mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-09 11:46:49 +00:00
0b5eb990ed
- The administrator's password form took "password-based authentication: Disabled" with "must change it at the next login": the change form asks for the old password, which the user then never had, so they could not get past it. That combination is refused, and an administrator cannot disable their own password. - A user who must change the password could still use the API with their tokens. A token is now refused until they change it, as the pages are. |
||
|---|---|---|
| .. | ||
| __init__.py | ||
| test_admin_email_otp.py | ||
| test_admin_password.py | ||
| test_api_tokens.py | ||
| test_audit_rows.py | ||
| test_change_password_permission.py | ||
| test_checks.py | ||
| test_email_otp.py | ||
| test_first_login_password.py | ||
| test_login_lockout.py | ||
| test_otp_login.py | ||
| test_security_fixes.py | ||
| test_utils.py | ||
| test_views.py | ||