WordPress plugin that checks the password a user enters on registration, reset or profile update to see if it’s been ‘burned’ ( released in a public database breach of another website or obtained through other means and made public ) using Have I Been Pwned’s PwnedPasswords API.
Breakdown
A user enters a password to login, reset or change their password – which triggers the following WordPress hooks: 'user_profile_update_errors', 'registration_errors' or 'validate_password_reset'
The plugin checks for a transient_key to see if a request is already in progress to the Have I Been Pwned API (which limits 1 request every 1.5 seconds from a single IP)
If there’s already a request in progress, the plugin waits 2 seconds and tries again.
Upon the second try, the plugin returns false and logs an error to the error_log. The user will be allowed to set the password they entered, and the password will not have been checked.
If there is not another request in progress the plugin starts a request and sets a transient_key to prevent other requests occurring in the meantime.
The password the user entered is hashed using SHA1. Then the first five characters hash are sent to Have I Been Pwned?, in a technique referred to as k-anonymization.
As an example, the word password when hashed, is 5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8
In other words, the password is converted to a form that’s hard to reverse
Then it’s trimmed down to the first five characters: 5BAA6
And is sent to Have I Been Pwned? to check their comprehensive database.
Have I Been Pwned? responds with a list of passwords with the same first characters and PwnedPasswordChecker then looks at the list to see if the password is there.
If the password is found in the list an error message is shown to the user and they are informed that the password has been breached:
That password is not secure.
If you use it on other sites,
you should change it immediately
Please enter a different password. Learn more
Installation
Download and place in a new folder within the /wp-content/plugins directory
Activate via wp-admin, drink lemonade.
Todos
Get a few people to double-check my code and call me names.
Possibly find a better method of returning an issue to the user if Have I Been Pwned cannot be reached or limits are met.
Allow for checking of burned passwords completely locally without an external GET request. Wouldn’t be great for plugin-download-size though and would require a more manual install process. – Should probably use CURL instead of file_get_contents, although the latter is more likely to be available on shared hosting. – Replace the switch method with something else for the sake of replacing the switch method with something else.
Cautions
This obviously isn’t perfect. Too many requests or a server outage will return false and allow the user to set the password even if it’s burned. This plugin should be used alongside a strong password policy as a second line of defence.
In the event that Have I Been Pwned were ever itself, pwned – this plugin could end up sending requests to an unwanted recipient. I have taken some precautions to verify that the request is going to the right place, by communicating with the API over a secure connection and limiting what Certificate Authorities are accepted when verifying the domain name, but all these precautions don’t help if the right place is itself compromised. I’d recommend following HIBP on social media so you’ll be able to act if it ever happens.
Also, as much as the k-anonymity model, is a nifty way of limiting what’s being sent to external servers – it’s more or less security through obscurity. Narrowing down which password is yours on a list of similar passwords may be easier than you think. Even though the passwords on Have I Been Pwned are hashed, it’s important to note that the SHA1 algorithm was cracked by Google in early 2017.
Now that you’ve read this, you may as well go download WordFence instead given that it does what this plugin does, isn’t coded by a dingus and has other WordPress-hardening features included to make your site a fortress, or something.
It runs the relevant code depending on where it runs.
On the local computer, it runs
the a debug server, serving requests to 127.0.0.1 with your app. You can start it directly (python3 main.py) or from a
container (docker run ...) to test the app.
In the AWS Cloud the requests are handled with the same app, but in a
different way. Lambdarado creates
a handler,
that is compatible with the combination of API Gateway + Lambda.
Install
$ pip3 install lambdarado
Configure
Dockerfile:
FROM public.ecr.aws/lambda/python:3.8
# ... here should be the code that creates the image ...ENTRYPOINT ["python", "main.py"]
You build the image as usual,
but the ENTRYPOINT is just a call to a .py file in the project root.
And there is no CMD.
main.py
fromlambdaradoimportstartdefget_app():
# this function must return WSGI app, e.g. Flaskfrommy_app_moduleimportappreturnappstart(get_app)
When starting the Lambda function instance, the get_app method will run once,
but the main.py module will be imported twice. Make sure that the app is only created
when get_app is called, not when main.py is imported.
In other words, simply running python3 main.py without calling start should
NOT do anything heavy and probably should not even declare or import the app.
This will start Werkzeug server listening to http://0.0.0.0:5000
(inside the docker). The server is accessible as http://127.0.0.1:5005
from the development (host) machine.
Production server on AWS Lambda
After deploying the same image as a Lambda function, it will serve the requests
to the AWS Gateway with your app.
You should connect the AWS Gateway to your Lambda function. For the function
to receive all HTTP requests, you may need to redirect the /{proxy+} route
to the function and make lambda:InvokeFunction policy less restrictive
Under the hood:
The awslambdaric will receive
requests from and send requests to the Lambda service
The apig_wsgi will translate requests
received by awslambdaric from the AWS Gateway. So your application doesn’t
have to handle calls from the gateway directly. For the application, requests
will look like normal HTTP
This project implements automation tests for the Selenium Web Form page using Behave (a BDD testing framework for Python), Selenium WebDriver and Allure Reports to create detailed performance reports.
📝 Objective
The goal of this project is to demonstrate how to use Behave and Selenium WebDriver to create and execute automated tests based on scenarios described in the Gherkin language.
