Commit Graph

178 Commits

Author SHA1 Message Date
Jacob Kaplan-Moss 87f4860718 [1.5.x] Fixed #20078: don't allow filtering on password in the user admin.
Backport of 9e462f8101 from master.
2013-03-27 11:52:40 -05:00
Aymeric Augustin 33fc438952 [1.5.x] Fixed #18144 -- Restored compatibility with SHA1 hashes with empty salt.
Thanks dahool for the report and initial version of the patch.

Backport of 633d8de from master.
2013-02-25 20:04:26 +01:00
Carl Meyer a7e33c5bf3 [1.5.x] Added a new required ALLOWED_HOSTS setting for HTTP host header validation.
This is a security fix; disclosure and advisory coming shortly.
2013-02-19 10:39:03 -07:00
Claude Paroz 1b54c85a53 [1.5.x] Avoided unneeded assertion on Python 3
Fixes failure introduced in 02e5909f7a.
2013-02-15 16:11:53 +01:00
Claude Paroz 5921f15c11 [1.5.x] Fixed #19807 -- Sanitized getpass input in createsuperuser
Python 2 getpass on Windows doesn't accept unicode, even when
containing only ascii chars.
Thanks Semmel for the report and tests.
Backport of 02e5909f7a from master.
2013-02-15 15:51:17 +01:00
Russell Keith-Magee bc6746ac30 [1.5.x] Fixed #19822 -- Added validation for uniqueness on USERNAME_FIELD on custom User models.
Thanks to Claude Peroz for the draft patch.

(cherry picked from commit f5e4a699ca)
2013-02-15 09:02:14 +08:00
Preston Holmes 830b9fde46 [1.5.x] Fixed #19776 -- Added missing import for backport
line was present on master from 1520748dac
2013-02-08 00:28:37 -08:00
Preston Holmes 660f80c3d6 [1.5.x] Fixed #19662 -- alter auth modelbackend to accept custom username fields
Thanks to Aymeric and Carl for the review.
2013-02-07 16:08:23 -08:00
Claude Paroz 933e956ba4 [1.5.x] Fixed #19745 -- Forced resolution of verbose names in createsupersuser
Thanks Baptiste Mispelon for the report and Preston Holmes for the review.
Backport of 2390fe3f4 from master.
2013-02-06 10:06:57 +01:00
Claude Paroz f5232597ea [1.5.x] Fixed #19725 -- Made createsuperuser handle non-ascii prompts
Thanks Michisu for the report.
Backport of 55c585f1c from master.
2013-02-04 10:11:29 +01:00
Claude Paroz c39be8b836 [1.5.x] Fixed #18144 -- Added backwards compatibility with old unsalted MD5 passwords
Thanks apreobrazhensky at gmail.com for the report.
Backport of 63d6a50dd from master.
2013-02-02 12:03:08 +01:00
Florian Apolloner 5f3c45f745 [1.5.X] Fixed #19596 -- Use `_default_manager` instead of `objects` in the auth app.
This is needed to support custom user models which don't define a manager
named `objects`.

Backport of cc4de61a2b from master.
2013-01-22 12:50:40 +01:00
Nick Sandford b4544dbd5b [1.5.x] Fixed #19573 -- Allow override of username field label in AuthenticationForm
Backport of cdad0b28d from master.
2013-01-10 09:07:06 +01:00
Claude Paroz beef02eeaa [1.5.x] Updated deprecated test assertions 2013-01-08 19:11:40 +01:00
Claude Paroz 3aba929bcc [1.5.x] Fixed #19509 -- Fixed crypt/bcrypt non-ascii password encoding
Also systematically added non-ascii passwords in hashers test suite.
Thanks Vaal for the report.
Backport of 0dc3fc954 from master.
2012-12-22 16:04:49 +01:00
Russell Keith-Magee 06b5f5fcb6 [1.5.X] Corrected tests depending on the error message on the AuthenticationForm.
Refs #19368, and the fix introduced in 27f8129d64.

Backport of 9facca28b6 from trunk.
2012-12-16 07:22:25 +08:00
Russell Keith-Magee 311bd0055d [1.5.X} Fixed #19412 -- Added PermissionsMixin to the auth.User heirarchy.
This makes it easier to make a ModelBackend-compliant (with regards to
permissions) User model.

