Improved salt generation for django.contrib.auth

[Ludvig Ericson]

Currently, the salts generated by the auth framework are pretty weak.

This patch changes the behavior of doing a SHA1 hash of digits into choosing five random characters from the lower and upper alphabet, as well as any digit. [a-zA-Z0-9]

See the django-dev this: ​http://tinyurl.com/5tjvhc

[anonymous]

You can also add string.punctuation to the SALT_CHARS soup.

[Matt Boersma]

Updated patch to use string.punctuation as well

[Matt Boersma]

Tested on sqlite, PostGres, and Oracle.

[Ludvig Ericson]

Regarding the latest patch, why import the name each time the function is run? I mean no, it's probably not going to be noticeable WRT the function's purpose, but I'm curious.

[Matt Boersma]

I was just following the example of the existing code, which imported the module inside the function. Elsewhere in the same module there's a similar import of random within another function, so I assumed there was some benefit to delaying the import until it's needed, since Django does this in many places.

I personally don't do late imports, but this style seemed to fit the module better. But really, it probably doesn't matter either way.

[Jacob]

This really isn't a change with any value; salt doesn't need to be particularly cryptographically strong as long as it's random enough; the point is to exponentially increase the search space for password crackers. The current code is fine.

[Jacob]

Milestone 1.1 deleted