- @Model.ToLocalTime().ToString("MMM d")
+ @Model.ToLocalTime().ToString("MM-dd")
@Model.ToLocalTime().ToString("yyyy")
\ No newline at end of file
diff --git a/src/FunnelWeb.Web/Views/Shared/_Mobile.cshtml b/src/FunnelWeb.Web/Views/Shared/_Mobile.cshtml
index 56e3de52..83d07a12 100644
--- a/src/FunnelWeb.Web/Views/Shared/_Mobile.cshtml
+++ b/src/FunnelWeb.Web/Views/Shared/_Mobile.cshtml
@@ -6,7 +6,7 @@
- @Styles.Render("~/Content/css")
+ @Styles.Render("~/Content/themes/base/baseCss")
@Styles.Render("~/Content/themes/base/css")
@RenderSection("Meta", required: false)
diff --git a/src/FunnelWeb.Web/Views/Shared/_Public.cshtml b/src/FunnelWeb.Web/Views/Shared/_Public.cshtml
index 9671051a..6fd8e59e 100644
--- a/src/FunnelWeb.Web/Views/Shared/_Public.cshtml
+++ b/src/FunnelWeb.Web/Views/Shared/_Public.cshtml
@@ -17,7 +17,7 @@
- @Styles.Render("~/Content/css")
+ @Styles.Render("~/Content/themes/base/baseCss")
@Styles.Render("~/Content/themes/base/css")
@RenderSection("Meta", required: false)
@@ -94,6 +94,7 @@
@Scripts.Render("~/bundles/prettify")
@MiniProfiler.RenderIncludes()
+ @MvcHtmlString.Create(Html.Settings().HtmlFooter)
@if (IsSectionDefined("Scripts"))
{
@RenderSection("Scripts")
diff --git a/src/FunnelWeb.Web/Views/Wiki/Search.cshtml b/src/FunnelWeb.Web/Views/Wiki/Search.cshtml
index 6aa7dad1..24a530ae 100644
--- a/src/FunnelWeb.Web/Views/Wiki/Search.cshtml
+++ b/src/FunnelWeb.Web/Views/Wiki/Search.cshtml
@@ -41,7 +41,7 @@
@entry.MetaDescription)
}
- @entry.Published.ToString("MMM d")
+ @entry.Published.ToString("MM-dd")
@entry.Published.ToString("yyyy")
diff --git a/src/FunnelWeb/Authentication/Internal/SqlAuthenticator.cs b/src/FunnelWeb/Authentication/Internal/SqlAuthenticator.cs
index 03f22d88..8cd3e66f 100644
--- a/src/FunnelWeb/Authentication/Internal/SqlAuthenticator.cs
+++ b/src/FunnelWeb/Authentication/Internal/SqlAuthenticator.cs
@@ -65,9 +65,17 @@ private bool UseFormsAuthentication
private bool SqlAuthenticateAndLogin(string username, string password)
{
- var user = sessionFactory().QueryOver()
- .Where(u => u.Username == username && u.Password == SqlFunnelWebMembership.HashPassword(password))
- .SingleOrDefault();
+ //var user = sessionFactory().QueryOver()
+ // .Where(u => u.Username == username && u.Password == SqlFunnelWebMembership.HashPassword(password, u.Salt))
+ // .SingleOrDefault();
+
+ var user = sessionFactory().QueryOver()
+ .Where( u => u.Username == username ).SingleOrDefault();
+ if ( user != null ) {
+ string pwd = SqlFunnelWebMembership.HashPassword( password, user.Salt );
+ if ( pwd != user.Password )
+ user = null;
+ }
if (user != null)
{
diff --git a/src/FunnelWeb/Authentication/Internal/SqlFunnelWebMembership.cs b/src/FunnelWeb/Authentication/Internal/SqlFunnelWebMembership.cs
index 8543010a..266dcc78 100644
--- a/src/FunnelWeb/Authentication/Internal/SqlFunnelWebMembership.cs
+++ b/src/FunnelWeb/Authentication/Internal/SqlFunnelWebMembership.cs
@@ -1,5 +1,6 @@
using System;
using System.Collections.Generic;
+using System.Text;
using System.Web.Configuration;
using System.Web.Mvc;
using System.Web.Security;
@@ -27,9 +28,11 @@ public User CreateAccount(string name, string email, string username, string pas
{
Name = name,
Email = email,
- Password = HashPassword(password),
+ Salt = Utilities.StringExtensions.NewGuid_PlainLower(),
