MoinMoin: attachment:try1.patch of MoinMoinBugs/HttpAuthNoSavePassword

   1 diff -Nur moin-1.5.5a/MoinMoin/auth.py moin-1.5.5a.new/MoinMoin/auth.py
   2 --- moin-1.5.5a/MoinMoin/auth.py	2006-10-11 11:33:21.607503000 +0100
   3 +++ moin-1.5.5a.new/MoinMoin/auth.py	2006-10-11 11:34:51.451724455 +0100
   4 @@ -172,7 +172,9 @@
   5      # check if we are running Twisted
   6      if isinstance(request, RequestTwisted):
   7          username = request.twistd.getUser()
   8 -        password = request.twistd.getPassword()
   9 +        password = None
  10 +        if request.cfg.user_save_password:
  11 +            password = request.twistd.getPassword()
  12          # when using Twisted http auth, we use username and password from
  13          # the moin user profile, so both can be changed by user.
  14          u = user.User(request, auth_username=username, password=password,
  15 diff -Nur moin-1.5.5a/MoinMoin/multiconfig.py moin-1.5.5a.new/MoinMoin/multiconfig.py
  16 --- moin-1.5.5a/MoinMoin/multiconfig.py	2006-10-11 11:33:11.585375000 +0100
  17 +++ moin-1.5.5a.new/MoinMoin/multiconfig.py	2006-10-11 11:35:13.121677407 +0100
  18 @@ -369,6 +369,7 @@
  19      tz_offset = 0.0 # default time zone offset in hours from UTC
  20      user_autocreate = False # do we auto-create user profiles
  21      user_email_unique = True # do we check whether a user's email is unique?
  22 +    user_save_password = True # do we save the user's password?
  23  
  24      # a regex of HTTP_USER_AGENTS that should be excluded from logging
  25      # and receive a FORBIDDEN for anything except viewing a page