Opened 4 years ago

Closed 4 years ago

Last modified 4 years ago

#26334 closed Bug (fixed)

django.contrib.auth forms shouldn't strip whitespace from password fields

Reported by: juristi Owned by: Vincenzo Pandolfo
Component: contrib.auth Version: 1.9
Severity: Release blocker Keywords:
Cc: Triage Stage: Accepted
Has patch: yes Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: no UI/UX: no

Description

I upgraded an existing site to Django 1.9. The new CharField strip functionality that is turned on by default now strips all white space from the beginning and the end of the passwords, which prevents affected users from logging in with their correct password. The users must use the password recovery functionality to be able to log in again.

An example:
Django 1.8 site has a user with password " aaa ", which is stored in db.
Site is upgraded to Django 1.9
AuthenticationForm now tries to log in user with password "aaa" instead of the correct one.

Also stripping the input text may cause users to have less secure passwords than they think.

All password fields in django.contrib.auth should add strip=False to their arguments.

Change History (5)

comment:1 Changed 4 years ago by Tim Graham

Severity: NormalRelease blocker
Summary: django.contrib.auth forms strip password fieldsdjango.contrib.auth forms shouldn't strip whitespace from password fields
Triage Stage: UnreviewedAccepted

comment:2 Changed 4 years ago by Vincenzo Pandolfo

Owner: changed from nobody to Vincenzo Pandolfo
Status: newassigned

comment:3 Changed 4 years ago by Vincenzo Pandolfo

Has patch: set
Last edited 4 years ago by Vincenzo Pandolfo (previous) (diff)

comment:4 Changed 4 years ago by Tim Graham <timograham@…>

Resolution: fixed
Status: assignedclosed

In d0fe6c9:

Fixed #26334 -- Removed whitespace stripping from contrib.auth password fields.

comment:5 Changed 4 years ago by Tim Graham <timograham@…>

In c6424efb:

[1.9.x] Fixed #26334 -- Removed whitespace stripping from contrib.auth password fields.

Backport of d0fe6c915665fa3220e84bd691ba7002a357e5c5 from master

Note: See TracTickets for help on using tickets.
Back to Top