#26395: CryptPasswordHasher only return None on some platform
-------------------------------+--------------------
Reporter: gkrnours | Owner: nobody
Type: Uncategorized | Status: new
Component: contrib.auth | Version: 1.9
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 1
Easy pickings: 0 | UI/UX: 0
-------------------------------+--------------------
Not all platform support the crypt module, as stated in the
CryptPasswordHasher. But some platform provide a dummy crypt module,
returning None on all input.
I tried the following code on both Linux with python 3.5 and OpenBSD with
python 3.4
{{{
import crypt
print(crypt.crypt(""))
}}}
On Linux, I get a string more or less 120 characters long starting with
$6. On OpenBSD, I get None. I haven't managed to get anything else than
None.
I noticed the problem while running the test suite. In
tests/auth_tests/test_hashers, importing crypt is successfull so the test
about crypt are done. But django.contrib.auth.hashers.make_password return
None for the "crypt" algorithm and fail the test as "crypt$$None" !=
"crypt$$ab1Hv2Lg7ltQo".
After a quick look at the different PasswordHasher, I believe
make_password shouldn't be able to return "crypt$$None". It should either
return a usable value or fail with an assert error from the
PasswordHasher, like the one that occur if CryptPasswordHasher is supplied
a salt of length other than 2.
In the current condition, make_password on OpenBSD using the "crypt"
algorithm return the same value for every value.
With attached patch, CryptPasswordHasher throw an assert error if crypt
return a None value.
--
Ticket URL: <https://code.djangoproject.com/ticket/26395>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/051.c7e2d702487f4ee74a42b80b3e6c4a4f%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
