Fixed #31375 -- Made contrib.auth.hashers.make_password() accept only bytes or strings.

1 files changed, 5 insertions, 0 deletions

diff --git a/django/contrib/auth/hashers.py b/django/contrib/auth/hashers.py
index c8cf0d3bf8..66fb94e7af 100644
--- a/django/contrib/auth/hashers.py
+++ b/django/contrib/auth/hashers.py
@@ -72,6 +72,11 @@ def make_password(password, salt=None, hasher='default'):
     """
     if password is None:
         return UNUSABLE_PASSWORD_PREFIX + get_random_string(UNUSABLE_PASSWORD_SUFFIX_LENGTH)
+    if not isinstance(password, (bytes, str)):
+        raise TypeError(
+            'Password must be a string or bytes, got %s.'
+            % type(password).__qualname__
+        )
     hasher = get_hasher(hasher)
     salt = salt or hasher.salt()
     return hasher.encode(password, salt)