diff options
Diffstat (limited to 'django')
| -rw-r--r-- | django/contrib/auth/hashers.py | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/django/contrib/auth/hashers.py b/django/contrib/auth/hashers.py index 9db5a12e13..f11bc8a0f3 100644 --- a/django/contrib/auth/hashers.py +++ b/django/contrib/auth/hashers.py @@ -43,14 +43,20 @@ def check_password(password, encoded, setter=None, preferred="default"): If setter is specified, it'll be called when you need to regenerate the password. """ - if password is None or not is_password_usable(encoded): - return False + fake_runtime = password is None or not is_password_usable(encoded) preferred = get_hasher(preferred) try: hasher = identify_hasher(encoded) except ValueError: # encoded is gibberish or uses a hasher that's no longer installed. + fake_runtime = True + + if fake_runtime: + # Run the default password hasher once to reduce the timing difference + # between an existing user with an unusable password and a nonexistent + # user or missing hasher (similar to #20760). + make_password(get_random_string(UNUSABLE_PASSWORD_SUFFIX_LENGTH)) return False hasher_changed = hasher.algorithm != preferred.algorithm |