From 0ccdb2adb70f234d1c1f93e01f71318d9b44a0f0 Mon Sep 17 00:00:00 2001 From: catborise Date: Fri, 6 Nov 2026 11:01:43 +0300 Subject: [PATCH] fix(settings): remove RemoteUserMiddleware, which no backend uses No RemoteUserBackend is configured, so the middleware never logged anyone in: it only ran on every request and read as if the panel trusted a REMOTE_USER header. --- webvirtcloud/settings.py.template | 1 - 1 file changed, 1 deletion(-) diff --git a/webvirtcloud/settings.py.template b/webvirtcloud/settings.py.template index 7d422e87..e2caadd7 100644 --- a/webvirtcloud/settings.py.template +++ b/webvirtcloud/settings.py.template @@ -99,7 +99,6 @@ MIDDLEWARE = [ "django_otp.middleware.OTPMiddleware", "django.contrib.auth.middleware.LoginRequiredMiddleware", "accounts.middleware.ForcePasswordChangeMiddleware", - "django.contrib.auth.middleware.RemoteUserMiddleware", "django.contrib.messages.middleware.MessageMiddleware", "django.middleware.clickjacking.XFrameOptionsMiddleware", "webvirtcloud.middleware.ContentSecurityPolicyMiddleware",