diff options
Diffstat (limited to 'django')
| -rw-r--r-- | django/contrib/auth/__init__.py | 9 | ||||
| -rw-r--r-- | django/contrib/auth/base_user.py | 7 |
2 files changed, 13 insertions, 3 deletions
diff --git a/django/contrib/auth/__init__.py b/django/contrib/auth/__init__.py index 09db690b5c..de2aa785e6 100644 --- a/django/contrib/auth/__init__.py +++ b/django/contrib/auth/__init__.py @@ -187,8 +187,13 @@ def get_user(request): user.get_session_auth_hash() ) if not session_hash_verified: - request.session.flush() - user = None + if not ( + session_hash and + hasattr(user, '_legacy_get_session_auth_hash') and + constant_time_compare(session_hash, user._legacy_get_session_auth_hash()) + ): + request.session.flush() + user = None return user or AnonymousUser() diff --git a/django/contrib/auth/base_user.py b/django/contrib/auth/base_user.py index f39c12a350..bb51cfbcc9 100644 --- a/django/contrib/auth/base_user.py +++ b/django/contrib/auth/base_user.py @@ -120,12 +120,17 @@ class AbstractBaseUser(models.Model): """ return is_password_usable(self.password) + def _legacy_get_session_auth_hash(self): + # RemovedInDjango40Warning: pre-Django 3.1 hashes will be invalid. + key_salt = 'django.contrib.auth.models.AbstractBaseUser.get_session_auth_hash' + return salted_hmac(key_salt, self.password, algorithm='sha1').hexdigest() + def get_session_auth_hash(self): """ Return an HMAC of the password field. """ key_salt = "django.contrib.auth.models.AbstractBaseUser.get_session_auth_hash" - return salted_hmac(key_salt, self.password).hexdigest() + return salted_hmac(key_salt, self.password, algorithm='sha256').hexdigest() @classmethod def get_email_field_name(cls): |