+ //Password = HashPassword(password),
Username = username
};
+ user.Password = HashPassword( password, user.Salt );
DependencyResolver.Current.GetService().Save(user);
return user;
@@ -43,9 +46,48 @@ public IEnumerable GetUsers()
.List();
}
- internal static string HashPassword(string password)
- {
- return FormsAuthentication.HashPasswordForStoringInConfigFile(password, FormsAuthPasswordFormat.SHA1.ToString());
+ // original method
+ //internal static string HashPassword( string password ) {
+ // return FormsAuthentication.HashPasswordForStoringInConfigFile( password, FormsAuthPasswordFormat.SHA1.ToString() );
+ //}
+
+ ///
+ /// 更安全的验证方式。Jerin.2013.3.9
+ ///
+ ///
+ ///
+ internal static string HashPassword( string password, string salt ) {
+ // should add Salt to User first
+ return IntensifyPassword( password, salt );
}
+
+ ///
+ /// 增强密码（二次加密）
+ ///
+ ///
+ ///
+ ///
+ internal static string IntensifyPassword( string pwd, string salt ) {
+ string part1 = FormsAuthentication.HashPasswordForStoringInConfigFile( pwd, FormsAuthPasswordFormat.SHA1.ToString() );
+ string part2 = FormsAuthentication.HashPasswordForStoringInConfigFile( salt, FormsAuthPasswordFormat.SHA1.ToString() );
+ // part1和part2都是长为40的字符串，总长即80，将其视为一个5X16的矩阵
+ // 排列规则为，依次从part1和part2中取一个字符，从左到右、从上到下排列
+ StringBuilder sb = new StringBuilder();
+ // 下面的双重循环是从5x16的矩阵中，5行16列，每行选取8个最后仍然是40个字符
+ for ( int i = 0; i < 5; i++ ) {
+ for ( int j = 0; j < 8; j++ ) {
+ int pos = i * 8 + j;
+ if ( i % 2 == 0 ) { // 奇数行: part1
+ sb.Append( part1[pos] );
+ }
+ else { // 偶数行: part2
+ sb.Append( part2[pos] );
+ }
+ }
+ }
+ // 再次加密
+ return FormsAuthentication.HashPasswordForStoringInConfigFile( sb.ToString(), FormsAuthPasswordFormat.SHA1.ToString() );
+ }
+
}
}
diff --git a/src/FunnelWeb/DatabaseDeployer/Scripts/Script0033.sql b/src/FunnelWeb/DatabaseDeployer/Scripts/Script0033.sql
new file mode 100644
index 00000000..e8df2845
--- /dev/null
+++ b/src/FunnelWeb/DatabaseDeployer/Scripts/Script0033.sql
@@ -0,0 +1,3 @@
+--add Salt field to User table
+alter table $schema$.[User] add [Salt] nchar(32) null
+go
\ No newline at end of file
diff --git a/src/FunnelWeb/FunnelWeb.csproj b/src/FunnelWeb/FunnelWeb.csproj
index 1e5f1bfe..0ecb8ed2 100644
--- a/src/FunnelWeb/FunnelWeb.csproj
+++ b/src/FunnelWeb/FunnelWeb.csproj
@@ -386,7 +386,9 @@
-
+
+
+
diff --git a/src/FunnelWeb/Model/Authentication/Mappings/UserMapping.cs b/src/FunnelWeb/Model/Authentication/Mappings/UserMapping.cs
index 5ddbf94f..6549f1d2 100644
--- a/src/FunnelWeb/Model/Authentication/Mappings/UserMapping.cs
+++ b/src/FunnelWeb/Model/Authentication/Mappings/UserMapping.cs
@@ -12,6 +12,7 @@ public UserMapping()
Map(x => x.Username);
Map(x => x.Email);
Map(x => x.Password);
+ Map( x => x.Salt );
HasManyToMany(x => x.Roles)
.AsBag()
.Table("UserRoles")
diff --git a/src/FunnelWeb/Model/Authentication/User.cs b/src/FunnelWeb/Model/Authentication/User.cs
index ee7a34d8..1a531b60 100644
--- a/src/FunnelWeb/Model/Authentication/User.cs
+++ b/src/FunnelWeb/Model/Authentication/User.cs
@@ -15,6 +15,7 @@ public User()
public virtual string Email { get; set; }
public virtual string Username { get; set; }
public virtual string Password { get; set; }
+ public virtual string Salt { get; set; }
public virtual IList Roles { get; protected set; }
}
}
diff --git a/src/FunnelWeb/Providers/File/FileRepositoryBase.cs b/src/FunnelWeb/Providers/File/FileRepositoryBase.cs
index cc046929..f3954f3d 100644
--- a/src/FunnelWeb/Providers/File/FileRepositoryBase.cs
+++ b/src/FunnelWeb/Providers/File/FileRepositoryBase.cs
@@ -22,7 +22,7 @@ protected static string GetImage(string file, string extension)
protected static bool IsZipFile(string fullPath)
{
var extension = Path.GetExtension(fullPath).ToLowerInvariant();
- return extension == "zip" || extension == "gz" || extension == "tar" || extension == "rar";
+ return extension == ".zip" || extension == ".gz" || extension == ".tar" || extension == ".rar";
}
public abstract bool IsFile(string path);
diff --git a/src/FunnelWeb/Utilities/HttpRequestExtensions.cs b/src/FunnelWeb/Utilities/HttpRequestExtensions.cs
index d4d686a1..80dc8673 100644
--- a/src/FunnelWeb/Utilities/HttpRequestExtensions.cs
+++ b/src/FunnelWeb/Utilities/HttpRequestExtensions.cs
@@ -37,7 +37,10 @@ public static Uri GetOriginalUrl(this HttpRequestBase request)
// When the application is run behind a load-balancer (or forward proxy), request.IsSecureConnection returns 'true' or 'false'
// based on the request from the load-balancer to the web server (e.g. IIS) and not the actual request to the load-balancer.
// The same is also applied to request.Url.Scheme (or uriBuilder.Scheme, as in our case).
- bool isSecureConnection = String.Equals(request.Headers["X-Forwarded-Proto"], "https", StringComparison.OrdinalIgnoreCase);
+ bool isSecureConnection =
+ string.IsNullOrWhiteSpace( request.Headers["X-Forwarded-Proto"] )
+ ? request.IsSecureConnection
+ : String.Equals( request.Headers["X-Forwarded-Proto"], "https", StringComparison.OrdinalIgnoreCase );
if (isSecureConnection)
{
diff --git a/src/FunnelWeb/Utilities/StringExtensions.cs b/src/FunnelWeb/Utilities/StringExtensions.cs
index f521d769..20cd8034 100644
--- a/src/FunnelWeb/Utilities/StringExtensions.cs
+++ b/src/FunnelWeb/Utilities/StringExtensions.cs
@@ -1,4 +1,5 @@
-using System.Text.RegularExpressions;
+using System;
+using System.Text.RegularExpressions;
namespace FunnelWeb.Utilities
{
@@ -20,5 +21,14 @@ public static string Slugify(this string value)
value = Regex.Replace(value, @"\s", "-"); // hyphens
return value;
}
+
+ ///
+ /// 创建一个Guid字符串，去掉了所有符号，只剩32位数字或小写字母，如bea8b23f69574b0c8832b5723c3aae71
+ ///
+ ///
+ public static string NewGuid_PlainLower() {
+ return Guid.NewGuid().ToString().Replace( "-", "" ).ToLower();
+ }
+
}
}
diff --git a/to-do.txt b/to-do.txt
new file mode 100644
index 00000000..d7dc4c1a
--- /dev/null
+++ b/to-do.txt
@@ -0,0 +1,12 @@
+last updated: 2013-3-10
+
+1. enhance security: accomplished@0000-00-00
+(1. [database] add Salt to User
+(2. update related classes in FunnelWeb.Model.Authentication
+(3. update the method HashPassword(password, salt) in FunnelWeb.Authentication.Internal.SqlFunnelWebMembership; the detailed algorithm can reference www.chuci.info.
+
+2. create a mechanism to integrate with existed system: accomplished@0000-00-00
+try 1: add prefix to table name in database
+try 2: drop the User table in FunnelWeb and use the related tables in existed system
+
+3. update the content editor to integrate with knowledges from www.chuci.info: accomplished@0000-00-00
\ No newline at end of file