Merge pull request #3 from fzoske/master

Add Support For BCrypt Storage of Passwords

.travis.yml

@@ -9,10 +9,7 @@ install:
   - go get ./...
   # Install gometalinter and certain linters
   - go get github.com/alecthomas/gometalinter
-  - go get github.com/client9/misspell/cmd/misspell
+  - gometalinter --install
-  - go get github.com/gordonklaus/ineffassign
-  - go get golang.org/x/tools/cmd/goimports
-  - go get github.com/tsenart/deadcode
 
 script:
   - gometalinter --disable-all -E vet -E gofmt -E misspell -E ineffassign -E goimports -E deadcode --tests ./...

cmd/webdav/main.go

@@ -11,8 +11,10 @@ import (
 	"os"
 	"path/filepath"
 	"regexp"
+	"strings"
 
 	"github.com/hacdias/webdav"
+	"golang.org/x/crypto/bcrypt"
 	wd "golang.org/x/net/webdav"
 	yaml "gopkg.in/yaml.v2"
 )
@@ -133,24 +135,27 @@ func getConfig() []byte {
 }
 
 type cfg struct {
-	webdav *webdav.Config
+	webdav  *webdav.Config
-	port   string
+	address string
-	auth   map[string]string
+	port    string
+	auth    map[string]string
 }
 
 func parseConfig() *cfg {
 	file := getConfig()
 
 	data := struct {
-		Port   string                   `json:"port" yaml:"port"`
+		Address string                   `json:"address" yaml:"address"`
-		Scope  string                   `json:"scope" yaml:"scope"`
+		Port    string                   `json:"port" yaml:"port"`
-		Modify bool                     `json:"modify" yaml:"modify"`
+		Scope   string                   `json:"scope" yaml:"scope"`
-		Rules  []map[string]interface{} `json:"rules" yaml:"rules"`
+		Modify  bool                     `json:"modify" yaml:"modify"`
-		Users  []map[string]interface{} `json:"users" yaml:"users"`
+		Rules   []map[string]interface{} `json:"rules" yaml:"rules"`
+		Users   []map[string]interface{} `json:"users" yaml:"users"`
 	}{
-		Port:   "0",
+		Address: "0.0.0.0",
-		Scope:  "./",
+		Port:    "0",
-		Modify: true,
+		Scope:   "./",
+		Modify:  true,
 	}
 
 	var err error
@@ -165,8 +170,9 @@ func parseConfig() *cfg {
 	}
 
 	config := &cfg{
-		port: data.Port,
+		address: data.Address,
-		auth: map[string]string{},
+		port:    data.Port,
+		auth:    map[string]string{},
 		webdav: &webdav.Config{
 			User: &webdav.User{
 				Scope:  data.Scope,
@@ -209,7 +215,8 @@ func basicAuth(c *cfg) http.Handler {
 			return
 		}
 
-		if password != p {
+		if !checkPassword(p, password) {
+			log.Println("Wrong Password for user", username)
 			http.Error(w, "Not authorized", 401)
 			return
 		}
@@ -218,13 +225,23 @@ func basicAuth(c *cfg) http.Handler {
 	})
 }
 
+func checkPassword(saved, input string) bool {
+
+	if strings.HasPrefix(saved, "{bcrypt}") {
+		savedPassword := strings.TrimPrefix(saved, "{bcrypt}")
+		return bcrypt.CompareHashAndPassword([]byte(savedPassword), []byte(input)) == nil
+	}
+
+	return saved == input
+}
+
 func main() {
 	flag.Parse()
 	cfg := parseConfig()
 	handler := basicAuth(cfg)
 
 	// Builds the address and a listener.
-	laddr := ":" + cfg.port
+	laddr := cfg.address + ":" + cfg.port
 	listener, err := net.Listen("tcp", laddr)
 	if err != nil {
 		log.Fatal(err)

readme.md

@@ -7,10 +7,13 @@
 
 ```yaml
 scope: /path/to/files
+address: 0.0.0.0
 port: 8080
 users:
   - username: admin
     password: admin
+  - username: encrypted
+    password: "{bcrypt}$2y$10$zEP6oofmXFeHaeMfBNLnP.DO8m.H.Mwhd24/TOX2MWLxAExXi4qgi"
   - username: basic
     password: basic
     modify:   false
@@ -22,4 +25,4 @@ users:
 
 You can specify the path to the configuration file using the `--config` flag. By default, it will search for a `config.{yaml,json}` file on your current working directory.
 
-Download it [here](https://github.com/hacdias/webdav/releases).
+Download it [here](https://github.com/hacdias/webdav/releases).