innov
/
django1
1
0
Fork 0
Code Issues Pull Requests 1 Projects Releases Wiki Activity

Fixed #29952 -- Lowercased all passwords in contrib.auth's auth/common-passwords.txt.gz.

This commit is contained in:
Mathew Payne 2018-11-15 19:11:03 +00:00 committed by Tim Graham
parent 9b15ff08ba
commit 26bb2611a5
4 changed files with 13 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
django/contrib/auth/common-passwords.txt.gz
View File

Binary file not shown.

8
django/contrib/auth/password_validation.py
View File

@ -161,9 +161,11 @@ class CommonPasswordValidator:
""" """
Validate whether the password is a common password. Validate whether the password is a common password.
The password is rejected if it occurs in a provided list, which may be gzipped. The password is rejected if it occurs in a provided list of passwords,
The list Django ships with contains 20000 common passwords, created by which may be gzipped. The list Django ships with contains 20000 common
Royce Williams: https://gist.github.com/roycewilliams/281ce539915a947a23db17137d91aeb7 passwords (lowercased and deduplicated), created by Royce Williams:
https://gist.github.com/roycewilliams/281ce539915a947a23db17137d91aeb7
The password list must be lowercased to match the comparison in validate().
""" """
DEFAULT_PASSWORD_LIST_PATH = Path(__file__).resolve().parent / 'common-passwords.txt.gz' DEFAULT_PASSWORD_LIST_PATH = Path(__file__).resolve().parent / 'common-passwords.txt.gz'

4
docs/releases/2.1.4.txt
View File

@ -9,4 +9,6 @@ Django 2.1.4 fixes several bugs in 2.1.3.
Bugfixes Bugfixes
======== ========
* ... * Corrected the default password list that ``CommonPasswordValidator`` uses by
lowercasing all passwords to match the format expected by the validator
(:ticket:`29952`).

5
tests/auth_tests/test_validators.py
View File

@ -202,6 +202,11 @@ class CommonPasswordValidatorTest(TestCase):
self.assertEqual(cm.exception.messages, [expected_error]) self.assertEqual(cm.exception.messages, [expected_error])
self.assertEqual(cm.exception.error_list[0].code, 'password_too_common') self.assertEqual(cm.exception.error_list[0].code, 'password_too_common')
def test_validate_django_supplied_file(self):
validator = CommonPasswordValidator()
for password in validator.passwords:
self.assertEqual(password, password.lower())
def test_help_text(self): def test_help_text(self):
self.assertEqual( self.assertEqual(
CommonPasswordValidator().get_help_text(), CommonPasswordValidator().get_help_text(),