Repository: Mailu/Mailu

Issue:
Radicale password check fails (length limited?)
So far, the webdav radicale is protected with basic auth (apparently htaccess or similar).
If user password > 8 then it fails to connect. 
we should remove this limitation to let use stong passwords
Radicale password check fails (length limited?)
So far, the webdav radicale is protected with basic auth (apparently htaccess or similar).
If user password > 8 then it fails to connect. 
we should remove this limitation to let use stong passwords


Discussion:
As far as I know, it's handled in 
https://github.com/Mailu/Mailu/blob/66ea28b50adce1c589fd6b2dc1b34356d4c64930/core/admin/mailu/internal/views/auth.py#L60 and there is no length limit.

Which version have you tested with? What's in master? Is there anything logged in the admin container?

I have fixed a bug whereby tokens (that are longer) weren't considered... but that was not length related
I think we should update the basic_authentication method. The handling of the base64 encoded data IMHO is a little bit sloppy. 

@parisni  do you have a colon in the password? I think the split in line 66 will fail if there is any (", 1" missing).

The username must not contain a colon, so it should be .split(b':', 1)
@ghostwheel42 good catch! Yeah, I've checked the RFC and the username can't have a colon... maybe we should enforce that elsewhere too.
@nextgens 
> maybe we should enforce that elsewhere too.

There user name is a E-Mail address. The domain part is "checked" in the model: AFAIK idna encode does not encode a colon. 
I don't see a check for the local part, but this is part of my config-import/export/schema/api work in progress: I'll add validators to the model. 

As far as I know, it's handled in 
https://github.com/Mailu/Mailu/blob/66ea28b50adce1c589fd6b2dc1b34356d4c64930/core/admin/mailu/internal/views/auth.py#L60 and there is no length limit.

Which version have you tested with? What's in master? Is there anything logged in the admin container?

I have fixed a bug whereby tokens (that are longer) weren't considered... but that was not length related
I think we should update the basic_authentication method. The handling of the base64 encoded data IMHO is a little bit sloppy. 

@parisni  do you have a colon in the password? I think the split in line 66 will fail if there is any (", 1" missing).

The username must not contain a colon, so it should be .split(b':', 1)
@ghostwheel42 good catch! Yeah, I've checked the RFC and the username can't have a colon... maybe we should enforce that elsewhere too.
@nextgens 
> maybe we should enforce that elsewhere too.

There user name is a E-Mail address. The domain part is "checked" in the model: AFAIK idna encode does not encode a colon. 
I don't see a check for the local part, but this is part of my config-import/export/schema/api work in progress: I'll add validators to the model. 


Resolving patch:
diff --git a/core/admin/mailu/internal/views/auth.py b/core/admin/mailu/internal/views/auth.py
--- a/core/admin/mailu/internal/views/auth.py
+++ b/core/admin/mailu/internal/views/auth.py
@@ -63,7 +63,7 @@ def basic_authentication():
     authorization = flask.request.headers.get("Authorization")
     if authorization and authorization.startswith("Basic "):
         encoded = authorization.replace("Basic ", "")
-        user_email, password = base64.b64decode(encoded).split(b":")
+        user_email, password = base64.b64decode(encoded).split(b":", 1)
         user = models.User.query.get(user_email.decode("utf8"))
         if nginx.check_credentials(user, password.decode('utf-8'), flask.request.remote_addr, "web"):
             response = flask.Response()


Test patch: