Admin app should not allow username discovery

The admin app login form should not allow users to discover the username
associated with an email address.
This commit is contained in:
Thomas Sutton 2012-08-20 11:17:26 +08:00 committed by Russell Keith-Magee
parent d088b3af58
commit 75118bd242
1 changed files with 1 additions and 14 deletions

View File

@ -4,8 +4,7 @@ from django import forms
from django.contrib.auth import authenticate from django.contrib.auth import authenticate
from django.contrib.auth.forms import AuthenticationForm from django.contrib.auth.forms import AuthenticationForm
from django.contrib.auth import get_user_model from django.utils.translation import ugettext_lazy
from django.utils.translation import ugettext_lazy, ugettext as _
ERROR_MESSAGE = ugettext_lazy("Please enter the correct username and password " ERROR_MESSAGE = ugettext_lazy("Please enter the correct username and password "
"for a staff account. Note that both fields are case-sensitive.") "for a staff account. Note that both fields are case-sensitive.")
@ -27,18 +26,6 @@ class AdminAuthenticationForm(AuthenticationForm):
if username and password: if username and password:
self.user_cache = authenticate(username=username, password=password) self.user_cache = authenticate(username=username, password=password)
if self.user_cache is None: if self.user_cache is None:
if '@' in username:
# Mistakenly entered e-mail address instead of username? Look it up.
user_model = get_user_model()
try:
user = user_model.objects.get(email=username)
except (user_model.DoesNotExist, user_model.MultipleObjectsReturned):
# Nothing to do here, moving along.
pass
else:
if user.check_password(password):
message = _("Your e-mail address is not your username."
" Try '%s' instead.") % user.username
raise forms.ValidationError(message) raise forms.ValidationError(message)
elif not self.user_cache.is_active or not self.user_cache.is_staff: elif not self.user_cache.is_active or not self.user_cache.is_staff:
raise forms.ValidationError(message) raise forms.ValidationError(message)