Changeset 75ccc48 for remit

Timestamp:

Jun 15, 2014, 9:42:51 PM (11 years ago)

Author:

Alex Dehnert <adehnert@…>

Branches:

master

Children:

ff623c3

Parents:

5c334f6

git-author:

Alex Dehnert <adehnert@…> (06/15/14 17:51:08)

git-committer:

Alex Dehnert <adehnert@…> (06/15/14 21:42:51)

Message:

Django 1.6: Handle the removal of UNUSABLE_PASSWORD

Django 1.6 (specifically, ticket #20079) replaced a fixed UNUSABLE_PASSWORD
with a prefix followed by a random suffix, to avoid password reset attacks.
This updates the a migration to do the same.

While in theory we could do a better job of (e.g.) using different random
passwords per-user, it's unlikely that the migration will ever impact a user --
new installs won't have any users with bad passwords, and old installs have
probably already run the migration (esp.mit.edu, the only site I know of using
SocketAuth?, already seems to have).

File:

• remit/finance_core/migrations/0004_socket_auth_password.py (modified) (2 diffs)

remit/finance_core/migrations/0004_socket_auth_password.py

@@ -3 +3 @@
 from south.db import db
 from south.v2 import DataMigration
-from django.contrib.auth.hashers import UNUSABLE_PASSWORD
+import django.contrib.auth.hashers
 from django.db import models
+from django.db.models import F
 
 class Migration(DataMigration):
@@ -11 +12 @@
         "Write your forwards methods here."
         issues = orm['auth.user'].objects.filter(password__in=['', 'SocketAuth'])
-        issues.update(password=UNUSABLE_PASSWORD)
+        try: # pre-1.6
+            new_password = django.contrib.auth.hashers.UNUSABLE_PASSWORD
+        except AttributeError: # post-1.6
+            # See https://code.djangoproject.com/ticket/20079 for details on the change.
+            # Ideally, we'd use a different suffix per user, but I don't want
+            # to deal with that, and this is probably acceptably secure.
+            #
+            # Also, it seems a little unlikely that this code will actually
+            # run -- it requires an install that hasn't already run the
+            # migration (notably, esp.mit.edu has already), but *does* have
+            # accounts with SocketAuth passwords.
+            prefix = django.contrib.auth.hashers.UNUSABLE_PASSWORD_PREFIX
+            suffix = django.contrib.auth.hashers.get_random_string(django.contrib.auth.hashers.UNUSABLE_PASSWORD_SUFFIX_LENGTH)
+            new_password = prefix + F("password") + prefix + suffix
+        issues.update(password=new_password)
 
     def backwards(self, orm):