From 5955adfdab973968ddeb98de973305360f1740e5 Mon Sep 17 00:00:00 2001
From: Anthony Bourguignon <contact@toniob.net>
Date: Fri, 5 Oct 2018 15:52:16 +0200
Subject: [PATCH] add a parameter to choose between updating the password to
 the default scheme or not

---
 modoboa/core/app_settings.py              |  8 ++++++
 modoboa/core/tests/test_authentication.py |  7 ++++++
 modoboa/core/tests/test_views.py          |  1 +
 modoboa/core/views/auth.py                | 30 ++++++++++++-----------
 4 files changed, 32 insertions(+), 14 deletions(-)

diff --git a/modoboa/core/app_settings.py b/modoboa/core/app_settings.py
index c0af12596..1e0124a4f 100644
--- a/modoboa/core/app_settings.py
+++ b/modoboa/core/app_settings.py
@@ -68,6 +68,14 @@ class GeneralParametersForm(param_forms.AdminParametersForm):
         widget=forms.TextInput(attrs={"class": "form-control"})
     )
 
+    update_scheme = YesNoField(
+        label=ugettext_lazy("Update password scheme"),
+        initial=True,
+        help_text=ugettext_lazy(
+            "Update user password at login to use the default password scheme"
+        )
+    )
+
     default_password = forms.CharField(
         label=ugettext_lazy("Default password"),
         initial="password",
diff --git a/modoboa/core/tests/test_authentication.py b/modoboa/core/tests/test_authentication.py
index f6826f551..1b912a0b5 100644
--- a/modoboa/core/tests/test_authentication.py
+++ b/modoboa/core/tests/test_authentication.py
@@ -95,6 +95,13 @@ class AuthenticationTestCase(ModoTestCase):
         user.refresh_from_db()
         self.assertTrue(user.password.startswith(pw_hash.scheme))
 
+        self.client.logout()
+        self.set_global_parameter("password_scheme", "sha256crypt")
+        self.set_global_parameter("update_scheme", False)
+        response = self.client.post(reverse("core:login"), data)
+        user.refresh_from_db()
+        self.assertTrue(user.password.startswith(pw_hash.scheme))
+
 
 class PasswordResetTestCase(ModoTestCase):
     """Test password reset service."""
diff --git a/modoboa/core/tests/test_views.py b/modoboa/core/tests/test_views.py
index 221445348..69d1c285e 100644
--- a/modoboa/core/tests/test_views.py
+++ b/modoboa/core/tests/test_views.py
@@ -36,6 +36,7 @@ SETTINGS_SAMPLE = {
     "csrfmiddlewaretoken": "SGgMVZsA4TPqoiV786TMST6xgOlhAf4F",
     "limits-deflt_user_mailboxes_limit": "0",
     "core-password_scheme": "sha512crypt",
+    "core-update_scheme": True,
     "core-items_per_page": "30",
     "limits-deflt_user_mailbox_aliases_limit": "0",
     "limits-deflt_domain_mailboxes_limit": "0",
diff --git a/modoboa/core/views/auth.py b/modoboa/core/views/auth.py
index 0280f1652..45054f149 100644
--- a/modoboa/core/views/auth.py
+++ b/modoboa/core/views/auth.py
@@ -35,20 +35,22 @@ def dologin(request):
             user = authenticate(username=form.cleaned_data["username"],
                                 password=form.cleaned_data["password"])
             if user and user.is_active:
-                # check if password scheme is correct
-                scheme = param_tools.get_global_parameter("password_scheme",
-                                                          raise_exception=False)
-                # use SHA512CRYPT as default fallback
-                if scheme is None:
-                    pwhash = get_password_hasher('sha512crypt')()
-                else:
-                    pwhash = get_password_hasher(scheme)()
-                if not user.password.startswith(pwhash.scheme):
-                    logging.info(
-                        _("Password scheme mismatch. Updating %s password") % user.username
-                    )
-                    user.set_password(form.cleaned_data["password"])
-                    user.save()
+                if param_tools.get_global_parameter("update_scheme",
+                                                    raise_exception=False):
+                    # check if password scheme is correct
+                    scheme = param_tools.get_global_parameter("password_scheme",
+                                                              raise_exception=False)
+                    # use SHA512CRYPT as default fallback
+                    if scheme is None:
+                        pwhash = get_password_hasher('sha512crypt')()
+                    else:
+                        pwhash = get_password_hasher(scheme)()
+                    if not user.password.startswith(pwhash.scheme):
+                        logging.info(
+                            _("Password scheme mismatch. Updating %s password") % user.username
+                        )
+                        user.set_password(form.cleaned_data["password"])
+                        user.save()
 
                 login(request, user)
                 if not form.cleaned_data["rememberme"]: