Fix py-bcrypt compatibility on Python 3

[arjan@…]

When using the BCryptSHA256PasswordHasher or derivatives, the verification of passwords fails when on Python 3.

This is due to the following line:
return constant_time_compare(data, bcrypt.hashpw(password, data))

In BCryptSHA256PasswordHasher.verify(), 'data' is forced to the 'bytes' type, but the output of bcrypt.hashpw() is of type 'str'. The hashpw() output should just like 'data' be passed through force_bytes() before comparison, because the comparison is now always returning False on Python3.

[Tim Graham]

Are you using py-bcrypt? Django now recommends using bcrypt, however, if we are no longer compatible with py-bcrypt and haven't put that in our docs, we have a problem. I'm not sure if that was the intention or not. This should be in the 1.6 release notes as well.

​https://github.com/django/django/commit/c792c83cad54f064b6ba13e285e95a90e2c61f09

[Donald Stufft]

py-bcrypt does not support Python3.

[Tim Graham]

I can't reproduce (using Django's existing tests in django/contrib/auth/tests/test_hashers.py bcrypt.hashpw() returning str as reported. Arjan, can you provide more details (ideally a failing test case for Django's test suite)?

[arjan@…]

I was indeed using py-bcrypt. When I switch to bcrypt everything works perfectly.
Please put the incompatibility with py-bcrypt in the releasenotes, as I was using it with Django 1.5 and Python 3 before without any problems. (py-bcrypt supports Python 3 since version 0.4 according to their website)
I actually did read the releasenotes before upgrading, so an entry in there would have saved me a lot of headaches.

[Tim Graham]

Donald, what would you like to do here? I can draft a doc patch for the release notes if necessary.

[Donald Stufft]

I don't have a problem with forcing the data through force_bytes.

[Tim Graham]

All right, I'll mark this as a release blocker so we backport it to 1.6. Not sure if we can integrate the verification with Jenkins easily since presumably bcrypt and py-bcrypt can't be easily installed side by side.

[Tim Graham]

​Pull request that simply adds a force_bytes() call as suggested. This does fix the tests on Python 3 with py-bcrypt 0.4.

[Tim Graham <timograham@…>]

In d15985d81ff1c3b353a48a87189b7847798214c0:

Fixed #21398 -- Fixed BCryptSHA256PasswordHasher with py-bcrypt and Python 3.

Thanks arjan at anymore.nl for the report.

[Tim Graham <timograham@…>]

In 4b9e932fd46eaac4774d229c40c2ee75f8fb759b:

[1.6.x] Fixed #21398 -- Fixed BCryptSHA256PasswordHasher with py-bcrypt and Python 3.

Thanks arjan at anymore.nl for the report.

Backport of d15985d81f from master