Ticket #14881: django-auth-string-pk-support.patch

django/contrib/auth/urls.py

@@ -11 +11 @@
     (r'^password_change/done/$', 'django.contrib.auth.views.password_change_done'),
     (r'^password_reset/$', 'django.contrib.auth.views.password_reset'),
     (r'^password_reset/done/$', 'django.contrib.auth.views.password_reset_done'),
-    (r'^reset/(?P<uidb36>[0-9A-Za-z]+)-(?P<token>.+)/$', 'django.contrib.auth.views.password_reset_confirm'),
+    (r'^reset/(?P<uidb64>[0-9A-Za-z_\-]+)/(?P<token>.+)/$', 'django.contrib.auth.views.password_reset_confirm'),
     (r'^reset/done/$', 'django.contrib.auth.views.password_reset_complete'),
 )
-

django/contrib/auth/views.py

@@ -13 +13 @@
 from django.contrib.sites.models import get_current_site
 from django.http import HttpResponseRedirect, Http404
 from django.template import RequestContext
-from django.utils.http import urlquote, base36_to_int
+from django.utils.http import urlquote, urlsafe_base64_decode
 from django.utils.translation import ugettext as _
 from django.contrib.auth.models import User
 from django.views.decorators.cache import never_cache
@@ -131 +131 @@
     return render_to_response(template_name, context_instance=RequestContext(request))
 
 # Doesn't need csrf_protect since no-one can guess the URL
-def password_reset_confirm(request, uidb36=None, token=None, template_name='registration/password_reset_confirm.html',
+def password_reset_confirm(request, uidb64=None, token=None, template_name='registration/password_reset_confirm.html',
                            token_generator=default_token_generator, set_password_form=SetPasswordForm,
                            post_reset_redirect=None):
     """
     View that checks the hash in a password reset link and presents a
     form for entering a new password.
     """
-    assert uidb36 is not None and token is not None # checked by URLconf
+    assert uidb64 is not None and token is not None # checked by URLconf
     if post_reset_redirect is None:
         post_reset_redirect = reverse('django.contrib.auth.views.password_reset_complete')
     try:
-        uid_int = base36_to_int(uidb36)
-        user = User.objects.get(id=uid_int)
+        uid = urlsafe_base64_decode(str(uidb64))
+        user = User.objects.get(id=uid)
     except (ValueError, User.DoesNotExist):
         user = None
 

django/contrib/auth/tests/templates/registration/password_reset_email.html

@@ -1 @@
-{{ protocol }}://{{ domain }}/reset/{{ uid }}-{{ token }}/
+{{ protocol }}://{{ domain }}/reset/{{ uid }}/{{ token }}/

django/contrib/auth/forms.py

@@ -5 +5 @@
 from django.template import Context, loader
 from django import forms
 from django.utils.translation import ugettext_lazy as _
-from django.utils.http import int_to_base36
+from django.utils.http import urlsafe_base64_encode
 
 class UserCreationForm(forms.ModelForm):
     """
@@ -134 +134 @@
                 'email': user.email,
                 'domain': domain,
                 'site_name': site_name,
-                'uid': int_to_base36(user.id),
+                'uid': urlsafe_base64_encode(str(user.id)),
                 'user': user,
                 'token': token_generator.make_token(user),
                 'protocol': use_https and 'https' or 'http',

django/utils/http.py

@@ -1 +1 @@
 import re
 import urllib
+import base64
+from binascii import Error as BinasciiError
 from email.Utils import formatdate
 
 from django.utils.encoding import smart_str, force_unicode
@@ -73 +75 @@
 
 def base36_to_int(s):
     """
-    Convertd a base 36 string to an integer
+    Converts a base 36 string to an integer
     """
     return int(s, 36)
 
@@ -98 +100 @@
         factor -= 1
     return ''.join(base36)
 
+def urlsafe_base64_encode(s):
+    return base64.urlsafe_b64encode(s).rstrip('\n=')
+
+def urlsafe_base64_decode(s):
+    assert isinstance(s, str)
+    try:
+        return base64.urlsafe_b64decode(s.ljust(len(s) + len(s) % 4, '='))
+    except (LookupError, BinasciiError), e:
+        raise ValueError(e)
+
 def parse_etags(etag_str):
     """
     Parses a string with one or several etags passed in If-None-Match and

django/contrib/auth/tests/views.py

@@ -102 +102 @@
 
     def test_confirm_invalid_user(self):
         # Ensure that we get a 200 response for a non-existant user, not a 404
-        response = self.client.get('/reset/123456-1-1/')
+        response = self.client.get('/reset/123456/1-1/')
         self.assertEquals(response.status_code, 200)
         self.assert_("The password reset link was invalid" in response.content)