fix(settings): new passwords pass Django's password validators

AUTH_PASSWORD_VALIDATORS was unset, so the user forms and the password
change accepted any password, a one-letter one included. The template
now sets Django's four standard validators: at least 8 characters, not
a common password, not only digits, not like the user's name or e-mail.
The tests that set weak passwords use ones the validators accept.

accounts/tests/test_change_password_permission.py

@@ -55,7 +55,7 @@ class ChangePasswordPermissionTestCase(TestCase):
 
     def test_create_form_ticks_it_and_the_admin_choice_wins(self):
         self.assertIn(permission(), UserCreateForm().fields["user_permissions"].initial)
-        form = UserCreateForm(data={"username": "unticked", "password": "pw", "is_active": True, "role": "user"})
+        form = UserCreateForm(data={"username": "unticked", "password": "Kq7-panel-pass", "is_active": True, "role": "user"})
         self.assertTrue(form.is_valid(), form.errors)
         self.assertFalse(can_change(form.save()))
 

accounts/tests/test_views.py

@@ -98,8 +98,8 @@ class AccountsTestCase(TestCase):
             reverse("accounts:change_password"),
             {
                 "old_password": "wrongpass",
-                "new_password1": "newpw",
-                "new_password2": "newpw",
+                "new_password1": "Wvc-changed-9",
+                "new_password2": "Wvc-changed-9",
             },
         )
         self.assertEqual(response.status_code, 200)
@@ -108,15 +108,15 @@ class AccountsTestCase(TestCase):
             reverse("accounts:change_password"),
             {
                 "old_password": "test",
-                "new_password1": "newpw",
-                "new_password2": "newpw",
+                "new_password1": "Wvc-changed-9",
+                "new_password2": "Wvc-changed-9",
             },
         )
         self.assertRedirects(response, reverse("accounts:profile"))
 
         self.client.logout()
 
-        logged_in = self.client.login(request=RequestFactory().get("/"), username="test", password="newpw")
+        logged_in = self.client.login(request=RequestFactory().get("/"), username="test", password="Wvc-changed-9")
         self.assertTrue(logged_in)
 
     def test_user_instance_create_update_delete(self):

admin/tests/test_views.py

@@ -105,7 +105,7 @@ class AdminTestCase(TestCase):
             reverse("admin:user_create"),
             {
                 "username": "test",
-                "password": "test",
+                "password": "Wvc-created-9",
                 "role": "user",
                 "max_instances": 1,
                 "max_cpus": 1,

webvirtcloud/settings.py.template

@@ -177,6 +177,13 @@ AUTHENTICATION_BACKENDS = [
     #"django_auth_ldap.backend.LDAPBackend",
 ]
 
+AUTH_PASSWORD_VALIDATORS = [
+    {"NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator"},
+    {"NAME": "django.contrib.auth.password_validation.MinimumLengthValidator"},
+    {"NAME": "django.contrib.auth.password_validation.CommonPasswordValidator"},
+    {"NAME": "django.contrib.auth.password_validation.NumericPasswordValidator"},
+]
+
 LOGIN_URL = "/accounts/login/"
 
 # Tests create users by the thousand: a fast hash for them (manage.py test only)