cryptographyProvider;
-        public DefaultAuthenticationProvider(ICryptoProvider crypto)
-        {
-            _cryptographyProvider = crypto;
-        }
-
-        public string Name => "Default";
-
-        public bool IsEnabled => true;
-
-        public Task<ProviderAuthenticationResult> Authenticate(string username, string password)
-        {
-            throw new NotImplementedException();
-        }
-
-        public Task<ProviderAuthenticationResult> Authenticate(string username, string password, User resolvedUser)
-        {
-            if (resolvedUser == null)
-            {
-                throw new Exception("Invalid username or password");
+using System;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+using MediaBrowser.Controller.Authentication;
+using MediaBrowser.Controller.Entities;
+using MediaBrowser.Model.Cryptography;
+
+namespace Emby.Server.Implementations.Library
+{
+    public class DefaultAuthenticationProvider : IAuthenticationProvider, IRequiresResolvedUser
+    {
+        private readonly ICryptoProvider _cryptographyProvider;
+        public DefaultAuthenticationProvider(ICryptoProvider crypto)
+        {
+            _cryptographyProvider = crypto;
+        }
+
+        public string Name => "Default";
+
+        public bool IsEnabled => true;
+
+
+        //This is dumb and an artifact of the backwards way auth providers were designed.
+        //This version of authenticate was never meant to be called, but needs to be here for interface compat
+        //Only the providers that don't provide local user support use this
+        public Task<ProviderAuthenticationResult> Authenticate(string username, string password)
+        {
+            throw new NotImplementedException();
+        }
+
+
+        //This is the verson that we need to use for local users. Because reasons.
+        public Task<ProviderAuthenticationResult> Authenticate(string username, string password, User resolvedUser)
+        {
+            bool success = false;
+            if (resolvedUser == null)
+            {
+                throw new Exception("Invalid username or password");
             }
 
-            var success = string.Equals(GetPasswordHash(resolvedUser), GetHashedString(resolvedUser, password), StringComparison.OrdinalIgnoreCase);
-
-            if (!success)
+            //As long as jellyfin supports passwordless users, we need this little block here to accomodate
+            if (IsPasswordEmpty(resolvedUser, password))
             {
-                throw new Exception("Invalid username or password");
+                return Task.FromResult(new ProviderAuthenticationResult
+                {
+                    Username = username
+                });
             }
-
-            return Task.FromResult(new ProviderAuthenticationResult
+
+            ConvertPasswordFormat(resolvedUser);
+            byte[] passwordbytes = Encoding.UTF8.GetBytes(password);
+
+            PasswordHash readyHash = new PasswordHash(resolvedUser.Password);
+            byte[] CalculatedHash;
+            string CalculatedHashString;
+            if (_cryptographyProvider.GetSupportedHashMethods().Contains(readyHash.Id))
+            {
+                if (string.IsNullOrEmpty(readyHash.Salt))
+                {
+                    CalculatedHash = _cryptographyProvider.ComputeHash(readyHash.Id, passwordbytes);
+                    CalculatedHashString = BitConverter.ToString(CalculatedHash).Replace("-", string.Empty);
+                }
+                else
+                {
+                    CalculatedHash = _cryptographyProvider.ComputeHash(readyHash.Id, passwordbytes, readyHash.SaltBytes);
+                    CalculatedHashString = BitConverter.ToString(CalculatedHash).Replace("-", string.Empty);
+                }
+
+                if (CalculatedHashString == readyHash.Hash)
+                {
+                    success = true;
+                    //throw new Exception("Invalid username or password");
+                }
+            }
+            else
+            {
+                throw new Exception(String.Format($"Requested crypto method not available in provider: {readyHash.Id}"));
+            }
+
+            //var success = string.Equals(GetPasswordHash(resolvedUser), GetHashedString(resolvedUser, password), StringComparison.OrdinalIgnoreCase);
+
+            if (!success)
+            {
+                throw new Exception("Invalid username or password");
+            }
+
+            return Task.FromResult(new ProviderAuthenticationResult
+            {
+                Username = username
+            });
+        }
+
+        //This allows us to move passwords forward to the newformat without breaking. They are still insecure, unsalted, and dumb before a password change
+        //but at least they are in the new format.
+        private void ConvertPasswordFormat(User user)
+        {
+            if (!string.IsNullOrEmpty(user.Password))
             {
-                Username = username
-            });
-        }
-
-        public Task<bool> HasPassword(User user)
-        {
-            var hasConfiguredPassword = !IsPasswordEmpty(user, GetPasswordHash(user));
-            return Task.FromResult(hasConfiguredPassword);
-        }
-
-        private bool IsPasswordEmpty(User user, string passwordHash)
-        {
-            return string.Equals(passwordHash, GetEmptyHashedString(user), StringComparison.OrdinalIgnoreCase);
-        }
-
-        public Task ChangePassword(User user, string newPassword)
+                return;
+            }
+
+            if (!user.Password.Contains("$"))
+            {
+                string hash = user.Password;
+                user.Password = String.Format("$SHA1${0}", hash);
+            }
+            
+            if (user.EasyPassword != null && !user.EasyPassword.Contains("$"))
+            {
+                string hash = user.EasyPassword;
+                user.EasyPassword = string.Format("$SHA1${0}", hash);
+            }
+        }
+
+        public Task<bool> HasPassword(User user)
+        {
+            var hasConfiguredPassword = !IsPasswordEmpty(user, GetPasswordHash(user));
+            return Task.FromResult(hasConfiguredPassword);
+        }
+
+        private bool IsPasswordEmpty(User user, string password)
         {
-            string newPasswordHash = null;
-
-            if (newPassword != null)
+            if (string.IsNullOrEmpty(user.Password))
             {
-                newPasswordHash = GetHashedString(user, newPassword);
+                return string.IsNullOrEmpty(password);
             }
 
