allow change of hash scheme

flask_security/core.py

@@ -94,6 +94,16 @@ _default_messages = {
     'REFRESH': ('Please reauthenticate to access this page.', 'info')
 }
 
+_allowed_password_hash_schemes = [
+    'bcrypt',
+    'des_crypt',
+    'pbkdf2_sha256',
+    'pbkdf2_sha512',
+    'sha256_crypt',
+    'sha512_crypt',
+    # And always last one...
+    'plaintext'
+]
 
 def _user_loader(user_id):
     return _security.datastore.find_user(id=user_id)
@@ -149,7 +159,10 @@ def _get_principal(app):
 
 def _get_pwd_context(app):
     pw_hash = cv('PASSWORD_HASH', app=app)
-    return CryptContext(schemes=[pw_hash], default=pw_hash)
+    if pw_hash not in _allowed_password_hash_schemes:
+        allowed = ', '.join(_allowed_password_hash_schemes[:-1]) + ' and ' + _allowed_password_hash_schemes[-1]
+        raise ValueError("Invalid hash scheme %r. Allowed values are %s" % (pw_hash, allowed))
+    return CryptContext(schemes=_allowed_password_hash_schemes, default=pw_hash)
 
 
 def _get_serializer(app, name):