Ticket #14881: 1.4.patch

django/contrib/admin/templates/registration/password_reset_email.html

@@ -3 +3 @@
 
 {% trans "Please go to the following page and choose a new password:" %}
 {% block reset_link %}
-{{ protocol }}://{{ domain }}{% url 'django.contrib.auth.views.password_reset_confirm' uidb36=uid token=token %}
+{{ protocol }}://{{ domain }}{% url 'django.contrib.auth.views.password_reset_confirm' uidb64=uid token=token %}
 {% endblock %}
 {% trans "Your username, in case you've forgotten:" %} {{ user.username }}
 

django/contrib/auth/forms.py

@@ -1 +1 @@
 from django import forms
 from django.template import loader
-from django.utils.http import int_to_base36
+from django.utils.http import urlsafe_base64_encode
 from django.utils.translation import ugettext_lazy as _
 
 from django.contrib.auth.models import User
@@ -144 +144 @@
                 'email': user.email,
                 'domain': domain,
                 'site_name': site_name,
-                'uid': int_to_base36(user.id),
+                'uid': urlsafe_base64_encode(str(user.id)),
                 'user': user,
                 'token': token_generator.make_token(user),
                 'protocol': use_https and 'https' or 'http',

django/contrib/auth/tests/templates/registration/password_reset_email.html

@@ -1 @@
-{{ protocol }}://{{ domain }}/reset/{{ uid }}-{{ token }}/
- No newline at end of file
+{{ protocol }}://{{ domain }}/reset/{{ uid }}/{{ token }}/

django/contrib/auth/tests/views.py

@@ -129 +129 @@
 
     def test_confirm_invalid_user(self):
         # Ensure that we get a 200 response for a non-existant user, not a 404
-        response = self.client.get('/reset/123456-1-1/')
+        response = self.client.get('/reset/123456/1-1/')
         self.assertEqual(response.status_code, 200)
         self.assertTrue("The password reset link was invalid" in response.content)
 
     def test_confirm_overflow_user(self):
         # Ensure that we get a 200 response for a base36 user id that overflows int
-        response = self.client.get('/reset/zzzzzzzzzzzzz-1-1/')
+        response = self.client.get('/reset/zzzzzzzzzzzzz/1-1/')
         self.assertEqual(response.status_code, 200)
         self.assertTrue("The password reset link was invalid" in response.content)
 

django/contrib/auth/urls.py

@@ -12 +12 @@
     url(r'^password_change/done/$', 'django.contrib.auth.views.password_change_done', name='password_change_done'),
     url(r'^password_reset/$', 'django.contrib.auth.views.password_reset', name='password_reset'),
     url(r'^password_reset/done/$', 'django.contrib.auth.views.password_reset_done', name='password_reset_done'),
-    url(r'^reset/(?P<uidb36>[0-9A-Za-z]{1,13})-(?P<token>[0-9A-Za-z]{1,13}-[0-9A-Za-z]{1,20})/$',
+    url(r'^reset/(?P<uidb64>[0-9A-Za-z_\-]+)/(?P<token>[0-9A-Za-z]{1,13}-[0-9A-Za-z]{1,20})/$',
         'django.contrib.auth.views.password_reset_confirm',
         name='password_reset_confirm'),
     url(r'^reset/done/$', 'django.contrib.auth.views.password_reset_complete', name='password_reset_complete'),

django/contrib/auth/views.py

@@ -4 +4 @@
 from django.core.urlresolvers import reverse
 from django.http import HttpResponseRedirect, QueryDict
 from django.template.response import TemplateResponse
-from django.utils.http import base36_to_int
+from django.utils.http import urlsafe_base64_decode
 from django.utils.translation import ugettext as _
 from django.views.decorators.debug import sensitive_post_parameters
 from django.views.decorators.cache import never_cache
@@ -181 +181 @@
 # Doesn't need csrf_protect since no-one can guess the URL
 @sensitive_post_parameters()
 @never_cache
-def password_reset_confirm(request, uidb36=None, token=None,
+def password_reset_confirm(request, uidb64=None, token=None,
                            template_name='registration/password_reset_confirm.html',
                            token_generator=default_token_generator,
                            set_password_form=SetPasswordForm,
@@ -191 +191 @@
     View that checks the hash in a password reset link and presents a
     form for entering a new password.
     """
-    assert uidb36 is not None and token is not None # checked by URLconf
+    assert uidb64 is not None and token is not None # checked by URLconf
     if post_reset_redirect is None:
         post_reset_redirect = reverse('django.contrib.auth.views.password_reset_complete')
     try:
-        uid_int = base36_to_int(uidb36)
-        user = User.objects.get(id=uid_int)
-    except (ValueError, User.DoesNotExist):
+        uid = urlsafe_base64_decode(str(uidb64))
+        user = User.objects.get(id=uid)
+    except (TypeError, ValueError, User.DoesNotExist):
         user = None
 
     if user is not None and token_generator.check_token(user, token):

django/utils/http.py

@@ +1 @@
+import base64
 import calendar
 import datetime
 import re
 import sys
 import urllib
 import urlparse
+from binascii import Error as BinasciiError
 from email.utils import formatdate
 
 from django.utils.datastructures import MultiValueDict
@@ -171 +173 @@
         factor -= 1
     return ''.join(base36)
 
+def urlsafe_base64_encode(s):
+    return base64.urlsafe_b64encode(s).rstrip('\n=')
+
+def urlsafe_base64_decode(s):
+    assert isinstance(s, str)
+    try:
+        return base64.urlsafe_b64decode(s.ljust(len(s) + len(s) % 4, '='))
+    except (LookupError, BinasciiError), e:
+        raise ValueError(e)
+
 def parse_etags(etag_str):
     """
     Parses a string with one or several etags passed in If-None-Match and