From 40f3076e118a3307baf6af8c32765aba268043aa Mon Sep 17 00:00:00 2001 From: Shengjing Zhu Date: May 16 2017 07:47:26 +0000 Subject: fix bcrypt.hashpw unicode input when password is not ascii: File "...pagure/lib/login.py", line 54, in generate_hashed_value return '$2$' + bcrypt.hashpw(to_unicode(password), bcrypt.gensalt()) UnicodeEncodeError: 'ascii' codec can't encode characters in position 0-1: ordinal not in range(128) the bcrypt.hashpw should take bytes, not unicode the change is safe for old password, since whether to_unicode or to_bytes, ascii password gets same result. Signed-off-by: Shengjing Zhu --- diff --git a/pagure/lib/login.py b/pagure/lib/login.py index b821e20..f0de812 100644 --- a/pagure/lib/login.py +++ b/pagure/lib/login.py @@ -51,7 +51,7 @@ def get_session_by_visitkey(session, sessionid): def generate_hashed_value(password): """ Generate hash value for password """ - return '$2$' + bcrypt.hashpw(to_unicode(password), bcrypt.gensalt()) + return '$2$' + bcrypt.hashpw(to_bytes(password), bcrypt.gensalt()) def check_password(entered_password, user_password, seed=None): @@ -65,7 +65,8 @@ def check_password(entered_password, user_password, seed=None): _, version, user_password = user_password.split('$', 2) if version == '2': - password = bcrypt.hashpw(to_unicode(entered_password), user_password) + password = bcrypt.hashpw(to_bytes(entered_password), + to_bytes(user_password)) elif version == '1': password = '%s%s' % (to_unicode(entered_password), seed)