Django-oscar: Anonymous order verification hash uses insecure md5

[rollcat]

In src/oscar/apps/order/abstract_models.py, the AbstractOrder model has a verification_hash method, which uses the insecure MD5 hashing algorithm to compute a verification code.

I Am Not A Cryptographer, but my spidey sense is tingling...

• key = '%s%s' % (self.number, settings.SECRET_KEY) <- user already knows the number; hash input is a simple concatenation of number and secret key
• hash = hashlib.md5(key.encode('utf8')) <- hash is also known to the user

Wouldn't that make the site-wide secret key recoverable from an anonymous order URL?

[solarissmoke]

Yep, this is an issue. Working on a patch.

[solarissmoke]

Thanks for reporting this. It is fixed in Oscar 1.5.3 which we've just released.

[rollcat]

Thanks for an extremely quick response and fix. It really speaks highly of the project.