Thanks to cdestigter for the report about the relationship between
ModelBackend and permissions, and to the many users on django-dev that
contributed to the discussion about mixins.

Backport of 47e1df896b from master.
2012-12-15 22:47:48 +08:00
Claude Paroz 4214a22e06 [1.5.x] Fixed #19357 -- Allow non-ASCII chars in filesystem paths
Thanks kujiu for the report and Aymeric Augustin for the review.
Backport of c91667338 from master.
2012-12-08 11:16:03 +01:00
Claude Paroz 676e4d5497 [1.5.x] Fixed #19349 -- Fixed re-rendering of ReadOnlyPasswordHashWidget
Thanks tim.bowden at mapforge.com.au for the report, Andreas Hug
for the patch and Anton Baklanov for the review.
Backport of a0cd6dd11 from master.
2012-12-01 12:23:49 +01:00
Claude Paroz 47c5b50d34 [1.5.x] Fixed #19354 -- Do not assume usermodel.pk == usermodel.id
Thanks markteisman at hotmail.com for the report.
Backport of 0eeae1505 from master.
2012-11-29 21:52:22 +01:00
Claude Paroz fc570b1415 [1.5.x] Updated User manager when testing custom AUTH_USER_MODEL
This is giving more real test conditions when AUTH_USER_MODEL is
set with override_settings.
Backport of a962bc7c4 from master.
2012-11-24 16:01:10 +01:00
Preston Holmes e8269a6729 [1.5.x] Fixed #17869 - force logout when REMOTE_USER header disappears
If the current sessions user was logged in via a remote user backend log out
the user if REMOTE_USER header not available - otherwise leave it to other auth
middleware to install the AnonymousUser.

Thanks to Sylvain Bouchard for the initial patch and ticket maintenance.
2012-10-29 22:58:36 -07:00
Preston Holmes 402a986c25 [1.5.x] Fixed #19057 (again) -- added additional tests 2012-10-29 22:33:46 -07:00
Russell Keith-Magee e784b5e594 [1.5.X] Added some test guards for some recently added auth tests.
Refs #19061, #19057.
2012-10-30 10:27:01 +08:00
Claude Paroz 8c556a32f2 [1.5.x] Fixed #19172 -- Isolated poisoned_http_host tests from 500 handlers
Thanks bernardofontes for the report.

Backport of b774c5993 from master.
2012-10-29 17:29:28 +01:00
Preston Holmes f427ecdc88 [1.5.x] Fixed #19061 -- added is_active attribute to AbstractBaseUser 2012-10-28 23:06:09 -07:00
Russell Keith-Magee 04b53ebfb7 Fixed #19133 -- Corrected regression in form handling for user passwords.
Thanks to pressureman for the report, and to Preston Holmes for the draft patch.
2012-10-20 11:41:54 +08:00
Preston Holmes 9305c0e12d Fixed a security issue related to password resets
Full disclosure and new release are forthcoming
2012-10-17 14:36:41 -07:00
Russell Keith-Magee b3b3db3d95 Fixed #19067 -- Clarified handling of username in createsuperuser.
Thanks to clelland for the report, and Preston Holmes for the draft patch.
2012-10-13 13:36:07 +08:00
Anssi Kääriäinen b5f224e8e2 Fixed tests introduced for #15915
The tests didn't clean up properly. The commit that introduced the
errors was 8c427448d5.

Thanks to Trac alias rizumu for spotting this.
2012-10-12 00:10:49 +03:00
Russell Keith-Magee b9039268a1 Fixed #19060 -- Corrected assumptions about the name of the User model in the ModelBackend.
Thanks to Ivan Virabyan for the report and initial patch.
2012-10-06 12:43:29 +08:00
Mateusz Haligowski 8c427448d5 Fixed #15915 -- Cleaned handling of duplicate permission codenames
Previously, a duplicate model, codename for permission would lead to
database integrity error. Cleaned the implementation so that this case
now raises an CommandError instead.
2012-10-03 23:10:32 +03:00
Russell Keith-Magee 934f35f1f9 Corrected test docstring. 2012-10-03 09:16:33 +08:00
Preston Holmes 5f8b97f9fb Fixed #19057 -- support custom user models in mod_wsgi auth handler
thanks @freakboy3742 for the catch and review
2012-10-02 06:42:05 -07:00
Michael Farrell 7cc4068c44 Fixed #18616 -- added user_login_fail signal to contrib.auth
Thanks to Brad Pitcher for documentation
2012-09-30 22:34:50 -07:00
Anssi Kääriäinen d5a4f209c3 Fixed #18991 -- Allowed permission lookup by "if in"
When looking permissions from PermWrapper it is now possible to use
{% if "someapp.someperm" in perms %} instead of
{% if perms.someapp.someperm %}.
2012-09-30 19:38:16 +03:00
Claude Paroz 82a74dce24 Used TransactionTestCase in ModWsgiHandlerTestCase
Now the data created in setUp() is not discarded when the connection
is closed in the handler's methods.
2012-09-29 12:10:52 +02:00
Preston Holmes 373932fa6b fixed #10809 -- add a mod_wsgi authentication handler
Thanks to baumer1122 for the suggestion and initial 
patch and David Fischer for the contributions and
long term patch maintenance and docs.
2012-09-27 12:43:37 -07:00
Preston Holmes 01362745ba Fixed a small oversight in auth tests
Thanks to Vinicius Ruan Cainelli for the catch
closes #392
2012-09-27 10:24:34 -07:00
Anssi Kääriäinen 50d573d2c0 Fixed #18979 -- Avoid endless loop caused by "val in PermLookupDict"
Fixed by defining __iter__ which raises TypeError. This was done to
PermWrapper earlier.
2012-09-27 15:36:30 +03:00
Adrien Lemaire 2c8267bf3d Fixed #17899 -- Rewrote [Ee]-mail to [Ee]mail 2012-09-26 14:14:51 +02:00
Russell Keith-Magee 70a0de37d1 Fixed #3011 -- Added swappable auth.User models.
Thanks to the many people that contributed to the development and review of
this patch, including (but not limited to) Jacob Kaplan-Moss, Anssi
Kääriäinen, Ramiro Morales, Preston Holmes, Josh Ourisman, Thomas Sutton,
and Roger Barnes, as well as the many, many people who have contributed to
the design discussion around this ticket over many years.

Squashed commit of the following:

commit d84749a0f0
Merge: 531e771 7c11b1a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date:   Wed Sep 26 18:37:04 2012 +0800

    Merge remote-tracking branch 'django/master' into t3011

commit 531e7715da
Merge: 29d1abb 1f84b04
Author: Russell Keith-Magee <russell@keith-magee.com>
Date:   Wed Sep 26 07:09:23 2012 +0800

    Merged recent trunk changes.

commit 29d1abbe35
Merge: 8a527dd 54c81a1
Author: Russell Keith-Magee <russell@keith-magee.com>
Date:   Mon Sep 24 07:49:46 2012 +0800

    Merge remote-tracking branch 'django/master' into t3011

commit 8a527dda13
Author: Russell Keith-Magee <russell@keith-magee.com>
Date:   Mon Sep 24 07:48:05 2012 +0800

    Ensure sequences are reset correctly in the presence of swapped models.

commit e2b6e22f29
Author: Russell Keith-Magee <russell@keith-magee.com>
Date:   Sun Sep 23 17:53:05 2012 +0800

    Modifications to the handling and docs for auth forms.

commit 98aba856b5
Author: Russell Keith-Magee <russell@keith-magee.com>
Date:   Sun Sep 23 15:28:57 2012 +0800

    Improved error handling and docs for get_user_model()

commit 0229209c84
Merge: 6494bf9 8599f64
Author: Russell Keith-Magee <russell@keith-magee.com>
Date:   Sun Sep 23 14:50:11 2012 +0800

    Merged recent Django trunk changes.

commit 6494bf91f2
Author: Russell Keith-Magee <russell@keith-magee.com>
Date:   Mon Sep 17 21:38:44 2012 +0800

    Improved validation of swappable model settings.

commit 5a04cde342
Author: Russell Keith-Magee <russell@keith-magee.com>
Date:   Mon Sep 17 07:15:14 2012 +0800

    Removed some unused imports.

commit ffd535e413
Author: Russell Keith-Magee <russell@keith-magee.com>
Date:   Sun Sep 16 20:31:28 2012 +0800

    Corrected attribute access on for get_by_natural_key

commit 913e1ac84c
Author: Russell Keith-Magee <russell@keith-magee.com>
Date:   Sun Sep 16 20:12:34 2012 +0800

