mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 19:26:48 +00:00
405e6f1445
The admin page that creates a user saved the form first, which wrote the user with the raw password in the password column, and hashed it with a second save afterwards. The raw password was in the database, and in its journal and any copy taken meanwhile, and stayed there if anything failed between the two writes. - UserCreateForm hashes the password before the first save; groups and permissions are saved as before. - The form applies AUTH_PASSWORD_VALIDATORS, after the user fields are set (so the similarity check sees the new username), as the password change forms already did. The settings template configures no validators, so nothing changes unless an installation sets them. The tests record the SQL parameters of the request: the previous code wrote the raw password in the INSERT; it also accepted passwords that configured validators reject.
147 lines
4.5 KiB
Python
147 lines
4.5 KiB
Python
from django import forms
|
|
from django.contrib.auth import password_validation
|
|
from django.contrib.auth.forms import ReadOnlyPasswordHashField
|
|
from django.contrib.auth.models import Group, User
|
|
from django.core.exceptions import ValidationError
|
|
from django.urls import reverse_lazy
|
|
from django.utils.text import format_lazy
|
|
from django.utils.translation import gettext_lazy as _
|
|
|
|
from accounts.models import UserAttributes
|
|
|
|
from .models import Permission
|
|
|
|
|
|
class GroupForm(forms.ModelForm):
|
|
permissions = forms.ModelMultipleChoiceField(
|
|
widget=forms.CheckboxSelectMultiple,
|
|
queryset=Permission.objects.filter(content_type__model="permissionset"),
|
|
required=False,
|
|
)
|
|
|
|
users = forms.ModelMultipleChoiceField(
|
|
widget=forms.CheckboxSelectMultiple,
|
|
queryset=User.objects.all(),
|
|
required=False,
|
|
)
|
|
|
|
def __init__(self, *args, **kwargs):
|
|
super(GroupForm, self).__init__(*args, **kwargs)
|
|
instance = getattr(self, "instance", None)
|
|
if instance and instance.id:
|
|
self.fields["users"].initial = self.instance.user_set.all()
|
|
|
|
def save_m2m(self):
|
|
self.instance.user_set.set(self.cleaned_data["users"])
|
|
|
|
def save(self, *args, **kwargs):
|
|
instance = super(GroupForm, self).save()
|
|
self.save_m2m()
|
|
return instance
|
|
|
|
class Meta:
|
|
model = Group
|
|
fields = "__all__"
|
|
|
|
|
|
class UserForm(forms.ModelForm):
|
|
user_permissions = forms.ModelMultipleChoiceField(
|
|
widget=forms.CheckboxSelectMultiple,
|
|
queryset=Permission.objects.filter(content_type__model="permissionset"),
|
|
label=_("Permissions"),
|
|
required=False,
|
|
)
|
|
|
|
groups = forms.ModelMultipleChoiceField(
|
|
widget=forms.CheckboxSelectMultiple,
|
|
queryset=Group.objects.all(),
|
|
label=_("Groups"),
|
|
required=False,
|
|
)
|
|
|
|
class Meta:
|
|
model = User
|
|
fields = [
|
|
"username",
|
|
"groups",
|
|
"first_name",
|
|
"last_name",
|
|
"email",
|
|
"user_permissions",
|
|
"is_staff",
|
|
"is_active",
|
|
"is_superuser",
|
|
]
|
|
|
|
def __init__(self, *args, **kwargs):
|
|
super(UserForm, self).__init__(*args, **kwargs)
|
|
if self.instance.id:
|
|
password = ReadOnlyPasswordHashField(
|
|
label=_("Password"),
|
|
help_text=format_lazy(
|
|
_(
|
|
"""Raw passwords are not stored, so there is no way to see this user's password,
|
|
but you can change the password using <a href='{}'>this form</a>."""
|
|
),
|
|
reverse_lazy(
|
|
"admin:user_update_password",
|
|
args=[
|
|
self.instance.id,
|
|
],
|
|
),
|
|
),
|
|
)
|
|
self.fields["Password"] = password
|
|
|
|
|
|
class UserCreateForm(UserForm):
|
|
password = forms.CharField(widget=forms.PasswordInput)
|
|
|
|
def __init__(self, *args, **kwargs):
|
|
super().__init__(*args, **kwargs)
|
|
# New users may change their own password unless unticked here
|
|
self.fields["user_permissions"].initial = Permission.objects.filter(
|
|
content_type__app_label="accounts", codename="change_password"
|
|
)
|
|
|
|
def _post_clean(self):
|
|
# The validators in AUTH_PASSWORD_VALIDATORS, as on the password change
|
|
# forms; after the instance has the form's values (username, email).
|
|
super()._post_clean()
|
|
password = self.cleaned_data.get("password")
|
|
if password:
|
|
try:
|
|
password_validation.validate_password(password, self.instance)
|
|
except ValidationError as error:
|
|
self.add_error("password", error)
|
|
|
|
def save(self, commit=True):
|
|
# hashed before the user is first written: the raw password never
|
|
# reaches the database
|
|
user = super().save(commit=False)
|
|
user.set_password(self.cleaned_data["password"])
|
|
if commit:
|
|
user.save()
|
|
self.save_m2m()
|
|
return user
|
|
|
|
class Meta:
|
|
model = User
|
|
fields = [
|
|
"username",
|
|
"password",
|
|
"groups",
|
|
"first_name",
|
|
"last_name",
|
|
"email",
|
|
"user_permissions",
|
|
"is_staff",
|
|
"is_active",
|
|
"is_superuser",
|
|
]
|
|
|
|
|
|
class UserAttributesForm(forms.ModelForm):
|
|
class Meta:
|
|
model = UserAttributes
|
|
exclude = ["user", "can_clone_instances", "must_change_password"]
|