From e2bef076d3161035daaa174600f73206dd3d6c30 Mon Sep 17 00:00:00 2001 From: Nils Hasenbanck Date: Sat, 24 Mar 2012 11:07:37 +0100 Subject: [PATCH 1/4] Fixed the session backend for django 1.4 Signed-off-by: Nils Hasenbanck --- mongoengine/django/sessions.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mongoengine/django/sessions.py b/mongoengine/django/sessions.py index 2f0e17fb..d3d2d3b9 100644 --- a/mongoengine/django/sessions.py +++ b/mongoengine/django/sessions.py @@ -41,7 +41,7 @@ class SessionStore(SessionBase): def create(self): while True: - self.session_key = self._get_new_session_key() + self._session_key = self._get_new_session_key() try: self.save(must_create=True) except CreateError: From 3af6d0dbfdf0ce76c6792f0a7b1a2e71ad49e05b Mon Sep 17 00:00:00 2001 From: Nils Hasenbanck Date: Sat, 24 Mar 2012 11:08:00 +0100 Subject: [PATCH 2/4] Replaces deprecated hasher with new django 1.4 hasher This way we can even use the new hasher configuration django 1.4 provides. Signed-off-by: Nils Hasenbanck --- mongoengine/django/auth.py | 22 ++++------------------ 1 file changed, 4 insertions(+), 18 deletions(-) diff --git a/mongoengine/django/auth.py b/mongoengine/django/auth.py index 38370cc5..156daf74 100644 --- a/mongoengine/django/auth.py +++ b/mongoengine/django/auth.py @@ -1,23 +1,14 @@ from mongoengine import * -from django.utils.hashcompat import md5_constructor, sha_constructor from django.utils.encoding import smart_str from django.contrib.auth.models import AnonymousUser +from django.contrib.auth.hashers import check_password, make_password from django.utils.translation import ugettext_lazy as _ import datetime REDIRECT_FIELD_NAME = 'next' -def get_hexdigest(algorithm, salt, raw_password): - raw_password, salt = smart_str(raw_password), smart_str(salt) - if algorithm == 'md5': - return md5_constructor(salt + raw_password).hexdigest() - elif algorithm == 'sha1': - return sha_constructor(salt + raw_password).hexdigest() - raise ValueError('Got unknown password algorithm type in password') - - class User(Document): """A User document that aims to mirror most of the API specified by Django at http://docs.djangoproject.com/en/dev/topics/auth/#users @@ -34,7 +25,7 @@ class User(Document): email = EmailField(verbose_name=_('e-mail address')) password = StringField(max_length=128, verbose_name=_('password'), - help_text=_("Use '[algo]$[salt]$[hexdigest]' or use the change password form.")) + help_text=_("Use '[algo]$[iterations]$[salt]$[hexdigest]' or use the change password form.")) is_staff = BooleanField(default=False, verbose_name=_('staff status'), help_text=_("Designates whether the user can log into this admin site.")) @@ -75,11 +66,7 @@ class User(Document): assigning to :attr:`~mongoengine.django.auth.User.password` as the password is hashed before storage. """ - from random import random - algo = 'sha1' - salt = get_hexdigest(algo, str(random()), str(random()))[:5] - hash = get_hexdigest(algo, salt, raw_password) - self.password = '%s$%s$%s' % (algo, salt, hash) + self.password = make_password(raw_password) self.save() return self @@ -89,8 +76,7 @@ class User(Document): :attr:`~mongoengine.django.auth.User.password` as the password is hashed before storage. """ - algo, salt, hash = self.password.split('$') - return hash == get_hexdigest(algo, salt, raw_password) + return check_password(raw_password, self.password) @classmethod def create_user(cls, username, password, email=None): From 8fe4a7029977a0870b137edab1aa173a7570ca77 Mon Sep 17 00:00:00 2001 From: Nils Hasenbanck Date: Sat, 24 Mar 2012 19:24:42 +0100 Subject: [PATCH 3/4] Fixed the exception when saving a new session Signed-off-by: Nils Hasenbanck --- mongoengine/django/sessions.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mongoengine/django/sessions.py b/mongoengine/django/sessions.py index d3d2d3b9..3686ecfd 100644 --- a/mongoengine/django/sessions.py +++ b/mongoengine/django/sessions.py @@ -51,7 +51,7 @@ class SessionStore(SessionBase): return def save(self, must_create=False): - s = MongoSession(session_key=self.session_key) + s = MongoSession(session_key=self._session_key) s.session_data = self.encode(self._get_session(no_load=must_create)) s.expire_date = self.get_expiry_date() try: From 421f324f9eb8ab7eb3d1783746fef0407834c677 Mon Sep 17 00:00:00 2001 From: Nils Hasenbanck Date: Sat, 24 Mar 2012 19:24:42 +0100 Subject: [PATCH 4/4] Fixed the exception when saving a new session The session was not created for some reason. Now it is. Signed-off-by: Nils Hasenbanck --- mongoengine/django/sessions.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/mongoengine/django/sessions.py b/mongoengine/django/sessions.py index d3d2d3b9..ca35962a 100644 --- a/mongoengine/django/sessions.py +++ b/mongoengine/django/sessions.py @@ -51,7 +51,9 @@ class SessionStore(SessionBase): return def save(self, must_create=False): - s = MongoSession(session_key=self.session_key) + if self._session_key is None: + self.create() + s = MongoSession(session_key=self._session_key) s.session_data = self.encode(self._get_session(no_load=must_create)) s.expire_date = self.get_expiry_date() try: