fwenzel/django-sha2 — pull request #16 by diox (2012-07-24 14:09:03+00:00)
Title: django 1.3 compatibility with dynamic hashers from 1.4

If a project uses django_sha2 + django 1.4 + dynamic hashers generation as suggested in the README, and then goes back to 1.3, checking the password of any user whose password was "upgraded" to the new-style hashers fails.

If I understand the code correctly, this is because the hashers used for 1.4 support have different prefixes, one for each entry in HMAC_KEYS, which wasn't the case before. In check_password() monkeypatch, there is a check to see if django_sha2 should use its own bcrypt_auth.check_password() code but it only checks if the hasher is "bcrypt" or "hh", so it fails if any dynamic hasher was used.

This pull request makes the check_password() monkeypatch also check if the hasher is in the dynamic hashers list. I haven't included tests yet because I'm not sure this is the right solution at the moment and I'd prefer having feedback on the patch before working on some tests.