Ticket #18182: patch_18182.diff

django/contrib/auth/hashers.py

@@ -16 +16 @@
 
 
 def is_password_usable(encoded):
-    return (encoded is not None and encoded != UNUSABLE_PASSWORD)
+    return (encoded is not None and encoded != UNUSABLE_PASSWORD and ('$' in encoded or len(encoded) == 32))
 
 
 def check_password(password, encoded, setter=None, preferred='default'):
@@ -35 +35 @@
     password = smart_str(password)
     encoded = smart_str(encoded)
 
-    if len(encoded) == 32 and '$' not in encoded:
+    if '$' not in encoded:
         hasher = get_hasher('unsalted_md5')
     else:
         algorithm = encoded.split('$', 1)[0]

django/contrib/auth/tests/hashers.py

@@ -90 +90 @@
             make_password('letmein', hasher='lolcat')
         self.assertRaises(ValueError, doit)
 
+    def test_bad_encoded_pasword(self):
+        encoded = 'letmeinbadencoded'
+        self.assertFalse(is_password_usable(encoded))
+
+
     def test_low_level_pkbdf2(self):
         hasher = PBKDF2PasswordHasher()
         encoded = hasher.encode('letmein', 'seasalt')