Fixed #28718 -- Allowed user to request a password reset if their password doesn't use an enabled hasher.

Regression in aeb1389442d0f9669edf6660b747fd10693b63a7.
Reverted changes to is_password_usable() from
703c266682be39f7153498ad0d8031231f12ee79 and documentation changes from
92f48680dbd2e02f2b33f6ad0e35b7d337889fb2.

3 files changed, 27 insertions, 5 deletions

diff --git a/docs/ref/contrib/auth.txt b/docs/ref/contrib/auth.txt
index e05280367c..2b1aa9ae08 100644
--- a/docs/ref/contrib/auth.txt
+++ b/docs/ref/contrib/auth.txt
@@ -212,9 +212,15 @@ Methods
 
         Returns ``False`` if
         :meth:`~django.contrib.auth.models.User.set_unusable_password()` has
-        been called for this user, or if the password is ``None``, or if the
-        password uses a hasher that's not in the :setting:`PASSWORD_HASHERS`
-        setting.
+        been called for this user.
+
+        .. versionchanged:: 2.1
+
+            In older versions, this also returns ``False`` if the password is
+            ``None`` or an empty string, or if the password uses a hasher
+            that's not in the :setting:`PASSWORD_HASHERS` setting. That
+            behavior is considered a bug as it prevents users with such
+            passwords from requesting a password reset.
 
     .. method:: get_group_permissions(obj=None)
 
diff --git a/docs/releases/2.1.txt b/docs/releases/2.1.txt
index 439dc275ce..463fad0b6c 100644
--- a/docs/releases/2.1.txt
+++ b/docs/releases/2.1.txt
@@ -358,6 +358,14 @@ Miscellaneous
   changed from 0 to an empty string, which mainly may require some adjustments
   in tests that compare HTML.
 
+* :meth:`.User.has_usable_password` and the
+  :func:`~django.contrib.auth.hashers.is_password_usable` function no longer
+  return ``False`` if the password is ``None`` or an empty string, or if the
+  password uses a hasher that's not in the :setting:`PASSWORD_HASHERS` setting.
+  This undocumented behavior was a regression in Django 1.6 and prevented users
+  with such passwords from requesting a password reset. Audit your code to
+  confirm that your usage of these APIs don't rely on the old behavior.
+
 .. _deprecated-features-2.1:
 
 Features deprecated in 2.1
diff --git a/docs/topics/auth/passwords.txt b/docs/topics/auth/passwords.txt
index 4dc6748075..0125118de6 100644
--- a/docs/topics/auth/passwords.txt
+++ b/docs/topics/auth/passwords.txt
@@ -409,8 +409,16 @@ from the ``User`` model.
 
 .. function:: is_password_usable(encoded_password)
 
-   Checks if the given string is a hashed password that has a chance
-   of being verified against :func:`check_password`.
+    Returns ``False`` if the password is a result of
+    :meth:`.User.set_unusable_password`.
+
+    .. versionchanged:: 2.1
+
+        In older versions, this also returns ``False`` if the password is
+        ``None`` or an empty string, or if the password uses a hasher that's
+        not in the :setting:`PASSWORD_HASHERS` setting. That behavior is
+        considered a bug as it prevents users with such passwords from
+        requesting a password reset.
 
 .. _password-validation: