Changes between Initial Version and Version 1 of CookBookPasswordHasherJS

Timestamp:

Nov 10, 2006, 1:57:57 PM (18 years ago)

Author:

Antti Kaihola

Comment:

--

CookBookPasswordHasherJS

@@ +1 @@
+= CookBook - [wiki:CookBookAdminTools Admin Tools] - !JavaScript password hash generator for Admin User edit =
+
+Django admin in the development version (as of 2006-08-04) accepts new users' passwords with normal double password fields, but when editing a user it still expects them to be entered as SHA-1 hashes in the format {{{[algo]$[salt]$[hexdigest]}}}. Here is some code which enhances the user edit form in admin to automatically calculate the hashes on the client side. The author of this code is known as "akaihola" on the {{{#django}}} IRC channel and in the newsgroups.
+
+What the code does in version 1.0:
+ * searches the user edit form for an {{{<input>}}} with {{{id="id_password"}}}, {{{class="vTextField required"}}}, {{{name="password}}}, {{{size="30"}}} and {{{maxlength="128"}}}, which is how the password field is defined in Django admin
+ * when the password field loses focus, replaces its contents with a SHA-1 salted hash as Django expects
+ * does not modify field contents if it's already a hash
+
+Here's what you need to do:
+
+1. Copy or symlink the admin media directories and place [http://svn.ambitone.com/ambidjangolib/js/djangopasswordhasher.js djangopasswordhasher.js] in the {{{js/}}} subdirectory
+
+2. "Hot-fix" the User model by inserting the following in your root urlconf ({{{urls.py}}}):
+{{{
+from django.contrib.auth.models import User
+User._meta.admin.js.append('js/djangopasswordhasher.js')
+}}}
+
+3. Have the Dojo Toolkit !JavaScript libraries served at {{{/js/dojo/}}} on your webserver.
+
+4. Override admin's {{{admin/base_site.html}}} template and add Dojo Toolkit initialization, for example:
+{{{
+{% extends "admin/base.html" %}
+{% load i18n %}
+
+{% block extrahead %}
+<script src="/js/dojo/dojo.js" type="text/javascript"></script>
+{% endblock %}
+
+{% block title %}{{ title|escape }} | {% trans 'Django site admin' %}{% endblock %}
+
+{% block branding %}
+<h1 id="site-name">{% trans 'Django administration' %}</h1>
+{% endblock %}
+
+{% block nav-global %}{% endblock %}
+}}}
+
+Pros:
+ * nothing to install on the client side
+ * no need to patch Django source code
+
+Cons:
+ * must have !JavaScript enabled in the browser
+ * doesn't use a real password field ­­-- password entry is visible
+ * ugly hack
+ * version 1.0 requires Dojo Toolkit
+
+Some possible improvements:
+ * Is there a more proper place to do the User model js "hot-fix" than urls.py?
+ * Now uses Dojo Toolkit because that's how the author prefers to code cross-browser !JavaScript. A stand-alone script would be better, contributions are welcome.
+ * Would it be possible to use a real password field and still have the hash calculated on the client side?