From 0aa6a602b2b1cac6fe8e55051eed493b9cea7b81 Mon Sep 17 00:00:00 2001 From: Mariusz Felisiak Date: Thu, 14 Jan 2021 10:27:04 +0100 Subject: Refs #31842 -- Removed DEFAULT_HASHING_ALGORITHM transitional setting. Per deprecation timeline. --- docs/ref/checks.txt | 4 ++-- docs/ref/settings.txt | 19 ------------------- docs/releases/3.1.txt | 14 +++++++------- docs/releases/4.0.txt | 2 ++ 4 files changed, 11 insertions(+), 28 deletions(-) (limited to 'docs') diff --git a/docs/ref/checks.txt b/docs/ref/checks.txt index aae23d1d20..1025549370 100644 --- a/docs/ref/checks.txt +++ b/docs/ref/checks.txt @@ -494,8 +494,8 @@ The following checks are run if you use the :option:`check --deploy` option: The following checks verify that your security-related settings are correctly configured: -* **security.E100**: :setting:`DEFAULT_HASHING_ALGORITHM` must be ``'sha1'`` or - ``'sha256'``. +* **security.E100**: ``DEFAULT_HASHING_ALGORITHM`` must be ``'sha1'`` or + ``'sha256'``. *This check appeared in Django 3.1 and 3.2*. * **security.E101**: The CSRF failure view ``'path.to.view'`` does not take the correct number of arguments. * **security.E102**: The CSRF failure view ``'path.to.view'`` could not be diff --git a/docs/ref/settings.txt b/docs/ref/settings.txt index 796045aebd..09eeb1e52f 100644 --- a/docs/ref/settings.txt +++ b/docs/ref/settings.txt @@ -1291,25 +1291,6 @@ Default email address to use for various automated correspondence from the site manager(s). This doesn't include error messages sent to :setting:`ADMINS` and :setting:`MANAGERS`; for that, see :setting:`SERVER_EMAIL`. -.. setting:: DEFAULT_HASHING_ALGORITHM - -``DEFAULT_HASHING_ALGORITHM`` ------------------------------ - -Default: ``'sha256'`` - -Default hashing algorithm to use for encoding cookies, password reset tokens in -the admin site, user sessions, and signatures created by -:class:`django.core.signing.Signer` and :meth:`django.core.signing.dumps`. -Algorithm must be ``'sha1'`` or ``'sha256'``. See -:ref:`release notes ` for usage details. - -.. deprecated:: 3.1 - - This transitional setting is deprecated. Support for it and tokens, - cookies, sessions, and signatures that use SHA-1 hashing algorithm will be - removed in Django 4.0. - .. setting:: DEFAULT_INDEX_TABLESPACE ``DEFAULT_INDEX_TABLESPACE`` diff --git a/docs/releases/3.1.txt b/docs/releases/3.1.txt index 730d0b682a..e6c040f22e 100644 --- a/docs/releases/3.1.txt +++ b/docs/releases/3.1.txt @@ -101,17 +101,17 @@ of this release `. ``DEFAULT_HASHING_ALGORITHM`` settings -------------------------------------- -The new :setting:`DEFAULT_HASHING_ALGORITHM` transitional setting allows -specifying the default hashing algorithm to use for encoding cookies, password -reset tokens in the admin site, user sessions, and signatures created by +The new ``DEFAULT_HASHING_ALGORITHM`` transitional setting allows specifying +the default hashing algorithm to use for encoding cookies, password reset +tokens in the admin site, user sessions, and signatures created by :class:`django.core.signing.Signer` and :meth:`django.core.signing.dumps`. Support for SHA-256 was added in Django 3.1. If you are upgrading multiple instances of the same project to Django 3.1, you should set -:setting:`DEFAULT_HASHING_ALGORITHM` to ``'sha1'`` during the transition, in -order to allow compatibility with the older versions of Django. Note that this -requires Django 3.1.1+. Once the transition to 3.1 is complete you can stop -overriding :setting:`DEFAULT_HASHING_ALGORITHM`. +``DEFAULT_HASHING_ALGORITHM`` to ``'sha1'`` during the transition, in order to +allow compatibility with the older versions of Django. Note that this requires +Django 3.1.1+. Once the transition to 3.1 is complete you can stop overriding +``DEFAULT_HASHING_ALGORITHM``. This setting is deprecated as of this release, because support for tokens, cookies, sessions, and signatures that use SHA-1 algorithm will be removed in diff --git a/docs/releases/4.0.txt b/docs/releases/4.0.txt index 0dd1a3d91a..c8106e2d39 100644 --- a/docs/releases/4.0.txt +++ b/docs/releases/4.0.txt @@ -323,3 +323,5 @@ to remove usage of these features. * ``django.contrib.postgres.forms.JSONField`` is removed. * The ``{% ifequal %}`` and ``{% ifnotequal %}`` template tags are removed. + +* The ``DEFAULT_HASHING_ALGORITHM`` transitional setting is removed. -- cgit v1.3