Ticket #10265: token.patch

contrib/auth/tokens.py

@@ -52 +52 @@
         # We limit the hash to 20 chars to keep URL short
         from django.utils.hashcompat import sha_constructor
         hash = sha_constructor(settings.SECRET_KEY + unicode(user.id) +
-                               user.password + unicode(user.last_login) +
+                               user.password + user.last_login.strftime('%Y-%m-%d %H:%M:%S') +
                                unicode(timestamp)).hexdigest()[::2]
         return "%s-%s" % (ts_b36, hash)
 

contrib/auth/tests/tokens.py

@@ -8 +8 @@
 >>> p0.check_token(u, tk1)
 True
 
+>>> u = User.objects.create_user('comebackkid', 'test3@example.com', 'testpw')
+>>> p0 = PasswordResetTokenGenerator()
+>>> tk1 = p0.make_token(u)
+>>> reload = User.objects.get(username='comebackkid')
+>>> tk2 = p0.make_token(reload)
+>>> tk1 == tk2
+True
+
 Tests to ensure we can use the token after n days, but no greater.
 Use a mocked version of PasswordResetTokenGenerator so we can change
 the value of 'today'