Apply PBKDF2 to GUI lock

src/base/preferences.cpp

@@ -29,7 +29,6 @@
 
 #include "preferences.h"
 
-#include <QCryptographicHash>
 #include <QDir>
 #include <QLocale>
 #include <QMutableListIterator>
@@ -725,22 +724,14 @@ void Preferences::setDynDNSPassword(const QString &password)
 }
 
 // Advanced settings
-void Preferences::clearUILockPassword()
+QByteArray Preferences::getUILockPassword() const
 {
-    setValue("Locking/password", QString());
+    return value("Locking/password_PBKDF2").toByteArray();
 }
 
-QString Preferences::getUILockPasswordMD5() const
+void Preferences::setUILockPassword(const QByteArray &password)
 {
-    return value("Locking/password").toString();
+    setValue("Locking/password_PBKDF2", password);
-}
-
-void Preferences::setUILockPassword(const QString &clearPassword)
-{
-    QCryptographicHash md5(QCryptographicHash::Md5);
-    md5.addData(clearPassword.toLocal8Bit());
-    QString md5Password = md5.result().toHex();
-    setValue("Locking/password", md5Password);
 }
 
 bool Preferences::isUILocked() const

src/base/preferences.h

@@ -229,9 +229,8 @@ public:
     void setDynDNSPassword(const QString &password);
 
     // Advanced settings
-    void setUILockPassword(const QString &clearPassword);
+    QByteArray getUILockPassword() const;
-    void clearUILockPassword();
+    void setUILockPassword(const QByteArray &password);
-    QString getUILockPasswordMD5() const;
     bool isUILocked() const;
     void setUILocked(bool locked);
     bool isAutoRunEnabled() const;

src/gui/mainwindow.cpp

@@ -30,7 +30,6 @@
 
 #include <QClipboard>
 #include <QCloseEvent>
-#include <QCryptographicHash>
 #include <QDebug>
 #include <QDesktopServices>
 #include <QFileDialog>
@@ -69,6 +68,7 @@
 #include "base/utils/foreignapps.h"
 #include "base/utils/fs.h"
 #include "base/utils/misc.h"
+#include "base/utils/password.h"
 #include "aboutdialog.h"
 #include "addnewtorrentdialog.h"
 #include "application.h"
@@ -631,45 +631,41 @@ void MainWindow::toolbarFollowSystem()
     Preferences::instance()->setToolbarTextPosition(Qt::ToolButtonFollowStyle);
 }
 
-void MainWindow::defineUILockPassword()
+bool MainWindow::defineUILockPassword()
 {
-    QString oldPassMd5 = Preferences::instance()->getUILockPasswordMD5();
-    if (oldPassMd5.isNull())
-        oldPassMd5 = "";
-
     bool ok = false;
-    QString newClearPassword = AutoExpandableDialog::getText(this, tr("UI lock password"), tr("Please type the UI lock password:"), QLineEdit::Password, oldPassMd5, &ok);
+    const QString newPassword = AutoExpandableDialog::getText(this, tr("UI lock password")
-    if (ok) {
+        , tr("Please type the UI lock password:"), QLineEdit::Password, {}, &ok);
-        newClearPassword = newClearPassword.trimmed();
+    if (!ok)
-        if (newClearPassword.size() < 3) {
+        return false;
+
+    if (newPassword.size() < 3) {
         QMessageBox::warning(this, tr("Invalid password"), tr("The password should contain at least 3 characters"));
+        return false;
     }
-        else {
+
-            if (newClearPassword != oldPassMd5)
+    Preferences::instance()->setUILockPassword(Utils::Password::PBKDF2::generate(newPassword));
-                Preferences::instance()->setUILockPassword(newClearPassword);
+    return true;
-            QMessageBox::information(this, tr("Password update"), tr("The UI lock password has been successfully updated"));
-        }
-    }
 }
 
 void MainWindow::clearUILockPassword()
 {
-    QMessageBox::StandardButton answer = QMessageBox::question(this, tr("Clear the password"), tr("Are you sure you want to clear the password?"), QMessageBox::Yes | QMessageBox::No, QMessageBox::No);
+    const QMessageBox::StandardButton answer = QMessageBox::question(this, tr("Clear the password")
+        , tr("Are you sure you want to clear the password?"), (QMessageBox::Yes | QMessageBox::No), QMessageBox::No);
     if (answer == QMessageBox::Yes)
-        Preferences::instance()->clearUILockPassword();
+        Preferences::instance()->setUILockPassword({});
 }
 
 void MainWindow::on_actionLock_triggered()
 {
     Preferences *const pref = Preferences::instance();
+
     // Check if there is a password
-    if (pref->getUILockPasswordMD5().isEmpty()) {
+    if (pref->getUILockPassword().isEmpty()) {
-        // Ask for a password
+        if (!defineUILockPassword())
-        bool ok = false;
+            return;
-        QString clearPassword = AutoExpandableDialog::getText(this, tr("UI lock password"), tr("Please type the UI lock password:"), QLineEdit::Password, "", &ok);
-        if (!ok) return;
-        pref->setUILockPassword(clearPassword);
     }
+
     // Lock the interface
     m_uiLocked = true;
     pref->setUILocked(true);
@@ -1049,28 +1045,25 @@ bool MainWindow::unlockUI()
 {
     if (m_unlockDlgShowing)
         return false;
-    else
-        m_unlockDlgShowing = true;
 
     bool ok = false;
-    QString clearPassword = AutoExpandableDialog::getText(this, tr("UI lock password"), tr("Please type the UI lock password:"), QLineEdit::Password, "", &ok);
+    const QString password = AutoExpandableDialog::getText(this, tr("UI lock password")
-    m_unlockDlgShowing = false;
+        , tr("Please type the UI lock password:"), QLineEdit::Password, {}, &ok);
     if (!ok) return false;
 
     Preferences *const pref = Preferences::instance();
-    QString realPassMd5 = pref->getUILockPasswordMD5();
+
-    QCryptographicHash md5(QCryptographicHash::Md5);
+    const QByteArray secret = pref->getUILockPassword();
-    md5.addData(clearPassword.toLocal8Bit());
+    if (!Utils::Password::PBKDF2::verify(secret, password)) {
-    QString passwordMd5 = md5.result().toHex();
+        QMessageBox::warning(this, tr("Invalid password"), tr("The password is invalid"));
-    if (realPassMd5 == passwordMd5) {
+        return false;
+    }
+
     m_uiLocked = false;
     pref->setUILocked(false);
     m_trayIconMenu->setEnabled(true);
     return true;
 }
-    QMessageBox::warning(this, tr("Invalid password"), tr("The password is invalid"));
-    return false;
-}
 
 void MainWindow::notifyOfUpdate(QString)
 {

src/gui/mainwindow.h

@@ -109,7 +109,7 @@ private slots:
     void fullDiskError(BitTorrent::TorrentHandle *const torrent, QString msg) const;
     void handleDownloadFromUrlFailure(QString, QString) const;
     void tabChanged(int newTab);
-    void defineUILockPassword();
+    bool defineUILockPassword();
     void clearUILockPassword();
     bool unlockUI();
     void notifyOfUpdate(QString);