From 5b2542c6edbc1a32f874a63b6f2453b1fc304cf4 Mon Sep 17 00:00:00 2001 From: catborise Date: Fri, 6 Nov 2026 11:01:43 +0300 Subject: [PATCH] fix(settings): new passwords pass Django's password validators AUTH_PASSWORD_VALIDATORS was unset, so the user forms and the password change accepted any password, a one-letter one included. The template now sets Django's four standard validators: at least 8 characters, not a common password, not only digits, not like the user's name or e-mail. The tests that set weak passwords use ones the validators accept. --- accounts/tests/test_change_password_permission.py | 2 +- accounts/tests/test_views.py | 10 +++++----- admin/tests/test_views.py | 2 +- webvirtcloud/settings.py.template | 7 +++++++ 4 files changed, 14 insertions(+), 7 deletions(-) diff --git a/accounts/tests/test_change_password_permission.py b/accounts/tests/test_change_password_permission.py index 4c40279a..fbce3e20 100644 --- a/accounts/tests/test_change_password_permission.py +++ b/accounts/tests/test_change_password_permission.py @@ -55,7 +55,7 @@ class ChangePasswordPermissionTestCase(TestCase): def test_create_form_ticks_it_and_the_admin_choice_wins(self): self.assertIn(permission(), UserCreateForm().fields["user_permissions"].initial) - form = UserCreateForm(data={"username": "unticked", "password": "pw", "is_active": True, "role": "user"}) + form = UserCreateForm(data={"username": "unticked", "password": "Kq7-panel-pass", "is_active": True, "role": "user"}) self.assertTrue(form.is_valid(), form.errors) self.assertFalse(can_change(form.save())) diff --git a/accounts/tests/test_views.py b/accounts/tests/test_views.py index 789395ae..ea78cf4c 100644 --- a/accounts/tests/test_views.py +++ b/accounts/tests/test_views.py @@ -98,8 +98,8 @@ class AccountsTestCase(TestCase): reverse("accounts:change_password"), { "old_password": "wrongpass", - "new_password1": "newpw", - "new_password2": "newpw", + "new_password1": "Wvc-changed-9", + "new_password2": "Wvc-changed-9", }, ) self.assertEqual(response.status_code, 200) @@ -108,15 +108,15 @@ class AccountsTestCase(TestCase): reverse("accounts:change_password"), { "old_password": "test", - "new_password1": "newpw", - "new_password2": "newpw", + "new_password1": "Wvc-changed-9", + "new_password2": "Wvc-changed-9", }, ) self.assertRedirects(response, reverse("accounts:profile")) self.client.logout() - logged_in = self.client.login(request=RequestFactory().get("/"), username="test", password="newpw") + logged_in = self.client.login(request=RequestFactory().get("/"), username="test", password="Wvc-changed-9") self.assertTrue(logged_in) def test_user_instance_create_update_delete(self): diff --git a/admin/tests/test_views.py b/admin/tests/test_views.py index 9100753c..cb87f869 100644 --- a/admin/tests/test_views.py +++ b/admin/tests/test_views.py @@ -105,7 +105,7 @@ class AdminTestCase(TestCase): reverse("admin:user_create"), { "username": "test", - "password": "test", + "password": "Wvc-created-9", "role": "user", "max_instances": 1, "max_cpus": 1, diff --git a/webvirtcloud/settings.py.template b/webvirtcloud/settings.py.template index e2caadd7..fb413924 100644 --- a/webvirtcloud/settings.py.template +++ b/webvirtcloud/settings.py.template @@ -177,6 +177,13 @@ AUTHENTICATION_BACKENDS = [ #"django_auth_ldap.backend.LDAPBackend", ] +AUTH_PASSWORD_VALIDATORS = [ + {"NAME": "django.contrib.auth.password_validation.UserAttributeSimilarityValidator"}, + {"NAME": "django.contrib.auth.password_validation.MinimumLengthValidator"}, + {"NAME": "django.contrib.auth.password_validation.CommonPasswordValidator"}, + {"NAME": "django.contrib.auth.password_validation.NumericPasswordValidator"}, +] + LOGIN_URL = "/accounts/login/" # Tests create users by the thousand: a fast hash for them (manage.py test only)