sthen e99b9c3602 SECURITY update to py-bcrypt 0.4, from Francisco de Borja Lopez Rio
- while there, fix WANTLIB and enable python 3 support; by me

Fix concurrency bug reported by Alan Fairless of spideroak.com:
Multiple threads may hash into the same memory area simultaneously.
This may manifest as occasional random authentication failures (as
user-a's password hash is compared to user-b's), but could potentially
be used to bypass password checking by an attacker (user-a attempts
login on user-b's account, while simultaneously flooding auth requests
against user-a's account to overwrite the hash).
2014-03-19 11:15:56 +00:00
..