From a1c007599f89e4b493947cc5c2c3968c47ff52d9 Mon Sep 17 00:00:00 2001
From: Christophe Simonis <christophe@kn.gl>
Date: Tue, 8 Jan 2013 00:15:21 +0100
Subject: [PATCH] allow change of hash scheme

---
 flask_security/core.py | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/flask_security/core.py b/flask_security/core.py
index c29de69..6b58b3d 100644
--- a/flask_security/core.py
+++ b/flask_security/core.py
@@ -94,6 +94,16 @@ _default_messages = {
     'REFRESH': ('Please reauthenticate to access this page.', 'info')
 }
 
+_allowed_password_hash_schemes = [
+    'bcrypt',
+    'des_crypt',
+    'pbkdf2_sha256',
+    'pbkdf2_sha512',
+    'sha256_crypt',
+    'sha512_crypt',
+    # And always last one...
+    'plaintext'
+]
 
 def _user_loader(user_id):
     return _security.datastore.find_user(id=user_id)
@@ -149,7 +159,10 @@ def _get_principal(app):
 
 def _get_pwd_context(app):
     pw_hash = cv('PASSWORD_HASH', app=app)
-    return CryptContext(schemes=[pw_hash], default=pw_hash)
+    if pw_hash not in _allowed_password_hash_schemes:
+        allowed = ', '.join(_allowed_password_hash_schemes[:-1]) + ' and ' + _allowed_password_hash_schemes[-1]
+        raise ValueError("Invalid hash scheme %r. Allowed values are %s" % (pw_hash, allowed))
+    return CryptContext(schemes=_allowed_password_hash_schemes, default=pw_hash)
 
 
 def _get_serializer(app, name):