Add unicode password support

data/model/legacy.py

@@ -86,6 +86,9 @@ class TooManyLoginAttemptsException(Exception):
     super(TooManyLoginAttemptsException, self).__init__(message)
     self.retry_after = retry_after
 
+def hash_password(password, salt=None):
+  salt = salt or bcrypt.gensalt()
+  return bcrypt.hashpw(password.encode('utf-8'), salt)
 
 def is_create_user_allowed():
   return True
@@ -101,7 +104,7 @@ def create_user(username, password, email):
   created = _create_user(username, email)
   
   # Store the password hash
-  pw_hash = bcrypt.hashpw(password, bcrypt.gensalt())
+  pw_hash = hash_password(password)
   created.password_hash = pw_hash
   
   created.save()
@@ -613,10 +616,7 @@ def verify_user(username_or_email, password):
       retry_after = can_retry_at - now
       raise TooManyLoginAttemptsException('Too many login attempts.', retry_after.total_seconds())
 
-  if (fetched.password_hash and 
-      bcrypt.hashpw(password, fetched.password_hash) ==
-      fetched.password_hash):
-
+  if (fetched.password_hash and hash_password(password, fetched.password_hash) == fetched.password_hash):
     if fetched.invalid_login_attempts > 0:
       fetched.invalid_login_attempts = 0
       fetched.save()
@@ -811,7 +811,7 @@ def change_password(user, new_password):
   if not validate_password(new_password):
     raise InvalidPasswordException(INVALID_PASSWORD_MESSAGE)
 
-  pw_hash = bcrypt.hashpw(new_password, bcrypt.gensalt())
+  pw_hash = hash_password(new_password)
   user.password_hash = pw_hash
   user.save()
 

test/test_api_usage.py

@@ -339,6 +339,12 @@ class TestChangeUserDetails(ApiTestCase):
                          data=dict(password='newpasswordiscool'))
     self.login(READ_ACCESS_USER, password='newpasswordiscool')
 
+  def test_changepassword_unicode(self):
+    self.login(READ_ACCESS_USER)
+    self.putJsonResponse(User,
+                         data=dict(password='someunicode北京市pass'))
+    self.login(READ_ACCESS_USER, password='someunicode北京市pass')
+
   def test_changeeemail(self):
     self.login(READ_ACCESS_USER)