From 128d55287acdfc563a103afb8f82bf7487e9f1b1 Mon Sep 17 00:00:00 2001 From: Marta Blazewska Date: Tue, 26 May 2026 15:37:39 +0200 Subject: [PATCH] fix: scope MD5 PASSWORD_HASHERS override to test runs only The previous predicate (`"karrio" in _sys.argv[0]`) matches the install path of the `karrio` virtualenv (`/karrio/venv/bin/gunicorn`), so the test-only MD5 PASSWORD_HASHERS override was firing in production gunicorn workers as well. Two consequences for any deployment upgraded past 2026.1.22: - Pre-upgrade users with PBKDF2-hashed passwords can no longer log in, because the loaded hasher list cannot verify their hash format. - New users (createsuperuser, dashboard signup) have their passwords stored as MD5, which Django itself documents as test-only. Replace the argv-based predicate with a custom TEST_RUNNER subclass that sets PASSWORD_HASHERS in `setup_test_environment`. Django loads TEST_RUNNER only for `manage.py test` / `karrio test`, so the override fires exactly when intended and never touches production process state. refs https://github.com/orgs/karrioapi/discussions/1094 --- apps/api/karrio/server/settings/base.py | 8 +------- apps/api/karrio/server/test_runner.py | 13 +++++++++++++ 2 files changed, 14 insertions(+), 7 deletions(-) create mode 100644 apps/api/karrio/server/test_runner.py diff --git a/apps/api/karrio/server/settings/base.py b/apps/api/karrio/server/settings/base.py index ce8784434..84377e0e0 100644 --- a/apps/api/karrio/server/settings/base.py +++ b/apps/api/karrio/server/settings/base.py @@ -374,13 +374,7 @@ } } -# Speed up test suite: use fast MD5 hasher instead of bcrypt/PBKDF2 -# This only applies when running `manage.py test` — production is unaffected -import sys as _sys -if "test" in _sys.argv or "karrio" in _sys.argv[0]: - PASSWORD_HASHERS = [ - "django.contrib.auth.hashers.MD5PasswordHasher", - ] +TEST_RUNNER = "karrio.server.test_runner.KarrioTestRunner" if config("DATABASE_URL", default=None): db_from_env = dj_database_url.config( diff --git a/apps/api/karrio/server/test_runner.py b/apps/api/karrio/server/test_runner.py new file mode 100644 index 000000000..bdf371f0d --- /dev/null +++ b/apps/api/karrio/server/test_runner.py @@ -0,0 +1,13 @@ +from django.conf import settings +from django.test.runner import DiscoverRunner + + +class KarrioTestRunner(DiscoverRunner): + """Custom Django test runner that overrides settings for the test suite.""" + + def setup_test_environment(self, **kwargs): + super().setup_test_environment(**kwargs) + # Speed up tests with a fast hasher (PBKDF2 is intentionally slow). + settings.PASSWORD_HASHERS = [ + "django.contrib.auth.hashers.MD5PasswordHasher", + ]