VladPolskiy/postgres-web
1
0
Fork 0
mirror of https://github.com/postgres/pgweb.git synced 2025-08-10 00:42:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

Revert to SHA1 hashing for stored passwords

Browse Source 
This is required for the old style community auth system that is still
in use by the commitfest app. Once that has been retired or upgraded,
this patch should be reverted.

Existing passwords are automatically converted once the user logs in to
the main website once.
This commit is contained in:
Magnus Hagander
2013-06-20 11:40:13 +02:00
parent e5385a5222
commit 3ea91f449c
1 changed files with 16 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
pgweb/settings.py
View File

@ -117,6 +117,22 @@ INSTALLED_APPS = [
'pgweb.pugs',
]
#
# Disable the new authentication handling for now. The reason for this is
# that we need the sha1 authentication so we can do old-style community
# auth, which is still used by the commitfest app. Once that app is
# migrated away, this can be reverted to the new django default which
# is more secure.
#
PASSWORD_HASHERS = (
'django.contrib.auth.hashers.SHA1PasswordHasher',
'django.contrib.auth.hashers.PBKDF2PasswordHasher',
'django.contrib.auth.hashers.PBKDF2SHA1PasswordHasher',
'django.contrib.auth.hashers.BCryptPasswordHasher',
'django.contrib.auth.hashers.MD5PasswordHasher',
'django.contrib.auth.hashers.CryptPasswordHasher',
)
###
# Application specific settings, likely overridden in settings_local.py.