Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with
or
.
Download ZIP
Browse files

Fixed #15627 -- Use constant time comparison for password checks. Tha…

…nks to hvdklauw for the report and patch.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@15870 bcc190cf-cafb-0310-a4f2-bffc1f526a37
  • Loading branch information...
commit a0878b5f95b5fc5bac02d818e864cab507b73564 1 parent 7ab5ce6
@freakboy3742 freakboy3742 authored
Showing with 2 additions and 1 deletion.
  1. +2 −1  django/contrib/auth/models.py
View
3  django/contrib/auth/models.py
@@ -10,6 +10,7 @@
from django.utils.encoding import smart_str
from django.utils.hashcompat import md5_constructor, sha_constructor
from django.utils.translation import ugettext_lazy as _
+from django.utils.crypto import constant_time_compare
UNUSABLE_PASSWORD = '!' # This will never be a valid hash
@@ -39,7 +40,7 @@ def check_password(raw_password, enc_password):
encryption formats behind the scenes.
"""
algo, salt, hsh = enc_password.split('$')
- return hsh == get_hexdigest(algo, salt, raw_password)
+ return constant_time_compare(hsh, get_hexdigest(algo, salt, raw_password))
def update_last_login(sender, user, **kwargs):
"""

0 comments on commit a0878b5

Please sign in to comment.
Something went wrong with that request. Please try again.