diff --git a/django/contrib/auth/password_validation.py b/django/contrib/auth/password_validation.py
index a44bf57875..f01c13d841 100644
--- a/django/contrib/auth/password_validation.py
+++ b/django/contrib/auth/password_validation.py
@@ -8,6 +8,7 @@ from difflib import SequenceMatcher
from django.conf import settings
from django.core.exceptions import ImproperlyConfigured, ValidationError
from django.utils import lru_cache
+from django.utils._os import upath
from django.utils.encoding import force_text
from django.utils.html import format_html
from django.utils.module_loading import import_string
@@ -47,7 +48,7 @@ def validate_password(password, user=None, password_validators=None):
try:
validator.validate(password, user)
except ValidationError as error:
- errors += error.messages
+ errors.append(error)
if errors:
raise ValidationError(errors)
@@ -95,8 +96,11 @@ class MinimumLengthValidator(object):
def validate(self, password, user=None):
if len(password) < self.min_length:
- msg = _("This password is too short. It must contain at least %(min_length)d characters.")
- raise ValidationError(msg % {'min_length': self.min_length})
+ raise ValidationError(
+ _("This password is too short. It must contain at least %(min_length)d characters."),
+ code='password_too_short',
+ params={'min_length': self.min_length},
+ )
def get_help_text(self):
return _("Your password must contain at least %(min_length)d characters.") % {'min_length': self.min_length}
@@ -131,7 +135,11 @@ class UserAttributeSimilarityValidator(object):
for value_part in value_parts:
if SequenceMatcher(a=password.lower(), b=value_part.lower()).quick_ratio() > self.max_similarity:
verbose_name = force_text(user._meta.get_field(attribute_name).verbose_name)
- raise ValidationError(_("The password is too similar to the %s." % verbose_name))
+ raise ValidationError(
+ _("The password is too similar to the %(verbose_name)s."),
+ code='password_too_similar',
+ params={'verbose_name': verbose_name},
+ )
def get_help_text(self):
return _("Your password can't be too similar to your other personal information.")
@@ -145,7 +153,9 @@ class CommonPasswordValidator(object):
The list Django ships with contains 1000 common passwords, created by Mark Burnett:
https://xato.net/passwords/more-top-worst-passwords/
"""
- DEFAULT_PASSWORD_LIST_PATH = os.path.dirname(os.path.realpath(__file__)) + '/common-passwords.txt.gz'
+ DEFAULT_PASSWORD_LIST_PATH = os.path.join(
+ os.path.dirname(os.path.realpath(upath(__file__))), 'common-passwords.txt.gz'
+ )
def __init__(self, password_list_path=DEFAULT_PASSWORD_LIST_PATH):
try:
@@ -156,7 +166,10 @@ class CommonPasswordValidator(object):
def validate(self, password, user=None):
if password.lower().strip() in self.passwords:
- raise ValidationError(_("This password is too common."))
+ raise ValidationError(
+ _("This password is too common."),
+ code='password_too_common',
+ )
def get_help_text(self):
return _("Your password can't be a commonly used password.")
@@ -168,7 +181,10 @@ class NumericPasswordValidator(object):
"""
def validate(self, password, user=None):
if password.isdigit():
- raise ValidationError(_("This password is entirely numeric."))
+ raise ValidationError(
+ _("This password is entirely numeric."),
+ code='password_entirely_numeric',
+ )
def get_help_text(self):
return _("Your password can't be entirely numeric.")
diff --git a/docs/ref/settings.txt b/docs/ref/settings.txt
index a0c3e69877..126f8f17fb 100644
--- a/docs/ref/settings.txt
+++ b/docs/ref/settings.txt
@@ -2774,11 +2774,11 @@ AUTH_PASSWORD_VALIDATORS
.. versionadded:: 1.9
-Default: ``[]``
+Default: ``[]`` (Empty list)
-Sets the validators that are used to check the strength of user's passwords.
-See :ref:`password-validation` for more details.
-By default, no validation is performed and all passwords are accepted.
+The list of validators that are used to check the strength of user's passwords.
+See :ref:`password-validation` for more details. By default, no validation is
+performed and all passwords are accepted.
.. _settings-messages:
diff --git a/docs/releases/1.9.txt b/docs/releases/1.9.txt
index 1054699bf9..5be8f233b5 100644
--- a/docs/releases/1.9.txt
+++ b/docs/releases/1.9.txt
@@ -28,7 +28,7 @@ What's new in Django 1.9
Password validation
~~~~~~~~~~~~~~~~~~~
-Django now offers password validation, to help prevent the usage of weak
+Django now offers password validation to help prevent the usage of weak
passwords by users. The validation is integrated in the included password
change and reset forms and is simple to integrate in any other code.
Validation is performed by one or more validators, configured in the new
@@ -36,10 +36,10 @@ Validation is performed by one or more validators, configured in the new
Four validators are included in Django, which can enforce a minimum length,
compare the password to the user's attributes like their name, ensure
-passwords aren't entirely numeric or check against an included list of common
+passwords aren't entirely numeric, or check against an included list of common
passwords. You can combine multiple validators, and some validators have
custom configuration options. For example, you can choose to provide a custom
-list of common passwords. Each validator provides a help text to explain their
+list of common passwords. Each validator provides a help text to explain its
requirements to the user.
By default, no validation is performed and all passwords are accepted, so if
diff --git a/docs/topics/auth/passwords.txt b/docs/topics/auth/passwords.txt
index 090c9196b6..69634cf314 100644
--- a/docs/topics/auth/passwords.txt
+++ b/docs/topics/auth/passwords.txt
@@ -242,6 +242,10 @@ from the ``User`` model.
Password validation
===================
+.. module:: django.contrib.auth.password_validation
+
+.. versionadded:: 1.9
+
Users often choose poor passwords. To help mitigate this problem, Django
offers pluggable password validation. You can configure multiple password
validators at the same time. A few validators are included in Django, but it's
@@ -254,14 +258,14 @@ Validators can also have optional settings to fine tune their behavior.
Validation is controlled by the :setting:`AUTH_PASSWORD_VALIDATORS` setting.
By default, validators are used in the forms to reset or change passwords.
-The default for setting is an empty list, which means no validators are
+The default for the setting is an empty list, which means no validators are
applied. In new projects created with the default :djadmin:`startproject`
template, a simple set of validators is enabled.
.. note::
Password validation can prevent the use of many types of weak passwords.
- However, the fact that a password passes all the validators, doesn't
+ However, the fact that a password passes all the validators doesn't
guarantee that it is a strong password. There are many factors that can
weaken a password that are not detectable by even the most advanced
password validators.
@@ -344,7 +348,7 @@ Django includes four validators:
`Mark Burnett `_.
The ``password_list_path`` can be set to the path of a custom file of
- common passwords. This file should contain one password per line, and
+ common passwords. This file should contain one password per line and
may be plain text or gzipped.
.. class:: NumericPasswordValidator()
@@ -354,8 +358,6 @@ Django includes four validators:
Integrating validation
-----------------------
-.. module:: django.contrib.auth.password_validation
-
There are a few functions in ``django.contrib.auth.password_validation`` that
you can call from your own forms or other code to integrate password
validation. This can be useful if you use custom forms for password setting,
@@ -368,14 +370,14 @@ or if you have API calls that allow passwords to be set, for example.
:exc:`~django.core.exceptions.ValidationError` with all the error messages
from the validators.
- The user object is optional: if it's not provided, some validators may not
- be able to perform any validation and will accept any password.
+ The ``user`` object is optional: if it's not provided, some validators may
+ not be able to perform any validation and will accept any password.
.. function:: password_changed(password, user=None, password_validators=None)
Informs all validators that the password has been changed. This can be used
- by some validators, e.g. a validator that prevents password reuse. This
- should be called once the password has been successfully changed.
+ by validators such as one that prevents password reuse. This should be
+ called once the password has been successfully changed.
.. function:: password_validators_help_texts(password_validators=None)
@@ -440,11 +442,17 @@ Here's a basic example of a validator, with one optional setting::
def validate(self, password, user=None):
if len(password) < self.min_length:
- raise ValidationError(_("This password is too short."))
+ raise ValidationError(
+ _("This password must contain at least %(min_length)d characters."),
+ code='password_too_short',
+ params={'min_length': self.min_length},
+ )
def get_help_text(self):
- return _("Your password must contain at least %(min_length)d characters.")
+ return _(
+ "Your password must contain at least %(min_length)d characters."
