Merge pull request #3 from fzoske/master

Add Support For BCrypt Storage of Passwords

cmd/webdav/main.go

@@ -11,8 +11,10 @@ import (
 	"os"
 	"path/filepath"
 	"regexp"
+	"strings"
 
 	"github.com/hacdias/webdav"
+	"golang.org/x/crypto/bcrypt"
 	wd "golang.org/x/net/webdav"
 	yaml "gopkg.in/yaml.v2"
 )
@@ -213,7 +215,8 @@ func basicAuth(c *cfg) http.Handler {
 			return
 		}
 
-		if password != p {
+		if !checkPassword(p, password) {
+			log.Println("Wrong Password for user", username)
 			http.Error(w, "Not authorized", 401)
 			return
 		}
@@ -222,6 +225,16 @@ func basicAuth(c *cfg) http.Handler {
 	})
 }
 
+func checkPassword(saved, input string) bool {
+
+	if strings.HasPrefix(saved, "{bcrypt}") {
+		savedPassword := strings.TrimPrefix(saved, "{bcrypt}")
+		return bcrypt.CompareHashAndPassword([]byte(savedPassword), []byte(input)) == nil
+	}
+
+	return saved == input
+}
+
 func main() {
 	flag.Parse()
 	cfg := parseConfig()

readme.md

@@ -12,6 +12,8 @@ port: 8080
 users:
   - username: admin
     password: admin
+  - username: encrypted
+    password: "{bcrypt}$2y$10$zEP6oofmXFeHaeMfBNLnP.DO8m.H.Mwhd24/TOX2MWLxAExXi4qgi"
   - username: basic
     password: basic
     modify:   false