Merge pull request #18 from fLotte-meets-HWR-DB/develop

Fix password being repeated for padding when too short

Cargo.lock

@@ -445,6 +445,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_postgres",
+ "sha2",
  "syntect",
  "zeroize",
 ]

Cargo.toml

@@ -37,3 +37,4 @@ regex = "1.4.2"
 lazy_static = "1.4.0"
 schemars = "0.8.0"
 syntect = "4.4.0"
+sha2 = "0.9.2"

src/utils/mod.rs

@@ -7,6 +7,7 @@ use std::panic;
 use bcrypt::DEFAULT_COST;
 use byteorder::{BigEndian, ByteOrder};
 use rand::Rng;
+use sha2::Digest;
 
 pub mod error;
 
@@ -47,7 +48,8 @@ pub fn get_user_id_from_token(token: &String) -> Option<i32> {
 pub fn hash_password(password: &[u8], salt: &[u8]) -> Result<[u8; 24], String> {
     panic::catch_unwind(|| {
         let mut pw_hash = [0u8; 24];
-        bcrypt::bcrypt(DEFAULT_COST, salt, password, &mut pw_hash);
+        let password = sha2::Sha256::digest(password);
+        bcrypt::bcrypt(DEFAULT_COST, salt, password.as_slice(), &mut pw_hash);
         Ok(pw_hash)
     })
     .map_err(|_| "Hashing failed".to_string())?