sugary/LarpixClient
1
0
Fork 0
forked from olcxjas-softworks/LarpixClient
Code Pull requests Activity

massive security update

Browse source
This commit is contained in:
olcxja 2026-08-24 19:22:28 +02:00
commit 1593a3a33a
20 changed files with 1121 additions and 339 deletions
Download patch file Download diff file Expand all files Collapse all files

11
webroot/login/index.html
View file

@ -285,7 +285,7 @@
const registerHost = document.getElementById("reg-host");
const registerUsername = document.getElementById("reg-username");
const registerPassword = document.getElementById("reg-password");
const registerPasswordConfirm = document.getElementById("reg-password");
const registerPasswordConfirm = document.getElementById("reg-confirm");
const loginHost = document.getElementById("login-host");
const loginUsername = document.getElementById("login-username");
const loginPassword = document.getElementById("login-password");
@ -382,6 +382,13 @@
var sharedkey = await calcHybridSharedKeyClient(dataarray[0], dataarray[1]);
sharedpvkey = sharedkey[2];
createId = dataarray[2];
//sól z init jest wymagana - hasło zawsze przez PBKDF2
if (!dataarray[3]) {
showBlahNotification("error:something.wrong");
authContainer.className = 'auth-container show-register';
return;
}
let regCredHash = await deriveCredentialKdf(registerPassword.value, dataarray[3]);
const captchaimage = await fetch(`${url}/createaccount?step=register`, {
method: 'POST',
body: JSON.stringify({
@ -389,7 +396,7 @@
ciphertextMlKem: sharedkey[1],
idKey: createId,
username: await encrypt(registerUsername.value, sharedpvkey),
password: await encrypt(await hashSHA3_512(registerPassword.value), sharedpvkey)
password: await encrypt(regCredHash, sharedpvkey)
})
});
const clone = captchaimage.clone();