Unable to access to User record in the admin if the user has a unmanageable password

[Stefano Apostolico]

If the user has a unmanageable password (ie no hashers found) ReadOnlyPasswordHashWidget reraise ValueError up to the UI, this prevents to access to the user record if the form contains ReadOnlyPasswordHashWidget ( admin ), this happen also for blank password. If the system use a custom backend with external authentication there is no reason for django to known the password algorithm, but should be still possible to access to the user record.
The patch simply surround the involved lined into the ReadOnlyPasswordHashWidget.render() and display a 'Unknown password hashing algorithm' message instead.
Not sure if the message could be improved/changed.

[Carl Meyer]

This is definitely a release-blocking regression, thanks for the report.

Patch looks good to me except that the "except" clause captures the exception when it has no use for it (and uses the old syntax to do so); the ",e" should just be removed.

And it needs a test.

This violates the string freeze, but I don't see any good alternative. Having this fixed with an untranslated message in 1.4 is better than not having it fixed.

[Stefano Apostolico]

Added ReadOnlyPasswordHashWidget_0.1.patch

• added tests both for empty and unparseable password
• removed exception capturing

[Aymeric Augustin]

I've updated the patch slightly to make the try/except clause as specific as possible and add one more test.

I agree with Carl that an untranslated string is less of a problem than an uncaught exception.

(There's a little bit of noise in the patch because my editor strips trailing spaces, sorry.)

[Aymeric Augustin]

In [17775]:

Fixed #17944 -- Prevented an error in the user change page of the admin when the content of the password field doesn't match the expected format. Thanks saxix for the report and initial patch.

[Jannis Leidel]

In [17779]:

Reverted the introduction of a translation string in r17775 as it happened after string freeze. Refs #17944.

[Aymeric Augustin]

I'm re-opening the bug so we remember to re-introduce the ugettext call after 1.4.

[Aymeric Augustin]

Oops, let's not forget this before 1.5.

[Claude Paroz]

In fact, already fixed in [703c266682be39f7153498ad0d8031231f12ee79].