The main code resides in the Behave step definition file, which connects the scenarios described in Gherkin files to Python code.
📝 Step File Organization
Here’s the information organized in a table format:
Feature File
Description of Scenarios
Step File
Step Definitions Purpose
webform_actions_part_1.feature
Scenarios for text, password, and textarea inputs.
webform_actions_part_1.py
Contains step definitions for handling input scenarios.
webform_actions_part_2.feature
Scenarios for dropdown boxes.
webform_actions_part_2.py
Contains step definitions for handling dropdown scenarios.
webform_actions_part_3.feature
Scenarios for file input, checkbox and radio buttons.
webform_actions_part_3.py
Contains step definitions for handling file input and buttons scenarios.
webform_actions_part_4.feature
Scenarios for color, date picker and range bar.
webform_actions_part_4.py
Contains step definitions for handling color, date picker and range bar scenarios.
It includes three main steps:
Given: Opens the web form page.
When: Enters text into the input field.
Then: Clicks the submit button.
@given(u'the browser open Webform page')@when(u'insert a information in the text input field')@then(u'the submit button will be clicked')
Example Gherkin Scenario
An example of how a scenario can be described in Gherkin in the features/form_test.feature file:
Feature: Test the Selenium Web FormScenario: Fill and submit the formGiven the browser open Webform page
When insert a information in the text input field
Then the submit button will be clicked
Make sure the requirements.txt file includes the following dependencies:
behave
selenium
Install the WebDriver for your browser (e.g., ChromeDriver for Google Chrome). Ensure the driver is added to your system PATH.
▶️ Running the Tests
To run the tests, use the following command:
behave
This will execute all scenarios described in the .feature files within the features directory.
🗒️ Generating Allure Reports
Install AlLure:
Allure can be installed in various ways. Choose the method that best fits your environment:
Option 1: Use the Allure Commandline
Via Homebrew (macOS/Linux):
brew install allure
Via Chocolatey (Windows):
First, install Chocolatey. Then:
choco install allure
Via Binary (manual):
Download the zip file from Allure Releases.
Extract the contents and add the binary directory to your PATH.
Install Allure plugin for Python:
Install the allure-behave package, which integrates Allure with Behave.
pip install allure-behave
Set up project for Allure
Make sure Behave test results are generated in a format compatible with Allure:
Run Behave with the Allure Plugin: When running your Behave tests, include the -f allure_behave.formatter:AllureFormatter option to use the Allure format and -o allure-results to specify the output directory for the results.
Alioli is a food app that aims to centralize different recipe and product functionalities in one place.
Built with Flutter and Firebase, it includes the use of design patterns, NoSQL and SQLite databases, and integration with external APIs.
Download by clicking on the following image:
📸 Screenshots
📌 Features
With Alioli you can:
🛒 Organize your pantry food list, as well as your shopping list.
📅 Receive notifications when your products are close to their expiration date.
🔍 Scan the barcode of the products to get a summary of their nutritional information.
🥕 Search for recipes based on the foods in your pantry, among other search criteria such as recipe name or category to which they belong.
🔧 Apply a multitude of filters to searches, classifying them by vegan, vegetarian, preparation time, best rating or existence of videos among other filters.
📚 Create your own personalized recipe lists.
⬆️ Upload your own recipes to the platform so that they can be accessible by everyone.
Alioli – Aplicación en Flutter
Alioli es una aplicación sobre alimentación que trata de centralizar distintas funcionalidades sobre recetas y productos en un solo lugar.
Realizada con Flutter y Firebase, incluye el uso de patrones de diseño, bases de datos NoSQL y SQLite e integración con apis externas.
Descargar haciendo click sobre la siguiente imagen:
📸 Capturas
📌 Características
Con Alioli puedes:
🛒 Organizar tu lista de alimentos en despensa, así como tu lista de la compra.
📅 Recibir notificaciones cuando tus productos estén próximos a su fecha de caducidad.
🔍 Escanear el código de barras de los productos para obtener un resumen de su información nutricional.
🥕 Buscar recetas basadas en los alimentos de tu despensa, entre otros criterios de búsqueda como nombre de la receta o categoría a la que pertenecen.
🔧 Aplicar multitud de filtros a las búsquedas, clasificándolas por veganas, vegetarianas, tiempo de preparación, mejor valoración o existencia de vídeos entre otros filtros.
📚 Crear tus propias listas de recetas personalizadas.
⬆️ Subir tus propias recetas a la plataforma para que puedan ser accesibles por todo el mundo.
cd scrm
bundle
rake db:migrate
rake db:seed
rails server
License
Simple CRM
Copyright (c) 2018 Hugo Marquez and contributors.
Permission is hereby granted, free of charge, to any person obtaining
a copy of this software and associated documentation files (the
“Software”), to deal in the Software without restriction, including
without limitation the rights to use, copy, modify, merge, publish,
distribute, sublicense, and/or sell copies of the Software, and to
permit persons to whom the Software is furnished to do so, subject to
the following conditions:
The above copyright notice and this permission notice shall be
included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
The CNNP Lab is a group of interdisciplinary researchers working on Computational Neurology, Neuroscience, and Psychiatry (psychology).
We apply theoretical and computational approaches to questions in the neuroscience domain. The lab members come from a colourful mix of backgrounds, ranging from computing,
mathematics, statistics, and engineering to biology, psychology, neuroscience, and neurology.
