mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-08-04 19:08:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Fixed #20593 -- Allow blank passwords in check_password() and set_password()

Browse source
This commit is contained in:
Erik Romijn 2013-06-17 18:06:26 +02:00 • committed by Tim Graham
parent 3128f3d38d
commit 2c4fe761a0
6 changed files with 106 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

16
docs/ref/contrib/auth.txt
View file

@ -132,12 +132,28 @@ Methods
password hashing. Doesn't save the
:class:`~django.contrib.auth.models.User` object.
When the ``raw_password`` is ``None``, the password will be set to an
unusable password, as if
:meth:`~django.contrib.auth.models.User.set_unusable_password()`
were used.
.. versionchanged:: 1.6
In Django 1.4 and 1.5, a blank string was unintentionally stored
as an unsable password.
.. method:: check_password(raw_password)
Returns ``True`` if the given raw string is the correct password for
the user. (This takes care of the password hashing in making the
comparison.)
.. versionchanged:: 1.6
In Django 1.4 and 1.5, a blank string was unintentionally
considered to be an unusable password, resulting in this method
returning ``False`` for such a password.
.. method:: set_unusable_password()
Marks the user as having no password set. This isn't the same as