1
+ from django .conf import settings
1
2
from django .contrib .auth .base_user import BaseUserManager
2
3
from django .contrib .auth .models import AbstractUser
3
4
from django .db import models
@@ -37,6 +38,10 @@ def create_superuser(self, email, **extra_fields):
37
38
return self ._create_user (email , ** extra_fields )
38
39
39
40
41
+ def _get_session_salt ():
42
+ return get_random_string (12 )
43
+
44
+
40
45
class AbstractEmailUser (AbstractUser ):
41
46
EMAIL_FIELD = 'email'
42
47
USERNAME_FIELD = 'email'
@@ -51,7 +56,7 @@ class AbstractEmailUser(AbstractUser):
51
56
# Salt for the session hash replacing the password in this function.
52
57
session_salt = models .CharField (
53
58
max_length = 12 , editable = False ,
54
- default = get_random_string ,
59
+ default = _get_session_salt ,
55
60
)
56
61
57
62
def has_usable_password (self ):
@@ -62,12 +67,29 @@ def has_usable_password(self):
62
67
class Meta (AbstractUser .Meta ):
63
68
abstract = True
64
69
70
+ def _legacy_get_session_auth_hash (self ):
71
+ # RemovedInDjango40Warning: pre-Django 3.1 hashes will be invalid.
72
+ key_salt = "mailauth.contrib.user.models.EmailUserManager.get_session_auth_hash"
73
+ if not self .session_salt :
74
+ raise ValueError ("'session_salt' must be set" )
75
+ return salted_hmac (key_salt , self .session_salt , algorithm = 'sha1' ).hexdigest ()
76
+
65
77
def get_session_auth_hash (self ):
66
78
"""Return an HMAC of the :attr:`.session_salt` field."""
67
79
key_salt = "mailauth.contrib.user.models.EmailUserManager.get_session_auth_hash"
68
80
if not self .session_salt :
69
81
raise ValueError ("'session_salt' must be set" )
70
- return salted_hmac (key_salt , self .session_salt ).hexdigest ()
82
+ algorithm = getattr (settings , 'DEFAULT_HASHING_ALGORITHM' )
83
+ if algorithm is None :
84
+ return salted_hmac (key_salt , self .session_salt ).hexdigest ()
85
+ return salted_hmac (
86
+ key_salt ,
87
55E
+ self .session_salt ,
88
+ # RemovedInDjango40Warning: when the deprecation ends, replace
89
+ # with:
90
+ # algorithm='sha256',
91
+ algorithm = algorithm ,
92
+ ).hexdigest ()
71
93
72
94
73
95
delattr (AbstractEmailUser , 'password' )
0 commit comments