From 08532d4b0ae5e28a95c9d2686b5724671bb9f3c5 Mon Sep 17 00:00:00 2001
From: Robert Kolner <robert.kolner@gmail.com>
Date: Sat, 20 Jul 2013 15:14:37 +0200
Subject: [PATCH] Fixed password setting for members.

---
 dusken/api/member.py | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/dusken/api/member.py b/dusken/api/member.py
index de45137..bc349b7 100644
--- a/dusken/api/member.py
+++ b/dusken/api/member.py
@@ -1,3 +1,4 @@
+from django.contrib.auth.hashers import make_password
 from django.contrib.auth.models import User
 from django.conf.urls import url
 from django.shortcuts import get_object_or_404
@@ -78,10 +79,13 @@ class MemberResource(ModelResource):
                     if value != bundle.obj.username:
                         # We can't change username.
                         raise ImmediateHttpResponse(HttpForbidden("You can't change your username."))
-                elif key == 'password':
-                    bundle.obj.set_password(value) #TODO Set password only once we know that we can trust the request.
         return bundle     
 
+    def obj_update(self, bundle, request, **kwargs):
+        bundle.obj.set_password(bundle.data['password'])
+        bundle.obj.save()
+        return super(MemberResource, self).obj_update(bundle, request, **kwargs)
+
     def dehydrate(self, bundle):
         """
         Catches GET requests and adds more data.