fix: unchanged masked client_secret/password updated to *** (#749)

* feat: hide proxy-test output

* Update build.sh

Co-authored-by: Yang Luo <hsluoyz@qq.com>

build.sh

@@ -1,11 +1,11 @@
 #!/bin/bash
 #try to connect to google to determine whether user need to use proxy
-curl www.google.com -o /dev/null --connect-timeout 5
+curl www.google.com -o /dev/null --connect-timeout 5 2 > /dev/null
 if [ $? == 0 ]
 then
-    echo "connect to google.com successed"
+    echo "Successfully connected to Google, no need to use Go proxy"
     CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags="-w -s" -o server .
 else
-    echo "connect to google.com failed"
+    echo "Google is blocked, Go proxy is enabled: GOPROXY=https://goproxy.cn,direct"
     CGO_ENABLED=0 GOOS=linux GOARCH=amd64 GOPROXY=https://goproxy.cn,direct go build -ldflags="-w -s" -o server .
-fi
+fi

controllers/auth.go

@@ -133,7 +133,7 @@ func (c *ApiController) HandleLoggedIn(application *object.Application, user *ob
 // @Param   scope    query    string  true        "scope"
 // @Param   state    query    string  true        "state"
 // @Success 200 {object} controllers.api_controller.Response The Response object
-// @router /update-application [get]
+// @router /get-app-login [get]
 func (c *ApiController) GetApplicationLogin() {
 	clientId := c.Input().Get("clientId")
 	responseType := c.Input().Get("responseType")

cred/argon2id.go

@@ -0,0 +1,38 @@
+// Copyright 2022 The Casdoor Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package cred
+
+import "github.com/alexedwards/argon2id"
+
+type Argon2idCredManager struct{}
+
+func NewArgon2idCredManager() *Argon2idCredManager {
+	cm := &Argon2idCredManager{}
+	return cm
+}
+
+func (cm *Argon2idCredManager) GetHashedPassword(password string, userSalt string, organizationSalt string) string {
+
+	hash, err := argon2id.CreateHash(password, argon2id.DefaultParams)
+	if err != nil {
+		return ""
+	}
+	return hash
+}
+
+func (cm *Argon2idCredManager) IsPasswordCorrect(plainPwd string, hashedPwd string, userSalt string, organizationSalt string) bool {
+	match, _ := argon2id.ComparePasswordAndHash(plainPwd, hashedPwd)
+	return match
+}

cred/manager.go

@@ -30,6 +30,8 @@ func GetCredManager(passwordType string) CredManager {
 		return NewBcryptCredManager()
 	} else if passwordType == "pbkdf2-salt" {
 		return NewPbkdf2SaltCredManager()
+	} else if passwordType == "argon2id" {
+		return NewArgon2idCredManager()
 	}
 	return nil
 }

go.mod

@@ -4,6 +4,7 @@ go 1.16
 
 require (
 	github.com/RobotsAndPencils/go-saml v0.0.0-20170520135329-fb13cb52a46b
+	github.com/alexedwards/argon2id v0.0.0-20211130144151-3585854a6387
 	github.com/astaxie/beego v1.12.3
 	github.com/aws/aws-sdk-go v1.44.4
 	github.com/beevik/etree v1.1.0

go.sum

@@ -65,6 +65,8 @@ github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuy
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
 github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
+github.com/alexedwards/argon2id v0.0.0-20211130144151-3585854a6387 h1:loy0fjI90vF44BPW4ZYOkE3tDkGTy7yHURusOJimt+I=
+github.com/alexedwards/argon2id v0.0.0-20211130144151-3585854a6387/go.mod h1:GuR5j/NW7AU7tDAQUDGCtpiPxWIOy/c3kiRDnlwiCHc=
 github.com/alicebob/gopher-json v0.0.0-20180125190556-5a6b3ba71ee6/go.mod h1:SGnFV6hVsYE877CKEZ6tDNTjaSXYUk6QqoIK6PrAtcc=
 github.com/alicebob/miniredis v2.5.0+incompatible/go.mod h1:8HZjEj4yU0dwhYHky+DxYx+6BMjkBbe5ONFIF1MXffk=
 github.com/aliyun/alibaba-cloud-sdk-go v1.61.1075 h1:Z0SzZttfYI/raZ5O9WF3cezZJTSW4Yz4Kow9uWdyRwg=
@@ -418,6 +420,7 @@ golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20201016220609-9e8e0b390897/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.0.0-20211117183948-ae814b36b871/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.0.0-20220208233918-bba287dce954 h1:BkypuErRT9A9I/iljuaG3/zdMjd/J6m8tKKJQtGfSdA=
 golang.org/x/crypto v0.0.0-20220208233918-bba287dce954/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=