-            if (string.IsNullOrWhiteSpace(newPasswordHash))
+            return false;
+        }
+
+        public Task ChangePassword(User user, string newPassword)
+        {
+            ConvertPasswordFormat(user);
+            //This is needed to support changing a no password user to a password user
+            if (string.IsNullOrEmpty(user.Password))
             {
-                throw new ArgumentNullException(nameof(newPasswordHash));
+                PasswordHash newPasswordHash = new PasswordHash(_cryptographyProvider);
+                newPasswordHash.SaltBytes = _cryptographyProvider.GenerateSalt();
+                newPasswordHash.Salt = PasswordHash.ConvertToByteString(newPasswordHash.SaltBytes);
+                newPasswordHash.Id = _cryptographyProvider.DefaultHashMethod;
+                newPasswordHash.Hash = GetHashedStringChangeAuth(newPassword, newPasswordHash);
+                user.Password = newPasswordHash.ToString();
+                return Task.CompletedTask;
             }
 
-            user.Password = newPasswordHash;
-
-            return Task.CompletedTask;
-        }
-
-        public string GetPasswordHash(User user)
-        {
-            return string.IsNullOrEmpty(user.Password)
-                ? GetEmptyHashedString(user)
-                : user.Password;
-        }
-
-        public string GetEmptyHashedString(User user)
-        {
-            return GetHashedString(user, string.Empty);
-        }
-
-        /// <summary>
-        /// Gets the hashed string.
-        /// </summary>
-        public string GetHashedString(User user, string str)
-        {
-            var salt = user.Salt;
-            if (salt != null)
-            {
-                // return BCrypt.HashPassword(str, salt);
+            PasswordHash passwordHash = new PasswordHash(user.Password);
+            if (passwordHash.Id == "SHA1" && string.IsNullOrEmpty(passwordHash.Salt))
+            {
+                passwordHash.SaltBytes = _cryptographyProvider.GenerateSalt();
+                passwordHash.Salt = PasswordHash.ConvertToByteString(passwordHash.SaltBytes);
+                passwordHash.Id = _cryptographyProvider.DefaultHashMethod;
+                passwordHash.Hash = GetHashedStringChangeAuth(newPassword, passwordHash);
+            }
+            else if (newPassword != null)
+            {
+                passwordHash.Hash = GetHashedString(user, newPassword);
+            }
+
+            if (string.IsNullOrWhiteSpace(passwordHash.Hash))
+            {
+                throw new ArgumentNullException(nameof(passwordHash.Hash));
+            }
+
+            user.Password = passwordHash.ToString();
+
+            return Task.CompletedTask;
+        }
+
+        public string GetPasswordHash(User user)
+        {
+            return user.Password;
+        }
+
+        public string GetHashedStringChangeAuth(string newPassword, PasswordHash passwordHash)
+        {
+            passwordHash.HashBytes = Encoding.UTF8.GetBytes(newPassword);
+            return PasswordHash.ConvertToByteString(_cryptographyProvider.ComputeHash(passwordHash));
+        }
+
+        /// <summary>
+        /// Gets the hashed string.
+        /// </summary>
+        public string GetHashedString(User user, string str)
+        {
+            PasswordHash passwordHash;
+            if (String.IsNullOrEmpty(user.Password))
+            {
+                passwordHash = new PasswordHash(_cryptographyProvider);
+            }
+            else
+            {
+                ConvertPasswordFormat(user);
+                passwordHash = new PasswordHash(user.Password);
             }
-
-            // legacy
-            return BitConverter.ToString(_cryptographyProvider.ComputeSHA1(Encoding.UTF8.GetBytes(str))).Replace("-", string.Empty);
-        }
-    }
-}
+
+            if (passwordHash.SaltBytes != null)
+            {
+                //the password is modern format with PBKDF and we should take advantage of that
+                passwordHash.HashBytes = Encoding.UTF8.GetBytes(str);
+                return PasswordHash.ConvertToByteString(_cryptographyProvider.ComputeHash(passwordHash));
+            }
+            else
+            {
+                //the password has no salt and should be called with the older method for safety
+                return PasswordHash.ConvertToByteString(_cryptographyProvider.ComputeHash(passwordHash.Id, Encoding.UTF8.GetBytes(str)));
+            }
+
+
+        }
+    }
+}