diff --git a/django/contrib/auth/tests/tokens.py b/django/contrib/auth/tests/tokens.py index c9baff2261..9211e062f1 100644 --- a/django/contrib/auth/tests/tokens.py +++ b/django/contrib/auth/tests/tokens.py @@ -51,28 +51,6 @@ class TokenGeneratorTest(TestCase): p2 = Mocked(date.today() + timedelta(settings.PASSWORD_RESET_TIMEOUT_DAYS + 1)) self.assertFalse(p2.check_token(user, tk1)) - def test_django12_hash(self): - """ - Ensure we can use the hashes generated by Django 1.2 - """ - # Hard code in the Django 1.2 algorithm (not the result, as it is time - # dependent) - def _make_token(user): - import hashlib - from django.utils.http import int_to_base36 - - timestamp = (date.today() - date(2001,1,1)).days - ts_b36 = int_to_base36(timestamp) - hash = hashlib.sha1(settings.SECRET_KEY + unicode(user.id) + - user.password + user.last_login.strftime('%Y-%m-%d %H:%M:%S') + - unicode(timestamp)).hexdigest()[::2] - return "%s-%s" % (ts_b36, hash) - - user = User.objects.create_user('tokentestuser', 'test2@example.com', 'testpw') - p0 = PasswordResetTokenGenerator() - tk1 = _make_token(user) - self.assertTrue(p0.check_token(user, tk1)) - def test_date_length(self): """ Make sure we don't allow overly long dates, causing a potential DoS. diff --git a/django/contrib/auth/tokens.py b/django/contrib/auth/tokens.py index 483c4838a7..db614135c0 100644 --- a/django/contrib/auth/tokens.py +++ b/django/contrib/auth/tokens.py @@ -1,5 +1,4 @@ from datetime import date -import hashlib from django.conf import settings from django.utils.http import int_to_base36, base36_to_int from django.utils.crypto import constant_time_compare, salted_hmac @@ -33,11 +32,7 @@ class PasswordResetTokenGenerator(object): # Check that the timestamp/uid has not been tampered with if not constant_time_compare(self._make_token_with_timestamp(user, ts), token): - # Fallback to Django 1.2 method for compatibility. - # PendingDeprecationWarning <- here to remind us to remove this in - # Django 1.5 - if not constant_time_compare(self._make_token_with_timestamp_old(user, ts), token): - return False + return False # Check the timestamp is within limit if (self._num_days(self._today()) - ts) > settings.PASSWORD_RESET_TIMEOUT_DAYS: @@ -63,14 +58,6 @@ class PasswordResetTokenGenerator(object): hash = salted_hmac(key_salt, value).hexdigest()[::2] return "%s-%s" % (ts_b36, hash) - def _make_token_with_timestamp_old(self, user, timestamp): - # The Django 1.2 method - ts_b36 = int_to_base36(timestamp) - hash = hashlib.sha1(settings.SECRET_KEY + unicode(user.id) + - user.password + user.last_login.strftime('%Y-%m-%d %H:%M:%S') + - unicode(timestamp)).hexdigest()[::2] - return "%s-%s" % (ts_b36, hash) - def _num_days(self, dt): return (dt - date(2001,1,1)).days