From a4f0e9aec76ee40c938d3bf450ff63211b7ba1f1 Mon Sep 17 00:00:00 2001 From: Tim Graham Date: Tue, 20 Mar 2018 17:19:27 -0400 Subject: Fixed #28718 -- Allowed user to request a password reset if their password doesn't use an enabled hasher. Regression in aeb1389442d0f9669edf6660b747fd10693b63a7. Reverted changes to is_password_usable() from 703c266682be39f7153498ad0d8031231f12ee79 and documentation changes from 92f48680dbd2e02f2b33f6ad0e35b7d337889fb2. --- docs/ref/contrib/auth.txt | 12 +++++++++--- docs/releases/2.1.txt | 8 ++++++++ docs/topics/auth/passwords.txt | 12 ++++++++++-- 3 files changed, 27 insertions(+), 5 deletions(-) (limited to 'docs') diff --git a/docs/ref/contrib/auth.txt b/docs/ref/contrib/auth.txt index e05280367c..2b1aa9ae08 100644 --- a/docs/ref/contrib/auth.txt +++ b/docs/ref/contrib/auth.txt @@ -212,9 +212,15 @@ Methods Returns ``False`` if :meth:`~django.contrib.auth.models.User.set_unusable_password()` has - been called for this user, or if the password is ``None``, or if the - password uses a hasher that's not in the :setting:`PASSWORD_HASHERS` - setting. + been called for this user. + + .. versionchanged:: 2.1 + + In older versions, this also returns ``False`` if the password is + ``None`` or an empty string, or if the password uses a hasher + that's not in the :setting:`PASSWORD_HASHERS` setting. That + behavior is considered a bug as it prevents users with such + passwords from requesting a password reset. .. method:: get_group_permissions(obj=None) diff --git a/docs/releases/2.1.txt b/docs/releases/2.1.txt index 439dc275ce..463fad0b6c 100644 --- a/docs/releases/2.1.txt +++ b/docs/releases/2.1.txt @@ -358,6 +358,14 @@ Miscellaneous changed from 0 to an empty string, which mainly may require some adjustments in tests that compare HTML. +* :meth:`.User.has_usable_password` and the + :func:`~django.contrib.auth.hashers.is_password_usable` function no longer + return ``False`` if the password is ``None`` or an empty string, or if the + password uses a hasher that's not in the :setting:`PASSWORD_HASHERS` setting. + This undocumented behavior was a regression in Django 1.6 and prevented users + with such passwords from requesting a password reset. Audit your code to + confirm that your usage of these APIs don't rely on the old behavior. + .. _deprecated-features-2.1: Features deprecated in 2.1 diff --git a/docs/topics/auth/passwords.txt b/docs/topics/auth/passwords.txt index 4dc6748075..0125118de6 100644 --- a/docs/topics/auth/passwords.txt +++ b/docs/topics/auth/passwords.txt @@ -409,8 +409,16 @@ from the ``User`` model. .. function:: is_password_usable(encoded_password) - Checks if the given string is a hashed password that has a chance - of being verified against :func:`check_password`. + Returns ``False`` if the password is a result of + :meth:`.User.set_unusable_password`. + + .. versionchanged:: 2.1 + + In older versions, this also returns ``False`` if the password is + ``None`` or an empty string, or if the password uses a hasher that's + not in the :setting:`PASSWORD_HASHERS` setting. That behavior is + considered a bug as it prevents users with such passwords from + requesting a password reset. .. _password-validation: -- cgit v1.3