p15693087
/
django
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

[1.4.x] Fixed #18144 -- Added backwards compatibility with old unsalted MD5 passwords 

Thanks apreobrazhensky at gmail.com for the report.
Backport of 63d6a50dd from master.
This commit is contained in:
Claude Paroz 2013-02-02 11:57:25 +01:00
parent 89ba1b27b4
commit 6bd3896fcb
2 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
django/contrib/auth/hashers.py
View File

@ -35,7 +35,8 @@ def check_password(password, encoded, setter=None, preferred='default'):
password = smart_str(password) password = smart_str(password)
encoded = smart_str(encoded) encoded = smart_str(encoded)
if len(encoded) == 32 and '$' not in encoded: if ((len(encoded) == 32 and '$' not in encoded) or
(len(encoded) == 37 and encoded.startswith('md5$$'))):
hasher = get_hasher('unsalted_md5') hasher = get_hasher('unsalted_md5')
else: else:
algorithm = encoded.split('$', 1)[0] algorithm = encoded.split('$', 1)[0]
@ -347,6 +348,8 @@ class UnsaltedMD5PasswordHasher(BasePasswordHasher):
return hashlib.md5(password).hexdigest() return hashlib.md5(password).hexdigest()
def verify(self, password, encoded): def verify(self, password, encoded):
if len(encoded) == 37 and encoded.startswith('md5$$'):
encoded = encoded[5:]
encoded_2 = self.encode(password, '') encoded_2 = self.encode(password, '')
return constant_time_compare(encoded, encoded_2) return constant_time_compare(encoded, encoded_2)

5
django/contrib/auth/tests/hashers.py
View File

@ -59,6 +59,11 @@ class TestUtilsHashPass(unittest.TestCase):
self.assertTrue(is_password_usable(encoded)) self.assertTrue(is_password_usable(encoded))
self.assertTrue(check_password(u'letmein', encoded)) self.assertTrue(check_password(u'letmein', encoded))
self.assertFalse(check_password('letmeinz', encoded)) self.assertFalse(check_password('letmeinz', encoded))
# Alternate unsalted syntax
alt_encoded = "md5$$%s" % encoded
self.assertTrue(is_password_usable(alt_encoded))
self.assertTrue(check_password(u'letmein', alt_encoded))
self.assertFalse(check_password('letmeinz', alt_encoded))
@skipUnless(crypt, "no crypt module to generate password.") @skipUnless(crypt, "no crypt module to generate password.")
def test_crypt(self): def test_crypt(self):