Merge branch 'release' into develop

website/server/controllers/api-v3/auth.js

@@ -25,6 +25,8 @@ import { validatePasswordResetCodeAndFindUser, convertToBcrypt} from '../../libs
 const BASE_URL = nconf.get('BASE_URL');
 const TECH_ASSISTANCE_EMAIL = nconf.get('EMAILS:TECH_ASSISTANCE_EMAIL');
 const COMMUNITY_MANAGER_EMAIL = nconf.get('EMAILS:COMMUNITY_MANAGER_EMAIL');
+const USERNAME_LENGTH_MIN = 1;
+const USERNAME_LENGTH_MAX = 20;
 
 let api = {};
 
@@ -78,11 +80,11 @@ function hasBackupAuth (user, networkToRemove) {
 
 /**
  * @api {post} /api/v3/user/auth/local/register Register
- * @apiDescription Register a new user with email, username and password or attach local auth to a social user
+ * @apiDescription Register a new user with email, login name, and password or attach local auth to a social user
  * @apiName UserRegisterLocal
  * @apiGroup User
  *
- * @apiParam (Body) {String} username Username of the new user
+ * @apiParam (Body) {String} username Login name of the new user. Must be 1-36 characters, containing only a-z, 0-9, hyphens (-), or underscores (_).
  * @apiParam (Body) {String} email Email address of the new user
  * @apiParam (Body) {String} password Password for the new user
  * @apiParam (Body) {String} confirmPassword Password confirmation
@@ -101,7 +103,12 @@ api.registerLocal = {
         notEmpty: {errorMessage: res.t('missingEmail')},
         isEmail: {errorMessage: res.t('notAnEmail')},
       },
-      username: {notEmpty: {errorMessage: res.t('missingUsername')}},
+      username: {
+        notEmpty: {errorMessage: res.t('missingUsername')},
+        isLength: {options: {min: USERNAME_LENGTH_MIN, max: USERNAME_LENGTH_MAX}, errorMessage: res.t('usernameWrongLength')},
+        // TODO use the constants in the error message above
+        matches: {options: /^[-_a-zA-Z0-9]+$/, errorMessage: res.t('usernameBadCharacters')},
+      },
       password: {
         notEmpty: {errorMessage: res.t('missingPassword')},
         equals: {options: [req.body.confirmPassword], errorMessage: res.t('passwordConfirmationMatch')},

website/server/libs/encryption.js

@@ -1,24 +1,26 @@
 import {
-  createCipher,
-  createDecipher,
+  createCipheriv,
+  createDecipheriv,
 } from 'crypto';
 import nconf from 'nconf';
 
 const algorithm = 'aes-256-ctr';
-const SESSION_SECRET = nconf.get('SESSION_SECRET');
+const SESSION_SECRET_KEY = nconf.get('SESSION_SECRET_KEY');
+const SESSION_SECRET_IV = nconf.get('SESSION_SECRET_IV');
+
+const key = Buffer.from(SESSION_SECRET_KEY, 'hex');
+const iv  = Buffer.from(SESSION_SECRET_IV, 'hex');
 
 export function encrypt (text) {
-  let cipher = createCipher(algorithm,  SESSION_SECRET);
+  const cipher = createCipheriv(algorithm, key, iv);
   let crypted = cipher.update(text, 'utf8', 'hex');
-
   crypted += cipher.final('hex');
   return crypted;
 }
 
 export function decrypt (text) {
-  let decipher = createDecipher(algorithm, SESSION_SECRET);
+  const decipher = createDecipheriv(algorithm, key, iv);
   let dec = decipher.update(text, 'hex', 'utf8');
-
   dec += decipher.final('utf8');
   return dec;
 }