    Added test for proxy model safeguards on swappable models.

commit 280bf19e94
Merge: dbb3900 935a863
Author: Russell Keith-Magee <russell@keith-magee.com>
Date:   Sun Sep 16 18:16:49 2012 +0800

    Merge remote-tracking branch 'django/master' into t3011

commit dbb3900775
Author: Russell Keith-Magee <russell@keith-magee.com>
Date:   Sun Sep 16 18:09:27 2012 +0800

    Fixes for Python 3 compatibility.

commit dfd72131d8
Author: Russell Keith-Magee <russell@keith-magee.com>
Date:   Sun Sep 16 15:54:30 2012 +0800

    Added protection against proxying swapped models.

commit abcb027190
Author: Russell Keith-Magee <russell@keith-magee.com>
Date:   Sun Sep 16 15:11:10 2012 +0800

    Cleanup and documentation of AbstractUser base class.

commit a9491a8776
Merge: fd8bb4e 08bcb4a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date:   Sun Sep 16 14:46:49 2012 +0800

    Merge commit '08bcb4aec1ed154cefc631b8510ee13e9af0c19d' into t3011

commit fd8bb4e3e4
Author: Russell Keith-Magee <russell@keith-magee.com>
Date:   Sun Sep 16 14:20:14 2012 +0800

    Documentation improvements coming from community review.

commit b550a6d06d
Author: Russell Keith-Magee <russell@keith-magee.com>
Date:   Sun Sep 16 13:52:47 2012 +0800

    Refactored skipIfCustomUser into the contrib.auth tests.

commit 52a02f1110
Author: Russell Keith-Magee <russell@keith-magee.com>
Date:   Sun Sep 16 13:46:10 2012 +0800

    Refactored common 'get' pattern into manager method.

commit b441a6bbc7
Author: Russell Keith-Magee <russell@keith-magee.com>
Date:   Sun Sep 16 13:41:33 2012 +0800

    Added note about backwards incompatible change to admin login messages.

commit 08bcb4aec1
Author: Anssi Kääriäinen <akaariai@gmail.com>
Date:   Sat Sep 15 18:30:33 2012 +0300

    Splitted User to AbstractUser and User

commit d9f5e5addb
Author: Anssi Kääriäinen <akaariai@gmail.com>
Date:   Sat Sep 15 18:30:02 2012 +0300

    Reworked REQUIRED_FIELDS + create_user() interaction

commit 579f152e4a
Merge: 9184972 93e6733
Author: Russell Keith-Magee <russell@keith-magee.com>
Date:   Sat Sep 15 20:18:37 2012 +0800

    Merge remote-tracking branch 'django/master' into t3011

commit 918497218c
Author: Russell Keith-Magee <russell@keith-magee.com>
Date:   Sat Sep 15 20:18:19 2012 +0800

    Deprecate AUTH_PROFILE_MODULE and get_profile().

commit 334cdfc1bb
Author: Russell Keith-Magee <russell@keith-magee.com>
Date:   Sat Sep 15 20:00:12 2012 +0800

    Added release notes for new swappable User feature.

commit 5d7bb22e8d
Author: Russell Keith-Magee <russell@keith-magee.com>
Date:   Sat Sep 15 19:59:49 2012 +0800

    Ensure swapped models can't be queried.

commit 57ac6e3d32
Merge: f2ec915 abfba3b
Author: Russell Keith-Magee <russell@keith-magee.com>
Date:   Sat Sep 15 14:31:54 2012 +0800

    Merge remote-tracking branch 'django/master' into t3011

commit f2ec915b20
Merge: 1952656 5e99a3d
Author: Russell Keith-Magee <russell@keith-magee.com>
Date:   Sun Sep 9 08:29:51 2012 +0800

    Merge remote-tracking branch 'django/master' into t3011

commit 19526563b5
Merge: 2c5e833 c4aa26a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date:   Sun Sep 9 08:22:26 2012 +0800

    Merge recent changes from master.

commit 2c5e833a30
Author: Russell Keith-Magee <russell@keith-magee.com>
Date:   Sun Sep 9 07:53:46 2012 +0800

    Corrected admin_views tests following removal of the email fallback on admin logins.

commit 20d1892491
Author: Russell Keith-Magee <russell@keith-magee.com>
Date:   Sun Sep 9 01:00:37 2012 +0800

    Added conditional skips for all tests dependent on the default User model

commit 40ea8b8882
Author: Russell Keith-Magee <russell@keith-magee.com>
Date:   Sat Sep 8 23:47:02 2012 +0800

    Added documentation for REQUIRED_FIELDS in custom auth.

commit e6aaf65970
Author: Russell Keith-Magee <russell@keith-magee.com>
Date:   Sat Sep 8 23:20:02 2012 +0800

    Added first draft of custom User docs.

