mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-08-03 18:38:50 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Refs #31842 -- Removed DEFAULT_HASHING_ALGORITHM transitional setting.

Browse source 
Per deprecation timeline.
This commit is contained in:
Mariusz Felisiak 2021-01-14 10:27:04 +01:00
parent e7208f13c0
commit 0aa6a602b2
15 changed files with 16 additions and 177 deletions
Download patch file Download diff file Expand all files Collapse all files

4
docs/ref/checks.txt
View file

@ -494,8 +494,8 @@ The following checks are run if you use the :option:`check --deploy` option:
The following checks verify that your security-related settings are correctly
configured:
* **security.E100**: :setting:`DEFAULT_HASHING_ALGORITHM` must be ``'sha1'`` or
``'sha256'``.
* **security.E100**: ``DEFAULT_HASHING_ALGORITHM`` must be ``'sha1'`` or
``'sha256'``. *This check appeared in Django 3.1 and 3.2*.
* **security.E101**: The CSRF failure view ``'path.to.view'`` does not take the
correct number of arguments.
* **security.E102**: The CSRF failure view ``'path.to.view'`` could not be

19
docs/ref/settings.txt
View file

@ -1291,25 +1291,6 @@ Default email address to use for various automated correspondence from the
site manager(s). This doesn't include error messages sent to :setting:`ADMINS`
and :setting:`MANAGERS`; for that, see :setting:`SERVER_EMAIL`.
.. setting:: DEFAULT_HASHING_ALGORITHM
``DEFAULT_HASHING_ALGORITHM``
-----------------------------
Default: ``'sha256'``
Default hashing algorithm to use for encoding cookies, password reset tokens in
the admin site, user sessions, and signatures created by
:class:`django.core.signing.Signer` and :meth:`django.core.signing.dumps`.
Algorithm must be ``'sha1'`` or ``'sha256'``. See
:ref:`release notes <default-hashing-algorithm-usage>` for usage details.
.. deprecated:: 3.1
This transitional setting is deprecated. Support for it and tokens,
cookies, sessions, and signatures that use SHA-1 hashing algorithm will be
removed in Django 4.0.
.. setting:: DEFAULT_INDEX_TABLESPACE
``DEFAULT_INDEX_TABLESPACE``

14
docs/releases/3.1.txt
View file

@ -101,17 +101,17 @@ of this release <deprecated-jsonfield>`.
``DEFAULT_HASHING_ALGORITHM`` settings
--------------------------------------
The new :setting:`DEFAULT_HASHING_ALGORITHM` transitional setting allows
specifying the default hashing algorithm to use for encoding cookies, password
reset tokens in the admin site, user sessions, and signatures created by
The new ``DEFAULT_HASHING_ALGORITHM`` transitional setting allows specifying
the default hashing algorithm to use for encoding cookies, password reset
tokens in the admin site, user sessions, and signatures created by
:class:`django.core.signing.Signer` and :meth:`django.core.signing.dumps`.
Support for SHA-256 was added in Django 3.1. If you are upgrading multiple
instances of the same project to Django 3.1, you should set
:setting:`DEFAULT_HASHING_ALGORITHM` to ``'sha1'`` during the transition, in
order to allow compatibility with the older versions of Django. Note that this
requires Django 3.1.1+. Once the transition to 3.1 is complete you can stop
overriding :setting:`DEFAULT_HASHING_ALGORITHM`.
``DEFAULT_HASHING_ALGORITHM`` to ``'sha1'`` during the transition, in order to
allow compatibility with the older versions of Django. Note that this requires
Django 3.1.1+. Once the transition to 3.1 is complete you can stop overriding
``DEFAULT_HASHING_ALGORITHM``.
This setting is deprecated as of this release, because support for tokens,
cookies, sessions, and signatures that use SHA-1 algorithm will be removed in

2
docs/releases/4.0.txt
View file

@ -323,3 +323,5 @@ to remove usage of these features.
* ``django.contrib.postgres.forms.JSONField`` is removed.
* The ``{% ifequal %}`` and ``{% ifnotequal %}`` template tags are removed.
* The ``DEFAULT_HASHING_ALGORITHM`` transitional setting is removed.