catborise 0b5eb990ed fix(admin): a forced password change cannot trap a user or be skipped with a token ... - The administrator's password form took "password-based authentication: Disabled" with "must change it at the next login": the change form asks for the old password, which the user then never had, so they could not get past it. That combination is refused, and an administrator cannot disable their own password. - A user who must change the password could still use the API with their tokens. A token is now refused until they change it, as the pages are.		2026-10-26 10:12:53 +03:00
..
migrations	ci: replace super-linter with ruff	2026-10-04 01:08:11 +03:00
templates/admin	fix(templates): the list pages search their rows as text, with one script	2026-10-25 23:08:42 +03:00
tests	fix(admin): a forced password change cannot trap a user or be skipped with a token	2026-10-26 10:12:53 +03:00
__init__.py	fix typo error	2022-09-05 15:36:37 +03:00
apps.py	format python code with black	2022-11-02 08:54:35 +03:00
decorators.py	feat(security): apply Codex review hardening to console tokens and superuser authorization	2026-09-27 11:30:03 +03:00
forms.py	fix(admin): a forced password change cannot trap a user or be skipped with a token	2026-10-26 10:12:53 +03:00
models.py	format python code with black	2022-11-02 08:54:35 +03:00
permissions.py	feat(security): apply Codex review hardening to console tokens and superuser authorization	2026-09-27 11:30:03 +03:00
urls.py	feat(admin): the Logs page searches every row, shows failures and downloads them	2026-10-25 23:08:42 +03:00
views.py	fix(admin): a forced password change cannot trap a user or be skipped with a token	2026-10-26 10:12:53 +03:00