Ticket #6858: legacy_auth.diff

django/contrib/auth/backends.py

@@ -1 +1 @@
 from django.db import connection
+from django.contrib.auth.models import get_hexdigest
 from django.contrib.auth.models import User
 
 try: 
@@ -68 +69 @@
             return User.objects.get(pk=user_id)
         except User.DoesNotExist:
             return None
+
+
+class LegacyMD5ModelBackend(ModelBackend):
+    """
+    Backend which provides legacy support for very old Django
+    installations. Otherwise, identical to ``ModelBackend``.
+    
+    Originally, passwords were stored as unsalted MD5 hashes; this
+    backend can authenticate users whose passwords were stored in this
+    fashion, and will transparently change them to use salted SHA1
+    hashes instead.
+    
+    This primarily affects sites which have had active users since the
+    Django 0.90 release; sites which launched on Django 0.91 or later
+    will not need this, as the current salted-hash system was
+    introduced in SVN revision 1327, and Django 0.91 was packaged from
+    SVN revision 1908.
+    
+    """
+    def authenticate(self, username=None, password=None):
+        if password is None or '$' in password:
+            return None
+        try:
+            user = User.objects.get(username=username)
+            if user.password == get_hexdigest('md5', '', password):
+                # Legacy unsalted md5 password; convert to new format.
+                user.set_password(password)
+                user.save()
+                return user
+        except User.DoesNotExist:
+            return None

django/contrib/auth/models.py

@@ -51 +51 @@
     Returns a boolean of whether the raw_password was correct. Handles
     encryption formats behind the scenes.
     """
+    if '$' not in enc_password:
+        return False
     algo, salt, hsh = enc_password.split('$')
     return hsh == get_hexdigest(algo, salt, raw_password)
 
@@ -192 +194 @@
         Returns a boolean of whether the raw_password was correct. Handles
         encryption formats behind the scenes.
         """
-        # Backwards-compatibility check. Older passwords won't include the
-        # algorithm or salt.
-        if '$' not in self.password:
-            is_correct = (self.password == get_hexdigest('md5', '', raw_password))
-            if is_correct:
-                # Convert the password to the new, more secure format.
-                self.set_password(raw_password)
-                self.save()
-            return is_correct
         return check_password(raw_password, self.password)
 
     def set_unusable_password(self):