object/application.go

@@ -257,7 +257,11 @@ func UpdateApplication(id string, application *Application) bool {
 		providerItem.Provider = nil
 	}
 
-	affected, err := adapter.Engine.ID(core.PK{owner, name}).AllCols().Update(application)
+	session := adapter.Engine.ID(core.PK{owner, name}).AllCols()
+	if application.ClientSecret == "***" {
+		session.Omit("client_secret")
+	}
+	affected, err := session.Update(application)
 	if err != nil {
 		panic(err)
 	}

object/init.go

@@ -147,7 +147,7 @@ func initBuiltInCert() {
 		DisplayName:     "Built-in Cert",
 		Scope:           "JWT",
 		Type:            "x509",
-		CryptoAlgorithm: "RSA",
+		CryptoAlgorithm: "RS256",
 		BitSize:         4096,
 		ExpireInYears:   20,
 		PublicKey:       tokenJwtPublicKey,

object/oidc_discovery.go

@@ -76,7 +76,7 @@ func GetOidcDiscovery(host string) OidcDiscovery {
 		UserinfoEndpoint:                       fmt.Sprintf("%s/api/userinfo", originBackend),
 		JwksUri:                                fmt.Sprintf("%s/.well-known/jwks", originBackend),
 		IntrospectionEndpoint:                  fmt.Sprintf("%s/api/login/oauth/introspect", originBackend),
-		ResponseTypesSupported:                 []string{"id_token"},
+		ResponseTypesSupported:                 []string{"code", "token", "id_token", "code token", "code id_token", "token id_token", "code token id_token", "none"},
 		ResponseModesSupported:                 []string{"login", "code", "link"},
 		GrantTypesSupported:                    []string{"password", "authorization_code"},
 		SubjectTypesSupported:                  []string{"public"},

object/organization.go

@@ -128,7 +128,7 @@ func UpdateOrganization(id string, organization *Organization) bool {
 		}
 	}
 
-	if organization.MasterPassword != "" {
+	if organization.MasterPassword != "" && organization.MasterPassword != "***" {
 		credManager := cred.GetCredManager(organization.PasswordType)
 		if credManager != nil {
 			hashedPassword := credManager.GetHashedPassword(organization.MasterPassword, "", organization.PasswordSalt)
@@ -136,7 +136,11 @@ func UpdateOrganization(id string, organization *Organization) bool {
 		}
 	}
 
-	affected, err := adapter.Engine.ID(core.PK{owner, name}).AllCols().Update(organization)
+	session := adapter.Engine.ID(core.PK{owner, name}).AllCols()
+	if organization.MasterPassword == "***" {
+		session.Omit("master_password")
+	}
+	affected, err := session.Update(organization)
 	if err != nil {
 		panic(err)
 	}

object/provider.go

@@ -172,7 +172,14 @@ func UpdateProvider(id string, provider *Provider) bool {
 		return false
 	}
 
-	affected, err := adapter.Engine.ID(core.PK{owner, name}).AllCols().Update(provider)
+	session := adapter.Engine.ID(core.PK{owner, name}).AllCols()
+	if provider.ClientSecret == "***" {
+		session = session.Omit("client_secret")
+	}
+	if provider.ClientSecret2 == "***" {
+		session = session.Omit("client_secret2")
+	}
+	affected, err := session.Update(provider)
 	if err != nil {
 		panic(err)
 	}

object/syncer.go

@@ -133,7 +133,11 @@ func UpdateSyncer(id string, syncer *Syncer) bool {
 		return false
 	}
 
