Problem with passwords about supysonic HOT 4 CLOSED

After several tests the problem is that hashlib.sha1 need a str without unicode codes. When you pass a string without unicode characters the conversion can be made automagically using default ascii encoding, but if the string have extended characters then the code can't handle it.

The solution is encode both strings as str as I say before.

return hashlib.sha1(salt.encode('utf-8') + password.encode('utf-8')).hexdigest(), salt

from supysonic.

Hi @spl0k, I have some small questions / proposals that I wanted to know your opinion.

I fix this issue and made some changes in several files to make project more clean with circular dependencies, but before send you a PR tell me wat do you think about the following.

• I made the headers of touched files more simple. You can see the result here. I think that is more clean and the given information is the same (part of supysonic, copyright and license).
• In the files where I made several changes in code I add me in copyright line (Sample here and here). This is simply credit my changes.
• The files that I toched are re-tabbed. I think that is better use four spaces that one tab.
• In these files I made some visual changes as make imports one for module or add more blank lines and return carriages. This is for complying with the style PEP.

No more, you'll tell me what you think.

from supysonic.

About UserManager.__decode_password, this is not old code and is used by pre-1.13.0 clients/servers. See the Subsonic API introduction about query parameters.
But you're right that it prevents having passwords starting with enc:. Actually that method shouldn't be here or called from any other UserManager method. That code should actually be executed when passwords are retrieved from query parameters (1, 2, 3).

For headers I actually followed the advice given by the license, but it's true it can be shortened. Your version, with added credit, suits me fine.

from supysonic.

Ok. In this case I think that we can use this method in __decode_password

def __decode_password(password):
    if not password.startswith('enc:'):
        return password

    try:
        return binascii.unhexlify(password[4:])
    except:
        return password

With this piece of code, a password that starts with enc: have no problem.

Ok. I'll make the changes 😉

from supysonic.