[master/rhel7] Display a fatal error if unable to encrypt a password. (#1057032)

David Shea dshea at redhat.com
Wed Aug 6 12:44:07 UTC 2014


Python's crypt.crypt silently fails if asked to encrypt using an
unavailable algorithm, such as if MD5 is specified but FIPS-mode is on.
Instead of crashing in somewhere surprising that can't handle a password
of None, raise an error through the error dialog.
---
 pyanaconda/errors.py | 14 +++++++++++++-
 pyanaconda/users.py  |  9 ++++++++-
 2 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/pyanaconda/errors.py b/pyanaconda/errors.py
index 744f0f5..1f228ff 100644
--- a/pyanaconda/errors.py
+++ b/pyanaconda/errors.py
@@ -44,6 +44,11 @@ class ScriptError(Exception):
 class CmdlineError(Exception):
     pass
 
+class PasswordCryptError(Exception):
+    def __init__(self, algo):
+        Exception.__init__(self)
+        self.algo = algo
+
 # These constants are returned by the callback in the ErrorHandler class.
 # Each represents a different kind of action the caller can take:
 #
@@ -228,6 +233,12 @@ class ErrorHandler(object):
         self.ui.showDetailedError(message, details)
         return ERROR_RAISE
 
+    def _passwordCryptErrorHandler(self, exn):
+        message = _("Unable to encrypt password: unsupported algorithm %s") % exn.algo
+
+        self.ui.showError(message)
+        return ERROR_RAISE
+
     def cb(self, exn, *args, **kwargs):
         """This method is the callback that all error handling should pass
            through.  The return value is one of the ERROR_* constants defined
@@ -260,7 +271,8 @@ class ErrorHandler(object):
                 "NoSuchPackage": self._noSuchPackageHandler,
                 "ScriptError": self._scriptErrorHandler,
                 "PayloadInstallError": self._payloadInstallHandler,
-                "DependencyError": self._dependencyErrorHandler}
+                "DependencyError": self._dependencyErrorHandler,
+                "PasswordCryptError": self._passwordCryptErrorHandler}
 
         if exn.__class__.__name__ in _map:
             kwargs["exception"] = exn
diff --git a/pyanaconda/users.py b/pyanaconda/users.py
index 2e40465..f23e987 100644
--- a/pyanaconda/users.py
+++ b/pyanaconda/users.py
@@ -31,6 +31,7 @@ import pwquality
 import re
 from pyanaconda.iutil import strip_accents
 from pyanaconda.i18n import _
+from pyanaconda.errors import errorHandler, PasswordCryptError, ERROR_RAISE
 
 import logging
 log = logging.getLogger("anaconda")
@@ -116,7 +117,13 @@ def cryptPassword(password, algo=None):
         saltstr = saltstr + random.choice (string.letters +
                                            string.digits + './')
 
-    return crypt.crypt (password, saltstr)
+    cryptpw = crypt.crypt (password, saltstr)
+    if cryptpw is None:
+        exn = PasswordCryptError(algo=algo)
+        if errorHandler.cb(exn) == ERROR_RAISE:
+            raise exn
+
+    return cryptpw
 
 def validatePassword(pw, confirm, minlen=6):
     # Do various steps to validate the password
-- 
2.0.0



More information about the anaconda-patches mailing list