From f92ba8403f38de95053a07e06b45747e856d37c0 Mon Sep 17 00:00:00 2001 From: Vincent Petry Date: Wed, 11 Jan 2023 15:21:26 +0100 Subject: [PATCH] Improve password generation for link shares Use web crypto when generating password for link shares whenever the password policy app is disabled. Signed-off-by: Vincent Petry --- apps/files_sharing/src/utils/GeneratePassword.js | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/apps/files_sharing/src/utils/GeneratePassword.js b/apps/files_sharing/src/utils/GeneratePassword.js index f3122de164478..c7012a912748b 100644 --- a/apps/files_sharing/src/utils/GeneratePassword.js +++ b/apps/files_sharing/src/utils/GeneratePassword.js @@ -24,6 +24,7 @@ import axios from '@nextcloud/axios' import Config from '../services/ConfigService' const config = new Config() +// note: some chars removed on purpose to make them human friendly when read out const passwordSet = 'abcdefgijkmnopqrstwxyzABCDEFGHJKLMNPQRSTWXYZ23456789' /** @@ -46,10 +47,12 @@ export default async function() { } } - // generate password of 10 length based on passwordSet - return Array(10).fill(0) - .reduce((prev, curr) => { - prev += passwordSet.charAt(Math.floor(Math.random() * passwordSet.length)) - return prev - }, '') + const array = new Uint8Array(10) + const ratio = passwordSet.length / 255 + self.crypto.getRandomValues(array) + let password = '' + for (let i = 0; i < array.length; i++) { + password += passwordSet.charAt(array[i] * ratio) + } + return password }