server2/mirrormanager/model/auth.py | 25 +++----------------------
1 file changed, 3 insertions(+), 22 deletions(-)
New commits:
commit 05a12e5e353958c6f92769a1e2dd45b8f36da69d
Author: Matt Domsch <Matt_Domsch(a)dell.com>
Date: Thu Aug 11 00:23:15 2011 -0500
revert password handling to match SQLObject
Because existing installation schemas expect it, passwords are stored
(stupidly) plaintext in the database by default. Adjust our code to
match for now.
This will get fixed in a schema update at some point, but we need to
add length to the password field to do so, then go an encrypt
passwords already stored.
diff --git a/server2/mirrormanager/model/auth.py b/server2/mirrormanager/model/auth.py
index 8e7a562..3d624fc 100644
--- a/server2/mirrormanager/model/auth.py
+++ b/server2/mirrormanager/model/auth.py
@@ -146,28 +146,9 @@ class User(DeclarativeBase):
"""Return the user object whose user name is
``username``."""
return DBSession.query(cls).filter(cls.user_name == username).first()
- def _set_password(self, password):
- """Hash ``password`` on the fly and store its hashed
version."""
- # Make sure password is a str because we cannot hash unicode objects
- if isinstance(password, unicode):
- password = password.encode('utf-8')
- salt = sha1()
- salt.update(os.urandom(60))
- hash = sha1()
- hash.update(password + salt.hexdigest())
- password = salt.hexdigest() + hash.hexdigest()
- # Make sure the hashed password is a unicode object at the end of the
- # process because SQLAlchemy _wants_ unicode objects for Unicode cols
- if not isinstance(password, unicode):
- password = password.decode('utf-8')
- self._password = password
-
- def _get_password(self):
- """Return the hashed version of the password."""
- return self._password
-
- password = synonym('_password', descriptor=property(_get_password,
- _set_password))
+
+ # because we're coming from old SQLObject schemas, we need to use the old hash
function
+ # to keep the size constant. Stupidly, by default it stored plaintext passwords.
:-(
#}
Show replies by date