Skip to content
Snippets Groups Projects
  1. Aug 04, 2015
  2. Jul 28, 2015
  3. Jul 26, 2015
  4. Jul 25, 2015
  5. Jul 23, 2015
  6. Jul 22, 2015
  7. Jul 21, 2015
    • Eli Collins's avatar
      testing fix: test_70_known() now deals w/ os_crypt backend not being · 646af1f26d5b
      Eli Collins authored
      able to handle non-utf8 passwords. only coming up now because bcrypt's
      os_crypt fallback can now fail for such inputs.
      
      --HG--
      branch : stable
      646af1f26d5b
    • Eli Collins's avatar
      updates changelog & other docs to reflect upcoming 1.6.3 changes · a2338972917c
      Eli Collins authored
      --HG--
      branch : stable
      a2338972917c
    • Eli Collins's avatar
      added universal flag when building wheels. · 24113aa870f7
      Eli Collins authored
      --HG--
      branch : stable
      24113aa870f7
    • Eli Collins's avatar
      updated tox.ini -- derived from one in default branch, · e21d571d790f
      Eli Collins authored
      but with some additional updates. needs to be merged back.
      
      --HG--
      branch : stable
      e21d571d790f
    • Eli Collins's avatar
      bunch of bcrypt updates, centered around the bsd wraparound bug. · 7adbe5f07f56
      Eli Collins authored
      bcrypt
      ------
      * added support & UT for $2b$ hash format.
        not making it the default yet, for backward compat.
      
      * large refactor of how bcrypt backends are loaded:
        instead of per-backend workarounds within each _calc_checksum_<backend>()
        function: now using runtime detection of specific capabilities & workarounds,
        that runs whenever set_backend() is called, combined with consolidated
        workaround code within _calc_checksum(), controlled by the flags
        set by set_backend().
      
        this detection now looks for:
          - the 8bit bug: throws a PasslibSecurityError
          - the wraparound bug: issues warning, sets flag enabling a workaround.
          - support for 2/2y/2b: if backend lacks support for particular variants,
            sets flag enabling workaround to add support.
      
      * os_crypt backend now just issues error if it can't handle a password encoding;
        rather than trying fallbacks first -- edge case anyways, and likely
        to not have any fallbacks when it does happen. simplifies backend code.
      
      * added UTs to make sure wraparound-vulnerable passwords are hashed correctly
        (as a 72char string, not a 1-3 char string that's repeated).
      
      * internal blowfish code's ident parsing clarified.
      
      other
      -----
      * added exc.PasslibSecurityError for fatal runtime errors.
      
      * test framework: os_crypt backends no longer expected to use
        *any* backend as fallback, just ones with lower priority than os_crypt.
      
      * test framework: crypt_stub() wrapper now subclasses the handler,
        so it can use an independant backend, instead of changing global
        backend for duration of call (made parallel testing hard)
      
      docs
      ----
      * added entry to bcrypt page, writing down wraparound bug details,
        and how passlib is handling it.
      
      * all versions of pybcrypt & bcryptor seem to be vulnerable to wraparound bug.
        starting process of deprecating these backends: marked bcrypt backend
        as 'preferred' throughout the documentation.
      
      --HG--
      branch : stable
      7adbe5f07f56
  8. Jul 20, 2015
  9. Jan 25, 2015
    • Eli Collins's avatar
      py3.2 compat fix to test_context · ab5ad210ec04
      Eli Collins authored
      --HG--
      branch : stable
      ab5ad210ec04
    • Eli Collins's avatar
      replaced a bunch of ``isinstance(xxx, str)`` checks with · 4b40daf7fc71
      Eli Collins authored
      ``isinstance(xxx, native_string_types)`` checks, to handle str or unicode
      under py2. this should explicitly take care of issue 54, but not closing
      that until checking deeper into the unicode handling.
      
      should allow str/unicode anywhere the inputs are program values
      (e.g. config options), not user-provided values.
      
      --HG--
      branch : stable
      4b40daf7fc71
    • Eli Collins's avatar
      bugfix: passlib.ext.django: clarified & tweaked logic for when we pass · f0b9d8385d96
      Eli Collins authored
      make_password()'s salt parameter on to the hash (fixes issue 52).
      
      old behavior would incorrectly pass explicit salt provided for hash
      that didn't need one; a situation that only occurs in django 1.4.0-1.4.5's
      unittests, and was corrected in django 1.4.6's.
      
      new behavior separates out a couple of the cases we were trying to handle,
      handles them separately, has better comment explaining what's going on.
      
      --HG--
      branch : stable
      f0b9d8385d96
  10. Jan 11, 2015
  11. Dec 04, 2014
  12. Dec 28, 2013
  13. Dec 27, 2013
  14. Dec 26, 2013
Loading