django/django — pull request #35 by MoritzS (2012-05-01 14:36:29+00:00)
Title: Fixed #18182 -- Raw password echoed on authentication if no hashing used

contrib.auth.hashers.is_password_usable now checks if the encoded string
contains a $ character. For backward compatibilty to unsalted md5 hashes all
encoded 32-character-long strings without a $ character are assumed to be
usable. check_password won't return True for a 32-character-long plain
password, though.