Skip to content

Commit

Permalink
Fixed #17944 -- Prevented an error in the user change page of the adm…
Browse files Browse the repository at this point in the history 
…in when the content of the password field doesn't match the expected format. Thanks saxix for the report and initial patch.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@17775 bcc190cf-cafb-0310-a4f2-bffc1f526a37
  • Loading branch information
@aaugustin
aaugustin committed Mar 22, 2012
1 parent 1e28567 commit a8d0fc1
Show file tree
Hide file tree
Showing 3 changed files with 120 additions and 44 deletions.
130 changes: 92 additions & 38 deletions django/contrib/auth/fixtures/authtestdata.json
View file
@@ -1,55 +1,109 @@
[ [
{ {
"pk": "1", "pk": "1",
"model": "auth.user", "model": "auth.user",
"fields": { "fields": {
"username": "testclient", "username": "testclient",
"first_name": "Test", "first_name": "Test",
"last_name": "Client", "last_name": "Client",
"is_active": true, "is_active": true,
"is_superuser": false, "is_superuser": false,
"is_staff": false, "is_staff": false,
"last_login": "2006-12-17 07:03:31", "last_login": "2006-12-17 07:03:31",
"groups": [], "groups": [],
"user_permissions": [], "user_permissions": [],
"password": "sha1$6efc0$f93efe9fd7542f25a7be94871ea45aa95de57161", "password": "sha1$6efc0$f93efe9fd7542f25a7be94871ea45aa95de57161",
"email": "testclient@example.com", "email": "testclient@example.com",
"date_joined": "2006-12-17 07:03:31" "date_joined": "2006-12-17 07:03:31"
} }
}, },
{ {
"pk": "2", "pk": "2",
"model": "auth.user", "model": "auth.user",
"fields": { "fields": {
"username": "inactive", "username": "inactive",
"first_name": "Inactive", "first_name": "Inactive",
"last_name": "User", "last_name": "User",
"is_active": false, "is_active": false,
"is_superuser": false, "is_superuser": false,
"is_staff": false, "is_staff": false,
"last_login": "2006-12-17 07:03:31", "last_login": "2006-12-17 07:03:31",
"groups": [], "groups": [],
"user_permissions": [], "user_permissions": [],
"password": "sha1$6efc0$f93efe9fd7542f25a7be94871ea45aa95de57161", "password": "sha1$6efc0$f93efe9fd7542f25a7be94871ea45aa95de57161",
"email": "testclient2@example.com", "email": "testclient2@example.com",
"date_joined": "2006-12-17 07:03:31" "date_joined": "2006-12-17 07:03:31"
} }
}, },
{ {
"pk": "3", "pk": "3",
"model": "auth.user", "model": "auth.user",
"fields": { "fields": {
"username": "staff", "username": "staff",
"first_name": "Staff", "first_name": "Staff",
"last_name": "Member", "last_name": "Member",
"is_active": true, "is_active": true,
"is_superuser": false, "is_superuser": false,
"is_staff": true, "is_staff": true,
"last_login": "2006-12-17 07:03:31", "last_login": "2006-12-17 07:03:31",
"groups": [], "groups": [],
"user_permissions": [], "user_permissions": [],
"password": "sha1$6efc0$f93efe9fd7542f25a7be94871ea45aa95de57161", "password": "sha1$6efc0$f93efe9fd7542f25a7be94871ea45aa95de57161",
"email": "staffmember@example.com", "email": "staffmember@example.com",
"date_joined": "2006-12-17 07:03:31"
}
},
{
"pk": "4",
"model": "auth.user",
"fields": {
"username": "empty_password",
"first_name": "Empty",
"last_name": "Password",
"is_active": true,
"is_superuser": false,
"is_staff": false,
"last_login": "2006-12-17 07:03:31",
"groups": [],
"user_permissions": [],
"password": "",
"email": "empty_password@example.com",
"date_joined": "2006-12-17 07:03:31"
}
},
{
"pk": "5",
"model": "auth.user",
"fields": {
"username": "unmanageable_password",
"first_name": "Unmanageable",
"last_name": "Password",
"is_active": true,
"is_superuser": false,
"is_staff": false,
"last_login": "2006-12-17 07:03:31",
"groups": [],
"user_permissions": [],
"password": "$",
"email": "unmanageable_password@example.com",
"date_joined": "2006-12-17 07:03:31"
}
},
{
"pk": "6",
"model": "auth.user",
"fields": {
"username": "unknown_password",
"first_name": "Unknown",
"last_name": "Password",
"is_active": true,
"is_superuser": false,
"is_staff": false,
"last_login": "2006-12-17 07:03:31",
"groups": [],
"user_permissions": [],
"password": "foo$bar",
"email": "unknown_password@example.com",
"date_joined": "2006-12-17 07:03:31" "date_joined": "2006-12-17 07:03:31"
} }
} }
Expand Down
14 changes: 9 additions & 5 deletions django/contrib/auth/forms.py
View file
Expand Up @@ -29,14 +29,18 @@ def render(self, name, value, attrs):
encoded = smart_str(encoded) encoded = smart_str(encoded)


if len(encoded) == 32 and '$' not in encoded: if len(encoded) == 32 and '$' not in encoded:
hasher = get_hasher('unsalted_md5') algorithm = 'unsalted_md5'
else: else:
algorithm = encoded.split('$', 1)[0] algorithm = encoded.split('$', 1)[0]
hasher = get_hasher(algorithm)


summary = "" try:
for key, value in hasher.safe_summary(encoded).iteritems(): hasher = get_hasher(algorithm)
summary += "<strong>%(key)s</strong>: %(value)s " % {"key": ugettext(key), "value": value} except ValueError:
summary = "<strong>%s</strong>" % ugettext("Invalid password format or unknown hashing algorithm.")
else:
summary = ""
for key, value in hasher.safe_summary(encoded).iteritems():
summary += "<strong>%(key)s</strong>: %(value)s " % {"key": ugettext(key), "value": value}


return mark_safe("<div%(attrs)s>%(summary)s</div>" % {"attrs": flatatt(final_attrs), "summary": summary}) return mark_safe("<div%(attrs)s>%(summary)s</div>" % {"attrs": flatatt(final_attrs), "summary": summary})


Expand Down
20 changes: 19 additions & 1 deletion django/contrib/auth/tests/forms.py
View file
Expand Up @@ -65,7 +65,6 @@ def test_both_passwords(self):


def test_success(self): def test_success(self):
# The success case. # The success case.

data = { data = {
'username': 'jsmith@example.com', 'username': 'jsmith@example.com',
'password1': 'test123', 'password1': 'test123',
Expand Down Expand Up @@ -236,6 +235,25 @@ class Meta(UserChangeForm.Meta):
# Just check we can create it # Just check we can create it
form = MyUserForm({}) form = MyUserForm({})


def test_bug_17944_empty_password(self):
user = User.objects.get(username='empty_password')
form = UserChangeForm(instance=user)
# Just check that no error is raised.
form.as_table()

def test_bug_17944_unmanageable_password(self):
user = User.objects.get(username='unmanageable_password')
form = UserChangeForm(instance=user)
# Just check that no error is raised.
form.as_table()

def test_bug_17944_unknown_password_algorithm(self):
user = User.objects.get(username='unknown_password')
form = UserChangeForm(instance=user)
# Just check that no error is raised.
form.as_table()


UserChangeFormTest = override_settings(USE_TZ=False)(UserChangeFormTest) UserChangeFormTest = override_settings(USE_TZ=False)(UserChangeFormTest)




Expand Down

0 comments on commit a8d0fc1

Please sign in to comment.