Обновить darkbazaar/src/auth.py

darkbazaar/src/auth.py

@@ -1,9 +1,11 @@
-from passlib.context import CryptContext
+from passlib.context import CryptContext
-
+
-ctx = CryptContext(schemes=["pbkdf2_sha256"], pbkdf2_sha256__rounds=1)
+# SECURITY FIX: Use proper PBKDF2 rounds (29000+ recommended, using 260000 for better security)
-
+# Previously was using only 1 round which made password cracking trivial
-def get_password_hash(password: str) -> str:
+ctx = CryptContext(schemes=["pbkdf2_sha256"], pbkdf2_sha256__rounds=260000)
-    return ctx.hash(password)
+
-
+def get_password_hash(password: str) -> str:
-def verify_password(plain_password: str, hashed_password: str) -> bool:
+    return ctx.hash(password)
-    return ctx.verify(plain_password, hashed_password)
+
+def verify_password(plain_password: str, hashed_password: str) -> bool:
+    return ctx.verify(plain_password, hashed_password)