#27467: Documentation inaccurate for password validator
UserAttributeSimilarityValidator
-------------------------------------+-------------------------------------
Reporter: | Owner: nobody
goblinJoel |
Type: | Status: new
Uncategorized |
Component: | Version: 1.9
Documentation | Keywords: password management
Severity: Normal | validation validator
Triage Stage: | Has patch: 0
Unreviewed |
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 1
UI/UX: 0 |
-------------------------------------+-------------------------------------
While this has to do with configuring password validation, it doesn't
strike me as a security vulnerability per se, so I'm posting in the
standard bug tracker:
The documentation for UserAttributeSimilarityValidator states,
"The maximum similarity the password can have, before it is rejected,
can be set with the max_similarity parameter, on a scale of 0 to 1. A
setting of 0 will cause all passwords to be rejected, '''whereas a setting
of 1 will cause it to only reject passwords that are identical to an
attribute’s value.'''"
However, if you set it to 1, it will never reject a password, even when
identical to a user attribute (for example, email). The code checks
whether the similarity is '''>''' the max_similarity, rather than '''>='''
as the documentation describes. The documentation should be updated to
reflect this.
I found this on Django 1.9.11 while testing that I'd installed password
validators correctly: when I tried to change a test user's password (via
the admin) to the same as their email, it allowed it. If I changed
max_similarity to 1.0 instead of 1, I got the same behavior. If I changed
it to 0.9, it rejected the email as password, as it should.
The documentation for the version I'm using:
https://docs.djangoproject.com/en/1.9/topics/auth/passwords/#django.contrib.auth.password_validation.UserAttributeSimilarityValidator
The source code for the validator:
https://docs.djangoproject.com/en/1.9/_modules/django/contrib/auth/password_validation/#UserAttributeSimilarityValidator
I checked the docs and source code for 1.10 and dev, and they appear to
have the same issue. I haven't submitted a bug here before, so I hope I've
done everything correctly!
--
Ticket URL: <https://code.djangoproject.com/ticket/27467>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/053.d22028e38ac1f44710cd955d253a6683%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
