Compute the MD5-hash of a PostgreSQL password before sending to server.
This follows the formula for how PostgreSQL stores a password for
MD5-based authentication and prevents the plaintext password from
being logged on the PostgreSQL server.
@@ -294,43 +294,20 @@ func updatePassword(clusterName string, p connInfo, username, newPassword, passw
}
var rows *sql.Rows
- querystr := "SELECT 'md5'|| md5('" + newPassword + username + "')"
- //log.Debug(querystr)
- rows, err = conn.Query(querystr)
- if err != nil {
- log.Debug(err.Error())
- return err
- }
- /**
- var md5Password string
- for rows.Next() {
- err = rows.Scan(&md5Password)
- if err != nil {
- log.Debug(err.Error())
- return err
- }
- }
- */
+ // Pre-hash the password in the PostgreSQL MD5 format to prevent the
+ // plaintext value from appearing in the PostgreSQL logs.
+ md5Password := "md5" + util.GetMD5HashForAuthFile(newPassword+username)
- //querystr = "ALTER user " + username + " PASSWORD '" + newPassword + "'"
- //alterRole(username, md5Password)
- _, err = AlterRole(conn, username, newPassword)
+ // This call is the equivalent to
+ // "ALTER USER " + username + " PASSWORD '" + md5Password + "'"
+ _, err = AlterRole(conn, username, md5Password)
if err != nil {
log.Debug(err.Error())
return err
}
- //querystr = "ALTER user " + username + " PASSWORD '" + md5Password + "'"
- //log.Debug(querystr)
- /**
- rows, err = conn.Query(querystr)
- if err != nil {
- log.Debug(err.Error())
- return err
- }
- */
- querystr = "ALTER user " + username + " VALID UNTIL '" + passwordExpireDate + "'"
+ querystr := "ALTER user " + username + " VALID UNTIL '" + passwordExpireDate + "'"
log.Debug(querystr)
rows, err = conn.Query(querystr)
if err != nil {
