mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-08-04 10:59:45 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Fixed #28718 -- Allowed user to request a password reset if their password doesn't use an enabled hasher.

Browse source 
Regression in aeb1389442.
Reverted changes to is_password_usable() from
703c266682 and documentation changes from
92f48680db.
This commit is contained in:
Tim Graham 2018-03-20 17:19:27 -04:00
parent d97cce3409
commit a4f0e9aec7
7 changed files with 50 additions and 19 deletions
Download patch file Download diff file Expand all files Collapse all files

12
docs/topics/auth/passwords.txt
View file

@ -409,8 +409,16 @@ from the ``User`` model.
.. function:: is_password_usable(encoded_password)
Checks if the given string is a hashed password that has a chance
of being verified against :func:`check_password`.
Returns ``False`` if the password is a result of
:meth:`.User.set_unusable_password`.
.. versionchanged:: 2.1
In older versions, this also returns ``False`` if the password is
``None`` or an empty string, or if the password uses a hasher that's
not in the :setting:`PASSWORD_HASHERS` setting. That behavior is
considered a bug as it prevents users with such passwords from
requesting a password reset.
.. _password-validation: