mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-09 11:46:49 +00:00
78852eb4c8
While data/admin_password exists and a user's password still matches it, the login sets a session flag (checked once at login, not per request). ForcePasswordChangeMiddleware then sends that user to the password-change page for every view except change password, login and logout. Setting a new password clears the flag and deletes data/admin_password. No schema change; if ADMIN_PASSWORD was set, there is no file and nothing is forced.
21 lines
756 B
Python
21 lines
756 B
Python
from django.shortcuts import redirect
|
|
from django.urls import Resolver404, resolve
|
|
|
|
ALLOWED_VIEWS = {"accounts:change_password", "accounts:logout", "accounts:login"}
|
|
|
|
|
|
class ForcePasswordChangeMiddleware:
|
|
"""Send users who still have the generated admin password to the change form."""
|
|
|
|
def __init__(self, get_response):
|
|
self.get_response = get_response
|
|
|
|
def __call__(self, request):
|
|
if request.session.get("must_change_password"):
|
|
try:
|
|
view_name = resolve(request.path_info).view_name
|
|
except Resolver404:
|
|
view_name = None
|
|
if view_name not in ALLOWED_VIEWS:
|
|
return redirect("accounts:change_password")
|
|
return self.get_response(request)
|