Ticket #9101: django-salts.diff

django/contrib/auth/models.py

@@ -7 +7 @@
 from django.utils.translation import ugettext_lazy as _
 import datetime
 import urllib
+import random
+import string
 
 UNUSABLE_PASSWORD = '!' # This will never be a valid hash
+SALT_CHARS = string.letters + string.digits
 
 try:
     set
@@ -173 +176 @@
         return full_name.strip()
 
     def set_password(self, raw_password):
-        import random
         algo = 'sha1'
-        salt = get_hexdigest(algo, str(random.random()), str(random.random()))[:5]
+        salt = ''.join(random.sample(SALT_CHARS, 5))
         hsh = get_hexdigest(algo, salt, raw_password)
         self.password = '%s$%s$%s' % (algo, salt, hsh)