innov
/
django1
1
0
Fork 0
Code Issues Pull Requests 1 Projects Releases Wiki Activity

Fixed #10265: fixed a bug when generating a password reset token for a user created on the same request. Thanks, crucialfelix. 

git-svn-id: http://code.djangoproject.com/svn/django/trunk@10341 bcc190cf-cafb-0310-a4f2-bffc1f526a37
This commit is contained in:
Jacob Kaplan-Moss 2009-04-01 21:25:24 +00:00
parent f03f9568aa
commit 2a994716a1
2 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
django/contrib/auth/tests/tokens.py
View File

@ -8,6 +8,14 @@ TOKEN_GENERATOR_TESTS = """
>>> p0.check_token(u, tk1) >>> p0.check_token(u, tk1)
True True
>>> u = User.objects.create_user('comebackkid', 'test3@example.com', 'testpw')
>>> p0 = PasswordResetTokenGenerator()
>>> tk1 = p0.make_token(u)
>>> reload = User.objects.get(username='comebackkid')
>>> tk2 = p0.make_token(reload)
>>> tk1 == tk2
True
Tests to ensure we can use the token after n days, but no greater. Tests to ensure we can use the token after n days, but no greater.
Use a mocked version of PasswordResetTokenGenerator so we can change Use a mocked version of PasswordResetTokenGenerator so we can change
the value of 'today' the value of 'today'

2
django/contrib/auth/tokens.py
View File

@ -52,7 +52,7 @@ class PasswordResetTokenGenerator(object):
# We limit the hash to 20 chars to keep URL short # We limit the hash to 20 chars to keep URL short
from django.utils.hashcompat import sha_constructor from django.utils.hashcompat import sha_constructor
hash = sha_constructor(settings.SECRET_KEY + unicode(user.id) + hash = sha_constructor(settings.SECRET_KEY + unicode(user.id) +
user.password + unicode(user.last_login) + user.password + user.last_login.strftime('%Y-%m-%d %H:%M:%S') +
unicode(timestamp)).hexdigest()[::2] unicode(timestamp)).hexdigest()[::2]
return "%s-%s" % (ts_b36, hash) return "%s-%s" % (ts_b36, hash)