[Django] #32163: Admin change password is not handled gracefully (error 500)

[Django]

#32163: Admin change password is not handled gracefully (error 500)
-----------------------------------------+---------------------------------
Reporter: rsommerard | Owner: nobody
Type: Bug | Status: new
Component: contrib.admin | Version: 3.1
Severity: Normal | Keywords: admin, password
Triage Stage: Unreviewed | Has patch: 0
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
-----------------------------------------+---------------------------------
Change the password via the admin form for a user and enter a password
like `qwerty123**`, the server return a not handled gracefully error 500.
With DEBUG=True, we can have more details:

error at /admin/users/user/27/password/

multiple repeat at position 10

Request Method: POST
Request URL: http://localhost:8000/admin/users/user/27/password/
Django Version: 3.0.7
Exception Type: error
Exception Value:

multiple repeat at position 10

Exception Location: /usr/lib/python3.8/sre_parse.py in _parse, line
671
Python Executable: /home/dave/.virtualenvs/my-project/bin/python
Python Version: 3.8.5
Python Path:

['/home/dave/my-project',
'/home/dave/my-project/django',
'/usr/lib/python38.zip',
'/usr/lib/python3.8',
'/usr/lib/python3.8/lib-dynload',
'/home/dave/.virtualenvs/my-project/lib/python3.8/site-packages']

Server time: Mon, 2 Nov 2020 17:35:25 +0100

--
Ticket URL: <https://code.djangoproject.com/ticket/32163>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.

[Django]

#32163: Admin change password is not handled gracefully (error 500)

----------------------------------+--------------------------------------
Reporter: Romain SOMMERARD | Owner: nobody

Type: Bug | Status: new
Component: contrib.admin | Version: 3.1

Severity: Normal | Resolution:

Keywords: admin, password | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0

----------------------------------+--------------------------------------

Comment (by slogan621):

So, a quick google search indicates that the "*" is probably being
interpreted as a regex wildcard. And two in a row is probably invalid,
leading to the exception being raised.

What happens if you escape the '*' characters, e.g., use querty123\*\*\*
instead of querty*** ? I'm expecting that doing so would allow for the use
of "*' in a password (or trigger some other filtering/error that might be
in place that disallows use of "*").

--
Ticket URL: <https://code.djangoproject.com/ticket/32163#comment:1>

[Django]

#32163: Admin change password is not handled gracefully (error 500)

----------------------------------+--------------------------------------
Reporter: Romain SOMMERARD | Owner: nobody
Type: Bug | Status: closed
Component: contrib.admin | Version: 3.1
Severity: Normal | Resolution: invalid

Keywords: admin, password | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0

----------------------------------+--------------------------------------
Changes (by Mariusz Felisiak):

* status: new => closed
* resolution: => invalid

Comment:

I cannot reproduce this issue with builtin validators, it looks that it's
an issue in a custom password validator. Closing per
TicketClosingReasons/UseSupportChannels.

--
Ticket URL: <https://code.djangoproject.com/ticket/32163#comment:2>