Jake Howard 3eb814e02a Fixed CVE-2025-13473 -- Standardized timing of check_password() in mod_wsgi auth handler. ...

Refs CVE-2024-39329, #20760.

Thanks Stackered for the report, and Jacob Walls and Markus Holtermann
for the reviews.

Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>

2026-02-03 07:52:25 -05:00

..

fixtures

Converted test fixtures to setUpTestData methods

2015-03-05 10:10:32 +11:00

models

Fixed #36087 -- Supported password reset on a custom user model with a composite primary key.

2025-01-13 15:51:21 +01:00

templates

Fixed spelling of "nonexistent".

2017-02-03 08:01:45 -05:00

__init__.py

Moved contrib.auth tests out of contrib.

2015-02-11 10:19:22 -05:00

backend_alias.py

Refs #33476 -- Reformatted code with Black.

2022-02-07 20:37:05 +01:00

client.py

Refs #33476 -- Reformatted code with Black.

2022-02-07 20:37:05 +01:00

common-passwords-custom.txt

Fixed #16860 -- Added password validation to django.contrib.auth.

2015-06-07 19:31:20 +02:00

settings.py

Refs #33476 -- Reformatted code with Black.

2022-02-07 20:37:05 +01:00

test_admin_multidb.py

Fixed #35520 -- Avoided opening transaction for read-only ModelAdmin requests.

2024-07-04 11:38:58 +02:00

test_auth_backends.py

Refs #36500 -- Rewrapped long docstrings and block comments via a script.

2025-07-23 20:17:55 -03:00

test_basic.py

Refs #36500 -- Rewrapped long docstrings and block comments via a script.

2025-07-23 20:17:55 -03:00

test_checks.py

Fixed #36709 -- Included static methods in system check for UserModel.is_anonymous/is_authenticated methods.

2025-11-05 16:56:15 -05:00

test_context_processors.py

Refs #36500 -- Rewrapped long docstrings and block comments via a script.

2025-07-23 20:17:55 -03:00

test_decorators.py

Refs #34118 -- Removed asgiref coroutine detection shims.

2026-01-31 08:59:54 -05:00

test_forms.py

Applied Black's 2026 stable style.

2026-01-18 21:26:56 +01:00

test_handlers.py

Fixed CVE-2025-13473 -- Standardized timing of check_password() in mod_wsgi auth handler.

2026-02-03 07:52:25 -05:00

test_hashers.py

Increased the default PBKDF2 iterations for Django 6.1.

2025-09-17 15:17:05 -03:00

test_login.py

Refs #35530 -- Removed request.user or auser() fallback in auth.login and auth.alogin.

2025-09-17 15:17:05 -03:00

test_management.py

Fixed #36843, #36793 -- Reverted "Fixed #27489 -- Renamed permissions upon model renaming in migrations."

2026-01-05 15:45:27 -05:00

test_middleware.py

Fixed #36603 -- Optimized check order in LoginRequiredMiddleware.

2025-09-11 11:09:53 +02:00

test_migrations.py

Refs #33476 -- Reformatted code with Black.

2022-02-07 20:37:05 +01:00

test_mixins.py

Refs #33476 -- Applied Black's 2023 stable style.

2023-02-01 11:04:38 +01:00

test_models.py

Fixed #35303 -- Implemented async auth backends and utils.

2024-10-07 14:19:41 +02:00

test_remote_user.py

Refs #36390 -- Removed support for RemoteUserMiddleware subclasses missing aprocess_request().

2025-09-17 15:17:05 -03:00

test_signals.py

Used addCleanup() in tests where appropriate.

2023-12-31 10:01:31 +01:00

test_templates.py

Refs #35706 -- Prefixed 'Error:' to titles of admin pages with form errors.

2024-09-02 15:19:33 +02:00

test_templatetags.py

Refs #35959 -- Added render_password_as_hash auth template tag for password rendering.

2025-04-17 12:00:20 -03:00

test_tokens.py

Refs #33476 -- Reformatted code with Black.

2022-02-07 20:37:05 +01:00

test_validators.py

Fixed #36280 -- Replaced exception checks with assertRaisesMessage().

2025-12-03 09:18:10 -05:00

test_views.py

Fixed #36807 -- Fixed form field alignment under <fieldset> in the admin.

2025-12-22 21:04:01 -05:00

urls_admin.py

Refs #33476 -- Reformatted code with Black.

2022-02-07 20:37:05 +01:00

urls_custom_user_admin.py

Refs #33476 -- Reformatted code with Black.

2022-02-07 20:37:05 +01:00

urls.py

Fixed #31405 -- Added LoginRequiredMiddleware.

2024-05-22 08:51:17 +02:00