Mateusz Mandera 63eece23a9 auth: Use zxcvbn to ensure password strength on server side. ... Backported for 2.0.7 security release. For a long time, we've been only doing the zxcvbn password strength checks on the browser, which is helpful, but means users could through hackery (or a bug in the frontend validation code) manage to set a too-weak password. We fix this by running our password strength validation on the backend as well, using python-zxcvbn. In theory, a bug in python-zxcvbn could result in it producing a different opinion than the frontend version; if so, it'd be a pretty bad bug in the library, and hopefully we'd hear about it from users, report upstream, and get it fixed that way. Alternatively, we can switch to shelling out to node like we do for KaTeX. Fixes #6880.		2019-11-20 23:22:23 -08:00
..
jinja2	zproject: Change use of typing.Text to str.	2018-05-10 14:19:49 -07:00
__init__.py	Rename Django project to zproject.	2013-08-07 11:04:03 -04:00
backends.py	auth: Use zxcvbn to ensure password strength on server side.	2019-11-20 23:22:23 -08:00
dev_settings.py	export: Fix finding manage.py to export usermessages.	2019-02-15 11:32:36 -08:00
dev_urls.py	tooling: Move confirmation_key view to development only views.	2019-01-11 12:45:21 -08:00
email_backends.py	tools: Upgrade Pycodestyle and fix new linter errors.	2019-01-31 12:21:41 -08:00
legacy_urls.py	urls: Move the json/fetch_api_key endpoint to be an API-style route.	2018-01-08 13:15:52 -05:00
prod_settings_template.py	settings: Improve example for RABBITMQ_HOST.	2019-06-06 16:42:23 -07:00
settings.py	settings: Set a default for SSO_APPEND_DOMAIN.	2019-04-17 12:17:17 -07:00
slack_importer_test_settings.py	settings: Migrate test settings to modern postgres backend name.	2019-01-23 17:08:24 -08:00
terms.md.template	Add TERMS_OF_SERVICE setting.	2016-07-29 20:47:31 -07:00
test_settings.py	settings: Migrate test settings to modern postgres backend name.	2019-01-23 17:08:24 -08:00
urls.py	settings: Add support for uploading logo for night mode.	2019-02-18 15:15:57 -08:00
wsgi.py	python: Mark intentionally unused imports with noop statements.	2019-02-22 16:54:47 -08:00