jellyfin · Bond-009 · Mar 7, 2019 · Jan 31, 2019 · Jan 31, 2019 · Feb 12, 2019
diff --git a/.gitignore b/.gitignore
@@ -263,5 +263,4 @@ deployment/**/pkg-dist/
 deployment/**/pkg-dist-tmp/
 deployment/collect-dist/
 
-jellyfin_version.ini
-MediaBrowser.WebDashboard/jellyfin-web
+jellyfin_version.ini
diff --git a/Emby.Server.Implementations/Cryptography/CryptographyProvider.cs b/Emby.Server.Implementations/Cryptography/CryptographyProvider.cs
@@ -9,15 +9,15 @@ namespace Emby.Server.Implementations.Cryptography
 {
     public class CryptographyProvider : ICryptoProvider
     {
-        private List<string> SupportedHashMethods = new List<string>();
+        private HashSet<string> SupportedHashMethods;
         public string DefaultHashMethod => "SHA256";
         private RandomNumberGenerator rng;
         private int defaultiterations = 1000;
         public CryptographyProvider()
         {
             //Currently supported hash methods from https://docs.microsoft.com/en-us/dotnet/api/system.security.cryptography.cryptoconfig?view=netcore-2.1
             //there might be a better way to autogenerate this list as dotnet updates, but I couldn't find one
-            SupportedHashMethods = new List<string>
+            SupportedHashMethods = new HashSet<string>()
             {
                "MD5"
                 ,"System.Security.Cryptography.MD5"
@@ -71,9 +71,9 @@ public IEnumerable<string> GetSupportedHashMethods()
             return SupportedHashMethods;
         }
 
-        private byte[] PBKDF2(string method, byte[] bytes, byte[] salt)
-        {
-            using (var r = new Rfc2898DeriveBytes(bytes, salt, defaultiterations, new HashAlgorithmName(method)))
+        private byte[] PBKDF2(string method, byte[] bytes, byte[] salt, int iterations)
+        {
+            using (var r = new Rfc2898DeriveBytes(bytes, salt, iterations, new HashAlgorithmName(method)))
             {
                 return r.GetBytes(32);
             }
@@ -102,30 +102,40 @@ public byte[] ComputeHash(string HashMethod, byte[] bytes, byte[] salt)
                 }
                 else
                 {
-                    return PBKDF2(HashMethod, bytes, salt);
+                    return PBKDF2(HashMethod, bytes, salt,defaultiterations);
                 }
             }
             else
             {
                 throw new CryptographicException(String.Format("Requested hash method is not supported: {0}", HashMethod));
             }
-        }
+        }
 
         public byte[] ComputeHashWithDefaultMethod(byte[] bytes, byte[] salt)
         {
-            return PBKDF2(DefaultHashMethod, bytes, salt);
+            return PBKDF2(DefaultHashMethod, bytes, salt, defaultiterations);
         }
 
         public byte[] ComputeHash(PasswordHash hash)
-        {
-            return ComputeHash(hash.Id, hash.HashBytes, hash.SaltBytes);
-        }
-
+        {
+            int iterations = defaultiterations;
+            if (!hash.Parameters.ContainsKey("iterations"))
+            {
+                hash.Parameters.Add("iterations", defaultiterations.ToString());
+            }
+            else
+            {
+                try { iterations = int.Parse(hash.Parameters["iterations"]); }
+                catch (Exception e) { iterations = defaultiterations; throw new Exception($"Couldn't successfully parse iterations value from string:{hash.Parameters["iterations"]}", e); }
+            }
+            return PBKDF2(hash.Id, hash.HashBytes, hash.SaltBytes,iterations);
+        }
+
         public byte[] GenerateSalt()
         {
-            byte[] salt = new byte[8];
+            byte[] salt = new byte[64];
             rng.GetBytes(salt);
             return salt;
-        }
+        }
     }
 }
diff --git a/Emby.Server.Implementations/Data/SqliteUserRepository.cs b/Emby.Server.Implementations/Data/SqliteUserRepository.cs
@@ -55,6 +55,7 @@ public void Initialize()
                 {
                     TryMigrateToLocalUsersTable(connection);
                 }
+                RemoveEmptyPasswordHashes();
             }
         }
 
@@ -73,6 +74,37 @@ private void TryMigrateToLocalUsersTable(ManagedConnection connection)
             }
         }
 
+        private void RemoveEmptyPasswordHashes()
+        {
+            foreach (var user in RetrieveAllUsers())
+            {
+                // If the user password is the sha1 hash of the empty string, remove it
+                if (!string.Equals(user.Password, "DA39A3EE5E6B4B0D3255BFEF95601890AFD80709") || !string.Equals(user.Password, "$SHA1$DA39A3EE5E6B4B0D3255BFEF95601890AFD80709"))
+                {
+                    continue;
+                }
+
+                user.Password = null;
+                var serialized = _jsonSerializer.SerializeToBytes(user);
+
+                using (WriteLock.Write())
+                using (var connection = CreateConnection())
+                {
+                    connection.RunInTransaction(db =>
+                    {
+                        using (var statement = db.PrepareStatement("update LocalUsersv2 set data=@data where Id=@InternalId"))
+                        {
+                            statement.TryBind("@InternalId", user.InternalId);
+                            statement.TryBind("@data", serialized);
+                            statement.MoveNext();
+                        }
+
+                    }, TransactionMode);
+                }
+            }
+
+        }
+
         /// <summary>
         /// Save a user in the repo
         /// </summary>