From 7b3dbde8bd89ca2c576a506bb3ef32bac550e8bc Mon Sep 17 00:00:00 2001
From: Midas <midas@contauro.com>
Date: Thu, 23 Jul 2026 09:21:21 +0200
Subject: [PATCH 1/2] orm/users: replace removed stdlib crypt/legacycrypt with
 passlib

---
 orm/users.py | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/orm/users.py b/orm/users.py
index 0e5d7ec..684ca12 100644
--- a/orm/users.py
+++ b/orm/users.py
@@ -16,11 +16,7 @@
 from sqlalchemy.ext.hybrid import hybrid_property
 from sqlalchemy.orm import column_property, relationship, selectinload, validates
 
-try:
-    # python 3.13
-    import legacycrypt as crypt
-except ImportError:
-    import crypt as crypt
+from passlib.hash import sha512_crypt, bcrypt
 
 import json
 import sys
@@ -368,13 +364,17 @@ def password(self):
     def password(self, pw):
         # On OpenBSD only blowfish is supported
         if sys.platform.startswith("openbsd"):
-            _method = crypt.METHOD_BLOWFISH
+            self._password = bcrypt.hash(pw)
         else:
-            _method = crypt.METHOD_SHA512
-        self._password = crypt.crypt(pw, crypt.mksalt(_method))
+            self._password = sha512_crypt.hash(pw)
 
     def chkPw(self, pw):
-        return crypt.crypt(pw, self.password) == self.password
+        try:
+            if self.password.startswith(("$2a$", "$2b$", "$2y$")):
+                return bcrypt.verify(pw, self.password)
+            return sha512_crypt.verify(pw, self.password)
+        except ValueError:
+            return False
 
     @property
     def propmap_id(self):

From a0fca2cbc631cab22d65943f1e5635b633798b95 Mon Sep 17 00:00:00 2001
From: Midas <midas@contauro.com>
Date: Thu, 13 Aug 2026 19:57:13 +0200
Subject: [PATCH 2/2] Update Pipfile: legacycrypt -> passlib

---
 Pipfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Pipfile b/Pipfile
index d354ed2..82418cf 100644
--- a/Pipfile
+++ b/Pipfile
@@ -19,7 +19,7 @@ systemd-python = "*"
 multidict = "*"
 cryptography = "*"
 dnspython = "*"
-legacycrypt = "*"
+passlib = "*"
 
 [dev-packages]