Commit c47b89db authored by Dom Sekotill's avatar Dom Sekotill
Browse files

added unsalted SHA256 password hasher for backward compat

Old entries in the database used unsalted, single iteration hashed
passwords (not very secure!) which need upgrading.
parent a95c2457
Loading
Loading
Loading
Loading
+26 −0
Original line number Diff line number Diff line
# -*- coding: utf-8 -*-
# Generated by Django 1.9 on 2015-12-24 01:50
from __future__ import unicode_literals

import re
from django.db import migrations


def update_passwd_hashes(apps, schema_editor):
	User = apps.get_model('custom_auth', 'User')

	for user in User.objects.all():
		if re.match(r'^[a-z0-9]{64}$', user.password or '', re.I):
			user.password = 'sha256_unsalted${0}'.format(user.password)
			user.save()


class Migration(migrations.Migration):

    dependencies = [
        ('custom_auth', '0003_add_user'),
    ]

    operations = [
		migrations.RunPython(update_passwd_hashes),
    ]
+25 −0
Original line number Diff line number Diff line
import hashlib
import passlib.hash

from django.contrib.auth import hashers
@@ -36,3 +37,27 @@ class SHA256CryptPasswordHasher(hashers.BasePasswordHasher):
		algorithm = self.algorithm
		assert encoded.startswith(algorithm)
		return encoded[len(algorithm):]


class UnsaltedSHA256PasswordHasher(hashers.BasePasswordHasher):
	""" SHA256 unsalted, single pass hash """

	digest = hashlib.sha256
	algorithm = 'sha256_unsalted'

	def verify(self, password, encoded):
		return self.encode(password) == encoded

	def encode(self, password, salt=None):
		return '{0}${1}'.format(
			self.algorithm,
			self.digest(password.encode('utf-8')).hexdigest(),
		)

	def safe_summary(self, encoded):
		algo, hash = encoded.split('$', 1)
		assert algo == self.algorithm
		return {
			'algorithm': self.algorithm,
			'hash': hashers.mask_hash(hash),
		}
+1 −0
Original line number Diff line number Diff line
@@ -21,6 +21,7 @@ INSTALLED_APPS = (
AUTH_USER_MODEL = 'custom_auth.User'
PASSWORD_HASHERS = (
	'kodo_sso.custom_auth.pass_hashers.SHA256CryptPasswordHasher',
	'kodo_sso.custom_auth.pass_hashers.UnsaltedSHA256PasswordHasher',
)