    Thanks to Greg Turner for the initial text.

commit 75118bd242
Author: Thomas Sutton <me@thomas-sutton.id.au>
Date:   Mon Aug 20 11:17:26 2012 +0800

    Admin app should not allow username discovery

    The admin app login form should not allow users to discover the username
    associated with an email address.

commit d088b3af58
Author: Thomas Sutton <me@thomas-sutton.id.au>
Date:   Mon Aug 20 10:32:13 2012 +0800

    Admin app login form should use swapped user model

commit 7e82e83d67
Merge: e29c010 39aa890
Author: Russell Keith-Magee <russell@keith-magee.com>
Date:   Fri Sep 7 23:45:03 2012 +0800

    Merged master changes.

commit e29c010beb
Merge: 8e3fd70 30bdf22
Author: Russell Keith-Magee <russell@keith-magee.com>
Date:   Mon Aug 20 13:12:57 2012 +0800

    Merge remote-tracking branch 'django/master' into t3011

commit 8e3fd703d0
Merge: 507bb50 26e0ba0
Author: Russell Keith-Magee <russell@keith-magee.com>
Date:   Mon Aug 20 13:09:09 2012 +0800

    Merged recent changes from trunk.

commit 507bb50a92
Author: Russell Keith-Magee <russell@keith-magee.com>
Date:   Mon Jun 4 20:41:37 2012 +0800

    Modified auth app so that login with alternate auth app is possible.

commit dabe362836
Author: Russell Keith-Magee <russell@keith-magee.com>
Date:   Mon Jun 4 20:10:51 2012 +0800

    Modified auth management commands to handle custom user definitions.

commit 7cc0baf89d
Author: Russell Keith-Magee <russell@keith-magee.com>
Date:   Mon Jun 4 14:17:28 2012 +0800

    Added model Meta option for swappable models, and made auth.User a swappable model
2012-09-26 18:48:09 +08:00
Florian Apolloner 06f79354d0 Added tests for d21f3d9b17. 2012-09-17 21:56:19 +02:00
Claude Paroz c7f44ae085 Fixed #17948 -- Isolated auth tests from custom template loaders
Thanks andrey@kostenko.name for the report.
2012-09-15 21:39:08 +02:00
Claude Paroz 1aa218b857 Fixed test output check when password is blank 2012-09-12 11:58:02 +02:00
Claude Paroz 703c266682 Fixed #18182 -- Made is_usable_password check if hashing algorithm is correct
The display of the ReadOnlyPasswordHashWidget has also been improved to
distinguish empty/unusable password from erroneous password.
Fixed #18453 also.
Thanks danielr and Leo for the reports and Moritz Sichert for the
initial patch.
2012-09-12 11:32:50 +02:00
Carl Meyer a78dd109e6 Fixed #15552 -- LOGIN_URL and LOGIN_REDIRECT_URL can take URLpattern names.
Thanks UloPe and Eric Florenzano for the patch, and Malcolm Tredinnick for
review.
2012-09-08 16:58:35 -06:00
Alex Gaynor 292322f977 [py3k] Silence many warnings while running the tests. 2012-09-07 13:17:34 -04:00
Aymeric Augustin 54899d810d [py3] Fixed #18805 -- ported createsuperuser.
Thanks sunsesh at gmail.com for the report.
2012-08-20 22:25:41 +02:00
Ramiro Morales 4c934f3921 Made createsuperuser more robust when getting current OS username.
Under some versions of OS X, failure in getting the default system
locale during the syncdb operation of the auth app were causing hard to
diagnose problems afterwards.

No solution based on getpreferredencoding() was chosen because it has
its own problems with certain combinations of Python and OS X versions
(e.g. http://bugs.python.org/issue6202).

Thanks prestonsimmons for the report and prestonsimmons and willhardy
for the initial patch.

Fixes #16017.
2012-08-17 23:15:20 -03:00