ZXzx2c4·Nov 24, 2015
Another service using pathetic password hashing:
https://github.com/hmngwy/weblog.sh/blob/master/lib/ssh/exec...
else if(command[0] === 'password') {
if(args.length===0) {
stream.write('→ You need to specify a password.\n\r');
stream.end();
return;
}
var hash = require('sha256');
var payload = args;
var salt = schemas.randomString(32);
userMeta.user.hash = hash(payload + salt);
userMeta.user.salt = salt;
userMeta.user.token = schemas.randomString(64);
stream.write('… Saving new password'+LB);
userMeta.user.save(function(err, saved){
if(err){
stream.write('→ Password update failed.'+LB);
}
var response = [];
response.push("→ password for "+saved.username+" updated"+LB);
Read the rest
stream.write(response.join(LB));
stream.exit(0);
stream.end();
});
}