- fixed initdb_from_csv.py to empty passwords (not bcrypt).

- fixed myauth.py to use bcrypt.

- fixed initdb_from_csv.py to empty passwords (not bcrypt).
- fixed myauth.py to use bcrypt.
Miguel Barão
1 parent 6d8bb39a
Showing 2 changed files with 29 additions and 32 deletions Show diff stats
initdb_from_csv.py
myauth.py
@@ -15,12 +15,10 @@ def fixname(s):
 def genstudent(reader, pw=''):
     for i, r in enumerate(reader):
-        print('\rInserting students into database... [{}]'.format(i+1), end='')
         num = r['N.º']
         name = fixname(r['Nome'])
-        pwhash = bcrypt.hashpw(pw.encode('utf-8'), bcrypt.gensalt())
-        yield (num, name, pwhash)
-    print('\nDone.')
+        yield (r['N.º'], fixname(r['Nome']), '')
+    print('{} students inserted.'.format(i+1))
 # ---- DATABASE SCHEMA ----
 sql_cmd = '''PRAGMA foreign_keys = ON;
@@ -49,12 +47,11 @@ sql_cmd = &#39;&#39;&#39;PRAGMA foreign_keys = ON;
 # --------- Parse command line options -----------
 argparser = argparse.ArgumentParser(description='Create new database from a CSV file (SIIUE format)')
 argparser.add_argument('--db', default='students.db', type=str, help='database filename')
-argparser.add_argument('--pw', default='', type=str, help='initial password')
 argparser.add_argument('csvfile', type=str, help='CSV filename')
 args = argparser.parse_args()
-# -------- Parse CSV  --------
+# --------- Parse CSV  --------
 with open(args.csvfile, encoding='iso-8859-1') as csvfile:   # SIIUE format
     reader = csv.DictReader(csvfile, delimiter=';', quotechar='"')
     db_exists = os.path.exists(args.db)
@@ -63,13 +60,12 @@ with open(args.csvfile, encoding=&#39;iso-8859-1&#39;) as csvfile:   # SIIUE format
         if not db_exists:
             print('Creating new database "{}"...'.format(args.db))
             c.executescript(sql_cmd)
-            pwhash = bcrypt.hashpw(pw.encode('utf-8'), bcrypt.gensalt())
-            c.execute('INSERT INTO students VALUES (?,?,?)', ('0', 'Professor', pwhash))
+            c.execute('INSERT INTO students VALUES (?,?,?)', ('0', 'Professor', ''))
         else:
             print('Database "{}" already exists.'.format(args.db))
-        print('Warning: Passwords are generated using bcrypt wich takes a lot of time...')
+        print('Inserting students into database... ', end='')
         try:
-            c.executemany('INSERT INTO students VALUES (?,?,?)', genstudent(reader, args.pw))
+            c.executemany('INSERT INTO students VALUES (?,?,?)', genstudent(reader))
         except sqlite3.IntegrityError:
             print('\rStudents already in the database. Aborting!!!')
@@ -7,7 +7,7 @@
 import cherrypy
 import sqlite3
-from hashlib import sha256
+import bcrypt
 from mako.lookup import TemplateLookup
 import urllib
 import html
@@ -27,33 +27,34 @@ def credentials_ok(uid, password, db):
     updated if it's initially empty.
     Returns the name of the student on success, otherwise returns None.
     '''
-    success = False
-    tryhash = sha256(password.encode('utf-8')).hexdigest()
+    # success = False
+    # tryhash = sha256(password.encode('utf-8')).hexdigest()
     # search student in database
-    conn = sqlite3.connect(db)
-    sql_cmd = 'SELECT * FROM students WHERE number=?'
-    found = conn.execute(sql_cmd, [uid]).fetchone()
-    if found is not None:
-        num, name, pw_hash = found
-        if pw_hash == '':
+    with sqlite3.connect(db) as c:
+        sql_cmd = 'SELECT name,password FROM students WHERE number=?'
+        try:
+            name, pwhash = c.execute(sql_cmd, [uid]).fetchone()
+        except:
+            cherrypy.log.error('Student %s not found!' % uid, 'APPLICATION')
+            return None
+
+        # student found in db
+        if pwhash == '':
             # update password on first login
-            pw_hash = tryhash
+            hashed = bcrypt.hashpw(password.encode('utf-8'), bcrypt.gensalt())
             sql_cmd = 'UPDATE students SET password=? WHERE number=?'
-            conn.execute(sql_cmd, (pw_hash, num))
-            conn.commit()
+            c.execute(sql_cmd, (hashed, uid))
             cherrypy.log.error('Student %s updated his password.' % uid, 'APPLICATION')
-
-        # check password
-        success = (tryhash == pw_hash)
-        if success:
-            cherrypy.log.error('Student %s logged in.' % uid, 'APPLICATION')
+            return name
         else:
-            cherrypy.log.error('Student %s wrong password.' % uid, 'APPLICATION')
-    else:
-        cherrypy.log.error('Student %s not found!' % uid, 'APPLICATION')
-    conn.close()
-    return name if success else None
+            # check password
+            if bcrypt.hashpw(password.encode('utf-8'), pwhash) == pwhash:
+                cherrypy.log.error('Student %s logged in.' % uid, 'APPLICATION')
+                return name
+            else:
+                cherrypy.log.error('Student %s wrong password.' % uid, 'APPLICATION')
+                return None
 def check_auth(*args, **kwargs):