Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
app.get("/", function(req, res) {
var salt = bcrypt.gen_salt_sync(10);
var hash = bcrypt.encrypt_sync("B4c0/\/", salt);
if (bcrypt.compare_sync("B4c0/\/", hash))
res.send("hello from express");
else
res.send("");
});
bootstrap: function (email, password, extra_fields) {
var salt = bcrypt.gen_salt_sync(10);
var hash = bcrypt.encrypt_sync(password, salt);
redis.hmset(req.body.email, "encrypted_password", hash, "email", email, function (err) {
console.log("Bootstrapped user authentication system");
});
}
};
validateUserData = function (req, callback) {
errors = [];
data = {};
if (req.param('password')) {
if (req.param('password').length < 5) {
errors.push('Password too short.');
}
else if (req.param('password') !== req.param('password_confirm')) {
errors.push('Passwords did not match.' + req.param('password' + ' ' + req.param('password_confirm')));
}
else {
var salt = bcrypt.gen_salt_sync(10);
var hash = bcrypt.encrypt_sync(req.param('password'), salt);
data.password = hash;
}
}
else if (!req.param('id')) {
errors.push('Password required.');
}
if (!req.param('username')) {
errors.push('Username required.');
}
if (!req.param('name')) {
errors.push('Name required.');
}
if (!/.*@.*\..*/.test(req.param('email'))){
errors.push('Valid email required.');
}
if (errors.length == 0) {
postgresql.query('CREATE TABLE IF NOT EXISTS "users" ( "id" int4 NOT NULL DEFAULT nextval(\'users_id_seq\'::regclass), "email" varchar(255) NOT NULL DEFAULT NULL, "crypted_password" varchar(255) NOT NULL DEFAULT NULL, "persistence_token" varchar(255) NOT NULL DEFAULT NULL, "perishable_token" varchar(255) NOT NULL DEFAULT NULL, "login_count" int4 NOT NULL DEFAULT 0, "last_request_at" timestamp(6) NULL DEFAULT NULL, "current_login_at" timestamp(6) NULL DEFAULT NULL, "last_login_at" timestamp(6) NULL DEFAULT NULL, "current_login_ip" varchar(255) DEFAULT NULL, "last_login_ip" varchar(255) DEFAULT NULL'+extra_fields+') WITH (OIDS=FALSE);', function (err, result) {
var salt = bcrypt.gen_salt_sync(10);
var hash = bcrypt.encrypt_sync(password, salt);
postgresql.query("insert into users (email, crypted_password) VALUES ($1, $2)", [email, hash], function (err1, res2) {
console.log("Bootstrapped user authentication system");
});
});
}
adminUserModel.findOne({'username': username}, function(err, adminUserData) {
if (err) {
console.log('Unable to check if admin user exists because: ' + err);
oReady('Unable to check if user exist', null);
} else {
if (adminUserData) {
var salt = bcrypt.gen_salt_sync(10);
adminUserData.passwordHash = bcrypt.encrypt_sync(password, salt);
} else {
adminUserData = new adminUserModel();
adminUserData.username = username;
var salt = bcrypt.gen_salt_sync(10);
adminUserData.passwordHash = bcrypt.encrypt_sync(password, salt);
}
adminUserData.save(function(err) {
if (err) {
console.log('Unable to create or update admin user because: ' + err);
onReady('Unable to create or update admin user', null);
} else {
adminUser.fields = adminUserData;
onReady(null, adminUser);
}
});
}
exports.createUser = function (userId, password, fullname, callback)
{
var salt = bcrypt.gen_salt_sync(10);
var hash = bcrypt.encrypt_sync(password, salt);
var userJSON = JSON.stringify({password: hash, fullname: fullname, dateRegistered:new Date().getTime()});
client.query("INSERT INTO `primarywall`.`user` VALUES(?,?)", [userId, userJSON], function (err, results, fields)
{
var success=err == null;
if(err)
{
//mysql problem
console.error("MYSQL_ERROR: " + JSON.stringify(err));
}
if(callback) callback(success);
});
}
getUser(req.body.email, function (user) {
if (user) {
if (user.last_request_at < (+helpers.yesterday()) || req.body.psk != user.perishable_token) {
redir();
} else if (req.body.password && req.body.password.length > 6 && req.body.password.length < 200 && req.body.password == req.body.password_confirmation) {
var salt = bcrypt.gen_salt_sync(10);
var hash = bcrypt.encrypt_sync(req.body.password, salt);
var pt = helpers.persistence_token()
user.encrypted_password = hash;
user.persistence_token = pt;
user.last_login_at = user.current_login_at;
user.last_login_ip = user.current_login_ip;
user.current_login_at = +(new Date());
user.current_login_ip = req.connection.remoteAddress;
saveUser(user, function () {
req.session.pt = pt;
res.render(__dirname+"/views/updated_password", {layout: __dirname+"/views/layout"});
}, redir);
} else {
res.render(__dirname+"/views/update_password", {
layout: __dirname+"/views/layout",
psk: req.params.psk,
userDb.findOne({is_root:'on'}, function(error, result) {
if (error) {
log.warn('Could not determine if this is the first run. Is mongodb running?');
}
else if(!result) {
log.info('Looks like this is your first run! Hello and Welcome.');
var newPassword = '';
var newUserData = {};
newPassword = newPassword.randomString(10);
var salt = bcrypt.gen_salt_sync(10);
var newPasswordHash = bcrypt.encrypt_sync(newPassword, salt);
getNextInt('users', function(error, count) {
if (error) {
log.error('Couldn\'t create admin user id. Is mongo running? Error: ' + error);
} else {
newUserData = { "_id" : count,
"email" : "admin@example.com",
"is_admin" : 'on',
"is_root" : 'on',
"name" : "Mister Admin",
"password" : newPasswordHash,
"username" : "admin" }
newUserData.created_at = new Date();
newUserData.modified_at = new Date();
userDb.insert( newUserData, function( error, userData) {
if (error) {
log.error('Couldn\'t insert admin user. Is mongo running? Error: ' + error);
update_password: function (req, res) {
if (req.body.psk) {
if (req.body.password && req.body.password.length > 6 && req.body.password.length < 200 && req.body.password == req.body.password_confirmation) {
var salt = bcrypt.gen_salt_sync(10);
var hash = bcrypt.encrypt_sync(req.body.password, salt);
var pt = helpers.persistence_token()
postgresql.query("update users set crypted_password = $1, persistence_token = $4 where perishable_token = $2 and last_request_at >= $3;", [hash, req.body.psk, helpers.yesterday(), pt], function (err, update_res) {
req.session.pt = pt;
res.sendfile(__dirname+"/static/updated.html");
});
} else {
res.redirect("/login/reset/"+h(req.body.psk))
}
} else {
res.redirect("/forgot_password");
}
},
logout: function (req, res) {
resetPassword = function (userId, callback) {
//check to see if email exists
var newPassword = '';
newPassword = newPassword.randomString(10);
var salt = bcrypt.gen_salt_sync(10);
var hash = bcrypt.encrypt_sync(newPassword, salt);
var data = {}
data.password = hash;
userDb.update(
{_id: parseInt(userId)}
, {$set: data}
, {multi:false,safe:true}
, function( error, docs) {
if (error) {
callback(error);
}
else {
callback(null, newPassword);
}
});
}