% {'min_length': self.min_length}
+ )
You can also implement ``password_changed(password, user=None``), which will
be called after a successful password change. That can be used to prevent
diff --git a/tests/auth_tests/test_forms.py b/tests/auth_tests/test_forms.py
index c469201408..2771c09111 100644
--- a/tests/auth_tests/test_forms.py
+++ b/tests/auth_tests/test_forms.py
@@ -278,8 +278,11 @@ class SetPasswordFormTest(TestDataMixin, TestCase):
form = SetPasswordForm(user, data)
self.assertFalse(form.is_valid())
self.assertEqual(len(form["new_password2"].errors), 2)
- self.assertTrue('The password is too similar to the username.' in form["new_password2"].errors)
- self.assertTrue('This password is too short. It must contain at least 12 characters.' in form["new_password2"].errors)
+ self.assertIn('The password is too similar to the username.', form["new_password2"].errors)
+ self.assertIn(
+ 'This password is too short. It must contain at least 12 characters.',
+ form["new_password2"].errors
+ )
@override_settings(USE_TZ=False, PASSWORD_HASHERS=['django.contrib.auth.hashers.SHA1PasswordHasher'])
diff --git a/tests/auth_tests/test_validators.py b/tests/auth_tests/test_validators.py
index 543e520e8f..3822c9c675 100644
--- a/tests/auth_tests/test_validators.py
+++ b/tests/auth_tests/test_validators.py
@@ -12,6 +12,7 @@ from django.contrib.auth.password_validation import (
)
from django.core.exceptions import ValidationError
from django.test import TestCase, override_settings
+from django.utils._os import upath
@override_settings(AUTH_PASSWORD_VALIDATORS=[
@@ -43,10 +44,12 @@ class PasswordValidationTest(TestCase):
with self.assertRaises(ValidationError, args=['This password is too short.']) as cm:
validate_password('django4242')
self.assertEqual(cm.exception.messages, [msg_too_short])
+ self.assertEqual(cm.exception.error_list[0].code, 'password_too_short')
with self.assertRaises(ValidationError) as cm:
validate_password('password')
self.assertEqual(cm.exception.messages, ['This password is too common.', msg_too_short])
+ self.assertEqual(cm.exception.error_list[0].code, 'password_too_common')
self.assertIsNone(validate_password('password', password_validators=[]))
@@ -56,14 +59,14 @@ class PasswordValidationTest(TestCase):
def test_password_validators_help_texts(self):
help_texts = password_validators_help_texts()
self.assertEqual(len(help_texts), 2)
- self.assertTrue('12 characters' in help_texts[1])
+ self.assertIn('12 characters', help_texts[1])
self.assertEqual(password_validators_help_texts(password_validators=[]), [])
def test_password_validators_help_text_html(self):
help_text = password_validators_help_text_html()
self.assertEqual(help_text.count(''), 2)
- self.assertTrue('12 characters' in help_text)
+ self.assertIn('12 characters', help_text)
class MinimumLengthValidatorTest(TestCase):
@@ -75,6 +78,7 @@ class MinimumLengthValidatorTest(TestCase):
with self.assertRaises(ValidationError) as cm:
MinimumLengthValidator().validate('1234567')
self.assertEqual(cm.exception.messages, [expected_error % 8])
+ self.assertEqual(cm.exception.error_list[0].code, 'password_too_short')
with self.assertRaises(ValidationError) as cm:
MinimumLengthValidator(min_length=3).validate('12')
@@ -100,13 +104,17 @@ class UserAttributeSimilarityValidatorTest(TestCase):
with self.assertRaises(ValidationError) as cm:
UserAttributeSimilarityValidator().validate('testclient', user=user),
self.assertEqual(cm.exception.messages, [expected_error % "username"])
+ self.assertEqual(cm.exception.error_list[0].code, 'password_too_similar')
with self.assertRaises(ValidationError) as cm:
UserAttributeSimilarityValidator().validate('example.com', user=user),
self.assertEqual(cm.exception.messages, [expected_error % "email address"])
with self.assertRaises(ValidationError) as cm:
- UserAttributeSimilarityValidator(user_attributes=['first_name'], max_similarity=0.3).validate('testclient', user=user),
+ UserAttributeSimilarityValidator(
+ user_attributes=['first_name'],
+ max_similarity=0.3,
+ ).validate('testclient', user=user)
self.assertEqual(cm.exception.messages, [expected_error % "first name"])
self.assertIsNone(
@@ -130,7 +138,7 @@ class CommonPasswordValidatorTest(TestCase):
self.assertEqual(cm.exception.messages, [expected_error])
def test_validate_custom_list(self):
- path = os.path.dirname(os.path.realpath(__file__)) + '/common-passwords-custom.txt'
+ path = os.path.join(os.path.dirname(os.path.realpath(upath(__file__))), 'common-passwords-custom.txt')
validator = CommonPasswordValidator(password_list_path=path)
expected_error = "This password is too common."
self.assertIsNone(validator.validate('a-safe-password'))
@@ -138,6 +146,7 @@ class CommonPasswordValidatorTest(TestCase):
with self.assertRaises(ValidationError) as cm:
validator.validate('from-my-custom-list')
self.assertEqual(cm.exception.messages, [expected_error])
+ self.assertEqual(cm.exception.error_list[0].code, 'password_too_common')
def test_help_text(self):
self.assertEqual(
@@ -154,6 +163,7 @@ class NumericPasswordValidatorTest(TestCase):
with self.assertRaises(ValidationError) as cm:
NumericPasswordValidator().validate('42424242')
self.assertEqual(cm.exception.messages, [expected_error])
+ self.assertEqual(cm.exception.error_list[0].code, 'password_entirely_numeric')
def test_help_text(self):
self.assertEqual(