make CRYPT with salt but not key compatible with third party systems

gluon/validators.py

@@ -19,7 +19,7 @@ import struct
 import decimal
 import unicodedata
 from cStringIO import StringIO
-from utils import simple_hash, hmac_hash, web2py_uuid, DIGEST_ALG_BY_SIZE
+from utils import simple_hash, web2py_uuid, DIGEST_ALG_BY_SIZE
 
 __all__ = [
     'CLEANUP',
@@ -2546,10 +2546,6 @@ class LazyCrypt(object):
         else assume the default digest_alg. If not key at all, set key=''
 
         If a salt is specified use it, if salt is True, set salt to uuid
-
-        masterkey is the key (as specified in argument) + salt
-        if masterkey is '' then simple_hash does not do HMAC
-        else simple_hash calls hmac_hash
         (this should all be backward compatible)
 
         Options:
@@ -2575,8 +2571,7 @@ class LazyCrypt(object):
                 salt = self.crypt.salt
         else:
             salt = ''
-        masterkey = key+salt
-        hashed = simple_hash(self.password, masterkey, digest_alg)
+        hashed = simple_hash(self.password, key, salt, digest_alg)
         self.crypted = '%s$%s$%s' % (digest_alg, salt, hashed)
         return self.crypted
 
@@ -2593,8 +2588,7 @@ class LazyCrypt(object):
             key = ''
         if stored_password.count('$')==2:
             (digest_alg, salt, hash) = stored_password.split('$')
-            masterkey = key+salt
-            h = simple_hash(self.password, masterkey, digest_alg)
+            h = simple_hash(self.password, key, salt, digest_alg)
             temp_pass = '%s$%s$%s' % (digest_alg, salt, h)            
         else: # no salting
             # guess digest_alg
@@ -2602,7 +2596,7 @@ class LazyCrypt(object):
             if not digest_alg:   
                 return False
             else:
-                temp_pass = simple_hash(self.password, key, digest_alg)
+                temp_pass = simple_hash(self.password, key, '', digest_alg)
         return temp_pass == stored_password