Ticket #16845: mask-password-field.diff

django/contrib/auth/forms.py

@@ -1 +1 @@
 from django import forms
+from django.forms.util import flatatt
 from django.template import loader
 from django.utils.http import int_to_base36
+from django.utils.safestring import mark_safe
 from django.utils.translation import ugettext_lazy as _
 
 from django.contrib.auth.models import User
@@ -9 +11 @@
 from django.contrib.auth.tokens import default_token_generator
 from django.contrib.sites.models import get_current_site
 
+UNMASKED_DIGITS_TO_SHOW = 6
+
+
+class ReadOnlyHashedPasswordWidget(forms.Widget):
+    def render(self, name, value, attrs):
+        final_attrs = self.build_attrs(attrs)
+
+        if not value:
+            return "None"
+
+        parts = value.split("$")
+        if len(parts) != 3:
+            # Legacy Passwords did not have a hash and were md5
+            hash_type = "md5"
+            masked = "%s%s" % (value[:UNMASKED_DIGITS_TO_SHOW], "*" * max(len(value) - UNMASKED_DIGITS_TO_SHOW, 0))
+        else:
+            hash_type = parts[0]
+            masked = "%s%s" % (parts[2][:UNMASKED_DIGITS_TO_SHOW], "*" * max(len(parts[2]) - UNMASKED_DIGITS_TO_SHOW, 0))
+
+        return mark_safe("""<div%(attrs)s>
+                    <strong>%(hash_type_label)s</strong>: %(hash_type)s
+                    <strong>%(masked_label)s</strong>: %(masked)s
+                </div>""" % {
+                    "attrs": flatatt(final_attrs),
+                    "hash_type_label": _("Hash Type"),
+                    "hash_type": hash_type,
+                    "masked_label": _("Masked Hash"),
+                    "masked": masked,
+                })
+
+
+class ReadOnlyHashedPasswordField(forms.Field):
+    widget = ReadOnlyHashedPasswordWidget
+
+    def __init__(self, *args, **kwargs):
+        kwargs.setdefault("required", False)
+        super(ReadOnlyHashedPasswordField, self).__init__(*args, **kwargs)
+
 
 class UserCreationForm(forms.ModelForm):
     """
@@ -51 +91 @@
     username = forms.RegexField(label=_("Username"), max_length=30, regex=r'^[\w.@+-]+$',
         help_text = _("Required. 30 characters or fewer. Letters, digits and @/./+/-/_ only."),
         error_messages = {'invalid': _("This value may contain only letters, numbers and @/./+/-/_ characters.")})
+    password = ReadOnlyHashedPasswordField(label=_("Password"), help_text=_("Use the <a href=\"password/\">change password form</a>."))
+
+    def clean_password(self):
+        return self.initial["password"]
 
     class Meta:
         model = User