From 053868f5931d21e80f48a47b6078f452a920c013 Mon Sep 17 00:00:00 2001 From: bergquist Date: Mon, 18 Jan 2016 08:38:32 +0100 Subject: [PATCH 1/4] fix(login): fix vulnerbility for timing attacks closes #3760 --- pkg/login/auth.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/pkg/login/auth.go b/pkg/login/auth.go index 38d87444e23..f2034476f81 100644 --- a/pkg/login/auth.go +++ b/pkg/login/auth.go @@ -3,6 +3,7 @@ package login import ( "errors" + "crypto/subtle" "github.com/grafana/grafana/pkg/bus" m "github.com/grafana/grafana/pkg/models" "github.com/grafana/grafana/pkg/setting" @@ -56,7 +57,7 @@ func loginUsingGrafanaDB(query *LoginUserQuery) error { user := userQuery.Result passwordHashed := util.EncodePassword(query.Password, user.Salt) - if passwordHashed != user.Password { + if subtle.ConstantTimeCompare([]byte(passwordHashed), []byte(user.Password)) != 1 { return ErrInvalidCredentials } From a35bf497bed5553bbce75461ea235c359927e2f4 Mon Sep 17 00:00:00 2001 From: bergquist Date: Mon, 18 Jan 2016 09:26:24 +0100 Subject: [PATCH 2/4] feat(units): add more data rate units closes #3759 --- public/app/core/utils/kbn.js | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/public/app/core/utils/kbn.js b/public/app/core/utils/kbn.js index cc296324eb5..e8084361916 100644 --- a/public/app/core/utils/kbn.js +++ b/public/app/core/utils/kbn.js @@ -595,6 +595,10 @@ function($, _) { {text: 'packets/sec', value: 'pps'}, {text: 'bits/sec', value: 'bps'}, {text: 'bytes/sec', value: 'Bps'}, + {text: 'megabytes/sec', value: 'MBs'}, + {text: 'megabites/sec', value: 'Mbits'}, + {text: 'gigabytes/sec', value: 'GBs'}, + {text: 'gigabites/sec', value: 'Gbits'}, ] }, { From 6a95963c898b64f181480904c65aeea011e56590 Mon Sep 17 00:00:00 2001 From: bergquist Date: Mon, 18 Jan 2016 09:47:01 +0100 Subject: [PATCH 3/4] Revert "feat(units): add more data rate units" This reverts commit a35bf497bed5553bbce75461ea235c359927e2f4. --- public/app/core/utils/kbn.js | 4 ---- 1 file changed, 4 deletions(-) diff --git a/public/app/core/utils/kbn.js b/public/app/core/utils/kbn.js index e8084361916..cc296324eb5 100644 --- a/public/app/core/utils/kbn.js +++ b/public/app/core/utils/kbn.js @@ -595,10 +595,6 @@ function($, _) { {text: 'packets/sec', value: 'pps'}, {text: 'bits/sec', value: 'bps'}, {text: 'bytes/sec', value: 'Bps'}, - {text: 'megabytes/sec', value: 'MBs'}, - {text: 'megabites/sec', value: 'Mbits'}, - {text: 'gigabytes/sec', value: 'GBs'}, - {text: 'gigabites/sec', value: 'Gbits'}, ] }, { From 899a44a73534dae6998ebbf68ce9141611f1e773 Mon Sep 17 00:00:00 2001 From: bergquist Date: Mon, 18 Jan 2016 10:02:46 +0100 Subject: [PATCH 4/4] feat(units): add more data rate options --- public/app/core/utils/kbn.js | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/public/app/core/utils/kbn.js b/public/app/core/utils/kbn.js index cc296324eb5..e323a9223e3 100644 --- a/public/app/core/utils/kbn.js +++ b/public/app/core/utils/kbn.js @@ -352,9 +352,15 @@ function($, _) { kbn.valueFormats.gbytes = kbn.formatBuilders.binarySIPrefix('B', 3); // Data Rate - kbn.valueFormats.pps = kbn.formatBuilders.decimalSIPrefix('pps'); - kbn.valueFormats.bps = kbn.formatBuilders.decimalSIPrefix('bps'); - kbn.valueFormats.Bps = kbn.formatBuilders.decimalSIPrefix('Bps'); + kbn.valueFormats.pps = kbn.formatBuilders.decimalSIPrefix('pps'); + kbn.valueFormats.bps = kbn.formatBuilders.decimalSIPrefix('bps'); + kbn.valueFormats.Bps = kbn.formatBuilders.decimalSIPrefix('Bps'); + kbn.valueFormats.KBs = kbn.formatBuilders.decimalSIPrefix('Bs', 1); + kbn.valueFormats.Kbits = kbn.formatBuilders.decimalSIPrefix('bits', 1); + kbn.valueFormats.MBs = kbn.formatBuilders.decimalSIPrefix('Bs', 2); + kbn.valueFormats.Mbits = kbn.formatBuilders.decimalSIPrefix('bits', 2); + kbn.valueFormats.GBs = kbn.formatBuilders.decimalSIPrefix('Bs', 3); + kbn.valueFormats.Gbits = kbn.formatBuilders.decimalSIPrefix('bits', 3); // Throughput kbn.valueFormats.ops = kbn.formatBuilders.simpleCountUnit('ops'); @@ -595,6 +601,12 @@ function($, _) { {text: 'packets/sec', value: 'pps'}, {text: 'bits/sec', value: 'bps'}, {text: 'bytes/sec', value: 'Bps'}, + {text: 'kilobites/sec', value: 'Kbits'}, + {text: 'kilobytes/sec', value: 'KBs'}, + {text: 'megabites/sec', value: 'Mbits'}, + {text: 'megabytes/sec', value: 'MBs'}, + {text: 'gigabytes/sec', value: 'GBs'}, + {text: 'gigabites/sec', value: 'Gbits'}, ] }, {