From 03545f2f01f16797de495cd10e57cea28f2a8e29 Mon Sep 17 00:00:00 2001 From: Kenneth Skovhede Date: Sat, 11 May 2013 13:14:07 +0200 Subject: [PATCH] Removed password from the dblocator criteria. Because it is unsafe to store an unsalted password hash, and because it is unlikely that the destination will differ with password (i.e. multiple accounts for same username but with different passwords). --- Duplicati/Library/Main/DatabaseLocator.cs | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/Duplicati/Library/Main/DatabaseLocator.cs b/Duplicati/Library/Main/DatabaseLocator.cs index b3ecc41c7..0d50b263c 100644 --- a/Duplicati/Library/Main/DatabaseLocator.cs +++ b/Duplicati/Library/Main/DatabaseLocator.cs @@ -31,7 +31,7 @@ namespace Duplicati.Library.Main public string Path; public string Prefix; public string Username; - public string Passwordhash; + //public string Passwordhash; public int Port; public string Databasepath; public string ParameterFile; @@ -87,13 +87,13 @@ namespace Duplicati.Library.Main } if (password != null) - password = Library.Utility.Utility.ByteArrayAsHexString(System.Security.Cryptography.SHA256.Create().ComputeHash(System.Text.Encoding.UTF8.GetBytes(password))); + password = Library.Utility.Utility.ByteArrayAsHexString(System.Security.Cryptography.SHA256.Create().ComputeHash(System.Text.Encoding.UTF8.GetBytes(password + "!" + uri.Scheme + "!" + uri.HostAndPath))); //Now find the one that matches :) var matches = (from n in configs where n.Type == type && - n.Passwordhash == password && + //n.Passwordhash == password && n.Username == username && n.Port == port && n.Server == server && @@ -130,7 +130,7 @@ namespace Duplicati.Library.Main Path = path, Prefix = prefix, Username = username, - Passwordhash = password, + //Passwordhash = password, Port = port, Databasepath = newpath, ParameterFile = null