Ticket #9101: 9101.diff

django/contrib/auth/models.py

@@ -1 +1 @@
 import datetime
+import string
 import urllib
 
 from django.contrib import auth
@@ -10 +11 @@
 from django.utils.hashcompat import md5_constructor, sha_constructor
 from django.utils.translation import ugettext_lazy as _
 
+SALT_CHARS = string.letters + string.digits + string.punctuation
 UNUSABLE_PASSWORD = '!' # This will never be a valid hash
 
 try:
@@ -164 +166 @@
         return full_name.strip()
 
     def set_password(self, raw_password):
-        import random
+        from random import sample
         algo = 'sha1'
-        salt = get_hexdigest(algo, str(random.random()), str(random.random()))[:5]
+        salt = ''.join(sample(SALT_CHARS, 5))
         hsh = get_hexdigest(algo, salt, raw_password)
         self.password = '%s$%s$%s' % (algo, salt, hsh)