More secure authentication

need to figure out to upgrade the passwords

1 files changed, 3 insertions, 5 deletions

diff --git a/famille.py b/famille.py
index 57be38d..19dd4d8 100644
--- a/famille.py
+++ b/famille.py
@@ -14,7 +14,7 @@ from bs4 import BeautifulSoup
 from flask_mail import Mail, Message
 import locale
 from smartypants import smartypants, Attr
-
+import bcrypt
 
 locale.setlocale(locale.LC_ALL, 'fr_FR.UTF-8')
 
@@ -258,8 +258,7 @@ def edit_user():
         result = {}
         try:
             if request.form['password'] == request.form['password_confirm']:
-                result['password'] = hashlib.md5(request.form['password']).\
-                    hexdigest()
+                result['password'] = bcrypt.hashpw(password, bcrypt.gensalt())
             else:
                 error = "Les deux mots de passe ne coïncident pas"
                 return render_template("user/edit.html", user=request.form,
@@ -287,11 +286,10 @@ def login():
 
     if request.method == 'POST':
         username = request.form['username']
-        password = hashlib.md5(request.form['password'].encode("utf-8")).hexdigest()
         user = query_db('select * from users where user_name = ?',
                         (username,), True)
         if user:
-            if user['password'] == password:
+            if bcrypt.hashpw(request.form['password'], user['password']) == user['password']:
                 session['user_name'] = user['user_name']
                 session['user_id'] = user['id']
                 session['timezone'] = user['timezone'] or "UTC"