[MM-57942] Fix a panic on password is too long (#27449)

* return error from bcrypt, handle gracefully; remove dead code

* linting

* linting

* i18n

* fix test

* fill out translations

server/channels/app/user.go

@@ -1445,7 +1445,11 @@ func (a *App) UpdatePassword(rctx request.CTX, user *model.User, newPassword str
 		return model.NewAppError("UpdatePassword", "api.user.update_password.failed.app_error", nil, "", http.StatusInternalServerError)
 	}
 
-	hashedPassword := model.HashPassword(newPassword)
+	hashedPassword, err := model.HashPassword(newPassword)
+	if err != nil {
+		// can't be password length (checked in IsPasswordValid)
+		return model.NewAppError("UpdatePassword", "api.user.update_password.password_hash.app_error", nil, "user_id="+user.Id, http.StatusInternalServerError).Wrap(err)
+	}
 
 	if err := a.Srv().Store().User().UpdatePassword(user.Id, hashedPassword); err != nil {
 		return model.NewAppError("UpdatePassword", "api.user.update_password.failed.app_error", nil, "", http.StatusInternalServerError).Wrap(err)

server/channels/app/users/password.go

@@ -20,16 +20,6 @@ func CheckUserPassword(user *model.User, password string) error {
 	return nil
 }
 
-// HashPassword generates a hash using the bcrypt.GenerateFromPassword
-func HashPassword(password string) string {
-	hash, err := bcrypt.GenerateFromPassword([]byte(password), 10)
-	if err != nil {
-		panic(err)
-	}
-
-	return string(hash)
-}
-
 func ComparePassword(hash string, password string) error {
 	if password == "" || hash == "" {
 		return errors.New("empty password or hash")

server/channels/app/users/password_test.go

@@ -13,13 +13,6 @@ import (
 	"github.com/mattermost/mattermost/server/public/model"
 )
 
-func TestComparePassword(t *testing.T) {
-	hash := HashPassword("Test")
-
-	assert.NoError(t, ComparePassword(hash, "Test"), "Passwords don't match")
-	assert.Error(t, ComparePassword(hash, "Test2"), "Passwords should not have matched")
-}
-
 func TestIsPasswordValidWithSettings(t *testing.T) {
 	for name, tc := range map[string]struct {
 		Password      string

server/channels/store/sqlstore/user_store.go

@@ -112,7 +112,9 @@ func (us SqlUserStore) Save(rctx request.CTX, user *model.User) (*model.User, er
 		return nil, store.NewErrInvalidInput("User", "id", user.Id)
 	}
 
-	user.PreSave()
+	if err := user.PreSave(); err != nil {
+		return nil, err
+	}
 	if err := user.IsValid(); err != nil {
 		return nil, err
 	}

server/channels/store/storetest/user_store.go

@@ -12,6 +12,8 @@ import (
 	"testing"
 	"time"
 
+	"golang.org/x/crypto/bcrypt"
+
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
@@ -2294,7 +2296,11 @@ func testUserStoreUpdatePassword(t *testing.T, rctx request.CTX, ss store.Store)
 	_, nErr := ss.Team().SaveMember(rctx, &model.TeamMember{TeamId: teamId, UserId: u1.Id}, -1)
 	require.NoError(t, nErr)
 
-	hashedPassword := model.HashPassword("newpwd")
+	_, err = model.HashPassword(strings.Repeat("1234567890", 8))
+	require.ErrorIs(t, err, bcrypt.ErrPasswordTooLong)
+
+	hashedPassword, err := model.HashPassword("newpwd")
+	require.NoError(t, err)
 
 	err = ss.User().UpdatePassword(u1.Id, hashedPassword)
 	require.NoError(t, err)