/
CHANGES.txt
77 lines (56 loc) · 2.92 KB
/
CHANGES.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
=======
CHANGES
=======
4.0.0 (unreleased)
------------------
- Replaced deprecated ``zope.interface.implements`` usage with equivalent
``zope.interface.implementer`` decorator.
- Dropped support for Python 2.4 and 2.5.
- Add a new IMatchingPasswordManager interface with a 'match' method, which
returns True if a given password hash was encdoded with the scheme
implemented by the specific manager. All managers in this package implement
this interface.
- Use {SHA} as the prefix for SHA1-encoded passwords to be compatible with
RFC 2307, but support matching against {SHA1} for backwards compatibility.
- Add a crypt password manager to fully support all methods named in RFC 2307.
It is contained in the 'legacy' module however, to flag crypt's status.
- Add a SMD5 (salted MD5) password manager to fully support all encoding
schemes implemented by OpenLDAP.
- Add a MySQL PASSWORD() (versions before 4.1) password manager, as also found
in Zope2's AccessControl.AuthEncoding module.
- Remove the useless, cosmetic salt from the MD5 and SHA1 password managers,
and use base64 encoding instead of hexdigests. This makes the output of
these managers compatible with other MD5 and SHA1 hash implementations such
as RFC 2307 but doesn't lower it's security in any way. Checking passwords
against old, still 'salted' password hashes with hexdigests is still
supported.
- Use the standard_base64encode method instead of url_base64encode to maintain
compatibility with LDAP.
3.6.1 (2010-05-27)
------------------
- The SSHAPasswordManager.checkPassword() would not handle unicode input
(even if the string would only contain ascii characters). Now, the
encoded_password input will be encoded to ascii, which is deemed safe as it
should not contain non-ascii characters anyway.
3.6.0 (2010-05-07)
------------------
- Removed zope.testing dependency for tests.
- Updated some copyright headers to comply to repository policy.
- Added zpasswd script formerly hold in zope.app.server. Contrary to
former zpasswd script, which used "Plain Text" as default password
manager, now SSHA is used as default.
3.5.1 (2009-03-14)
------------------
- Make security protection directives in `configure.zcml` execute only
if ``zope.security`` is installed. This will allow reuse of the
`configure.zcml` file in environments without ``zope.security``,
for example with ``repoze.zcml``.
- Add "Password Manager Names" vocabulary for use with ``zope.schema``
and ``zope.component``, like it was in ``zope.app.authentication``.
It's an optional feature so it doesn't add hard dependency. We use
"vocabulary" extra to list dependencies needed for vocabulary functionality.
3.5.0 (2009-03-06)
------------------
First release. This package was splitted off from ``zope.app.authentication``
to separate password manager functionality that is greatly re-usable without
any bit of ``zope.app.authentication`` and to reduce its dependencies.