-	affected, err := adapter.Engine.ID(core.PK{owner, name}).AllCols().Update(syncer)
+	session := adapter.Engine.ID(core.PK{owner, name}).AllCols()
+	if syncer.Password == "***" {
+		session.Omit("password")
+	}
+	affected, err := session.Update(syncer)
 	if err != nil {
 		panic(err)
 	}

object/user.go

@@ -314,6 +314,9 @@ func UpdateUser(id string, user *User, columns []string, isGlobalAdmin bool) boo
 		return false
 	}
 
+	if user.Password == "***" {
+		user.Password = oldUser.Password
+	}
 	user.UpdateUserHash()
 
 	if user.Avatar != oldUser.Avatar && user.Avatar != "" && user.PermanentAvatar != "*" {

web/src/ApplicationEditPage.js

@@ -454,8 +454,9 @@ class ApplicationEditPage extends React.Component {
                           {id: "password", name: "Password"},
                           {id: "client_credentials", name: "Client Credentials"},
                           {id: "token", name: "Token"},
-                          {id: "id_token",name:"ID Token"},
-                        ].map((item, index)=><Option key={index} value={item.id}>{item.name}</Option>)
+                          {id: "id_token", name: "ID Token"},
+                          {id: "refresh_token", name: "Refresh Token"},
+                        ].map((item, index) => <Option key={index} value={item.id}>{item.name}</Option>)
                       }
             </Select>
           </Col>

web/src/CertEditPage.js

@@ -136,7 +136,7 @@ class CertEditPage extends React.Component {
             })}>
               {
                 [
-                  {id: 'RSA', name: 'RSA'},
+                  {id: 'RS256', name: 'RS256'},
                 ].map((item, index) => <Option key={index} value={item.id}>{item.name}</Option>)
               }
             </Select>

web/src/CertListPage.js

@@ -32,7 +32,7 @@ class CertListPage extends BaseListPage {
       displayName: `New Cert - ${randomName}`,
       scope: "JWT",
       type: "x509",
-      cryptoAlgorithm: "RSA",
+      cryptoAlgorithm: "RS256",
       bitSize: 4096,
       expireInYears: 20,
       publicKey: "",
@@ -131,7 +131,7 @@ class CertListPage extends BaseListPage {
         key: 'cryptoAlgorithm',
         filterMultiple: false,
         filters: [
-          {text: 'RSA', value: 'RSA'},
+          {text: 'RS256', value: 'RS256'},
         ],
         width: '190px',
         sorter: true,

web/src/OrganizationEditPage.js

@@ -155,7 +155,7 @@ class OrganizationEditPage extends React.Component {
           <Col span={22} >
             <Select virtual={false} style={{width: '100%'}} value={this.state.organization.passwordType} onChange={(value => {this.updateOrganizationField('passwordType', value);})}>
               {
-                ['plain', 'salt', 'md5-salt', 'bcrypt', 'pbkdf2-salt']
+                ['plain', 'salt', 'md5-salt', 'bcrypt', 'pbkdf2-salt', 'argon2id']
                   .map((item, index) => <Option key={index} value={item}>{item}</Option>)
               }
             </Select>

web/src/ResourceListPage.js

@@ -74,7 +74,7 @@ class ResourceListPage extends BaseListPage {
 
   renderUpload() {
     return (
-      <Upload maxCount={1} accept="image/*,video/*,audio/*,.pdf,.doc,.docx" showUploadList={false}
+      <Upload maxCount={1} accept="image/*,video/*,audio/*,.pdf,.doc,.docx,.csv,.xls,.xlsx" showUploadList={false}
               beforeUpload={file => {return false}} onChange={info => {this.handleUpload(info)}}>
         <Button icon={<UploadOutlined />} loading={this.state.uploading} type="primary" size="small">
           {i18next.t("resource:Upload a file...")}