Commit 0eeae150 authored by Claude Paroz's avatar Claude Paroz
Browse files

Fixed #19354 -- Do not assume usermodel.pk == usermodel.id 

Thanks markteisman at hotmail.com for the report.
parent d913a8b4

django/contrib/admin/options.py

+1 −1
Original line number Diff line number Diff line
@@ -552,7 +552,7 @@ class ModelAdmin(BaseModelAdmin): 
        """

        from django.contrib.admin.models import LogEntry, DELETION

        LogEntry.objects.log_action(

            user_id         = request.user.id,

            user_id         = request.user.pk,

            content_type_id = ContentType.objects.get_for_model(self.model).pk,

            object_id       = object.pk,

            object_repr     = object_repr,

django/contrib/auth/__init__.py

+2 −2
Original line number Diff line number Diff line
@@ -84,14 +84,14 @@ def login(request, user): 
        user = request.user

    # TODO: It would be nice to support different login methods, like signed cookies.

    if SESSION_KEY in request.session:

        if request.session[SESSION_KEY] != user.id:

        if request.session[SESSION_KEY] != user.pk:

            # To avoid reusing another user's session, create a new, empty

            # session if the existing session corresponds to a different

            # authenticated user.

            request.session.flush()

    else:

        request.session.cycle_key()

    request.session[SESSION_KEY] = user.id

    request.session[SESSION_KEY] = user.pk

    request.session[BACKEND_SESSION_KEY] = user.backend

    if hasattr(request, 'user'):

        request.user = user

django/contrib/auth/forms.py

+1 −1
Original line number Diff line number Diff line
@@ -241,7 +241,7 @@ class PasswordResetForm(forms.Form): 
                'email': user.email,

                'domain': domain,

                'site_name': site_name,

                'uid': int_to_base36(user.id),

                'uid': int_to_base36(user.pk),

                'user': user,

                'token': token_generator.make_token(user),

                'protocol': use_https and 'https' or 'http',

django/contrib/auth/tests/templates/context_processors/auth_attrs_user.html

+1 −1
Original line number Diff line number Diff line 
unicode: {{ user }}

id: {{ user.id }}

id: {{ user.pk }}

username: {{ user.username }}

url: {% url 'userpage' user %}

django/contrib/auth/tokens.py

+1 −1
Original line number Diff line number Diff line
@@ -58,7 +58,7 @@ class PasswordResetTokenGenerator(object): 
        # Ensure results are consistent across DB backends

        login_timestamp = user.last_login.replace(microsecond=0, tzinfo=None)



        value = (six.text_type(user.id) + user.password +

        value = (six.text_type(user.pk) + user.password +

                six.text_type(login_timestamp) + six.text_type(timestamp))

        hash = salted_hmac(key_salt, value).hexdigest()[::2]

        return "%s-%s" % (ts_b36, hash)