| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
will be removed completely in 1.8.
Rationale:
Aside from the arguments in issue 83, performed a timing analysis,
and decided harden_verify framework wasn't going to be easily workable
to prevent a timing attack anyways (see attached admin/plot_verify_timing.py script).
Changes:
* dummy_verify() has been kept around, but now uses .verify() against a dummy hash,
which is guaranteed to have correct timing (though wastes cpu cycles).
* Removed most harden_verify code, treating it as NOOP just like min_verify_time.
Similarly, removed most documentation references to.
|
|
|
passlib.ext.django
------------------
* everything in .models relocated to the DjangoContextAdapter() class in .utils.
all that's left in models is a couple of hooks. This consolidates all
the model state into a single object, making it a lot easier to inspect
and optimize.
* consolidated a bunch of (undocumented) helper functions into DjangoTranslator()
class, which now acts as based for DjangoContextAdapter. Translator instances
handle converted passlib <-> django hashers, including caching speed-critical bits.
* wrapper class now has guards against wrong type of hasher being passed in
* wrapper class uses .using() instead of deprecated .hash(**kwds) format.
* updated and confirmed passing tests w/ django 1.10.3
passlib.ext.django tests
------------------------
* split test wrapper for django's internal tests (HashersTest) into separate file,
test_ext_django_source.py, to make it easier to run independantly.
reworked to use patchAttr(wraps=True) rather than less flexible ContextHook() hack
* tries to clean up HashersTest - adapts to django settings,
fixed code syncing .iteration settings back to passlib hashers,
* blocked out some django tests that we can't / won't pass,
documented reasons why.
other
-----
* CryptContext: added temporary hack to access unpatched Hasher.needs_update() method.
* PrefixWrapper: now proxies attr writes if it owns the wrapped hasher.
* test utils: added wrap=True support to patchAttr(), for wrapping arbitrary functions.
|
