Ticket #27468: 27468-sessions.diff

django/contrib/auth/__init__.py

@@ -91 +91 @@
     the anonymous session is retained when the user logs in.
     """
     session_auth_hash = ''
+    session_auth_hash_legacy = ''
     if user is None:
         user = request.user
     if hasattr(user, 'get_session_auth_hash'):
         session_auth_hash = user.get_session_auth_hash()
+    if hasattr(user, '_get_session_auth_hash_legacy'):
+        session_auth_hash_legacy = user._get_session_auth_hash_legacy()
 
     if SESSION_KEY in request.session:
-        if _get_user_session_key(request) != user.pk or (
+        if _get_user_session_key(request) != user.pk or ((
                 session_auth_hash and
-                not constant_time_compare(request.session.get(HASH_SESSION_KEY, ''), session_auth_hash)):
+                not constant_time_compare(request.session.get(HASH_SESSION_KEY, ''), session_auth_hash)) and (
+                session_auth_hash_legacy and
+                not constant_time_compare(request.session.get(HASH_SESSION_KEY, ''), session_auth_hash_legacy))):
             # To avoid reusing another user's session, create a new, empty
             # session if the existing session corresponds to a different
             # authenticated user.

django/contrib/auth/base_user.py

@@ -120 +120 @@
         """
         return is_password_usable(self.password)
 
+    def _get_session_auth_hash_legacy(self):
+        """
+        Return an HMAC of the password field.
+        """
+        key_salt = "django.contrib.auth.models.AbstractBaseUser.get_session_auth_hash"
+        return salted_hmac(key_salt, self.password, algorithm='sha1').hexdigest()
+
     def get_session_auth_hash(self):
         """
         Return an HMAC of the password field.
         """
         key_salt = "django.contrib.auth.models.AbstractBaseUser.get_session_auth_hash"
-        return salted_hmac(key_salt, self.password).hexdigest()
+        return salted_hmac(key_salt, self.password, algorithm='sha256').hexdigest()
 
     @classmethod
     def get_email_field_name(cls):