Django集成PHP password_hash()用户密码的迁移指南

# users/models.py
from django.contrib.auth.models import AbstractUser
from django.db import models

class CustomUser(AbstractUser):
    # 添加一个字段来存储旧的PHP密码哈希
    old_password = models.CharField(max_length=255, blank=True, null=True)

    # 可以添加其他自定义字段
    # bio = models.TextField(blank=True, null=True)

    class Meta:
        verbose_name = "用户"
        verbose_name_plural = "用户"

    def __str__(self):
        return self.username

# your_project/settings.py
AUTH_USER_MODEL = 'users.CustomUser' # 替换为你的应用名和模型名

python manage.py makemigrations users
python manage.py migrate

# import_users.py (或在Django shell中执行)
import os
import django
from django.conf import settings

# 确保Django环境已设置
os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'your_project.settings')
django.setup()

from users.models import CustomUser # 导入你的自定义用户模型

# 假设你有一个包含旧用户数据的列表或CSV文件
# 示例数据结构：[{'username': 'testguy', 'email': 'test@example.com', 'php_password_hash': '$2y$10$ZnxKDPbqOfACnGmQeN76o.UtdwWBFBCCLTiGnvCSvl/zqIBeVxhai'}]
old_users_data = [
    {'username': 'testguy', 'email': 'test@example.com', 'php_password_hash': '$2y$10$ZnxKDPbqOfACnGmQeN76o.UtdwWBFBCCLTiGnvCSvl/zqIBeVxhai'},
    # 更多用户数据...
]

for user_data in old_users_data:
    try:
        user, created = CustomUser.objects.get_or_create(
            username=user_data['username'],
            defaults={
                'email': user_data['email'],
                'old_password': user_data['php_password_hash'],
                # 注意：不要在此处设置password字段为php_password_hash
                # 如果是新用户，可以设置一个临时密码或留空
                'password': '', # 留空或设置一个不可用的哈希
            }
        )
        if not created:
            # 如果用户已存在，可以选择更新其信息或跳过
            user.email = user_data['email']
            user.old_password = user_data['php_password_hash']
            user.save()
        print(f"用户 {user.username} 导入成功。")
    except Exception as e:
        print(f"导入用户 {user_data['username']} 时发生错误: {e}")

pip install bcrypt

# users/backends.py
import bcrypt
from django.contrib.auth.backends import ModelBackend
from django.contrib.auth import get_user_model

class PHPHashCheckingBackend(ModelBackend):
    def authenticate(self, request, username=None, password=None, **kwargs):
        User = get_user_model()
        try:
            user = User.objects.get(username=username)
        except User.DoesNotExist:
            return None

        # 1. 首先尝试Django自带的密码验证
        if user.check_password(password):
            return user
        else:
            # 2. 如果Django验证失败，检查是否存在旧的PHP哈希密码
            if user.old_password:
                try:
                    # bcrypt.checkpw 期望字节串
                    # 将明文密码和存储的旧哈希转换为字节串
                    if bcrypt.checkpw(password.encode('utf-8'), user.old_password.encode('utf-8')):
                        # 3. 如果旧密码匹配，则更新用户的密码为Django格式
                        # 这样下次登录时就会使用Django的原生哈希
                        user.set_password(password)
                        user.old_password = None # 清除旧密码，标记为已迁移
                        user.save()
                        return user
                except ValueError:
                    # bcrypt.checkpw可能会在哈希格式不正确时抛出ValueError
                    # 例如，如果old_password不是有效的bcrypt哈希
                    pass
        return None

    def get_user(self, user_id):
        User = get_user_model()
        try:
            return User.objects.get(pk=user_id)
        except User.DoesNotExist:
            return None

# your_project/settings.py
AUTHENTICATION_BACKENDS = [
    'users.backends.PHPHashCheckingBackend', # 你的自定义后端
    'django.contrib.auth.backends.ModelBackend', # Django的默认后端
]