catborise c2fea2aa39 feat(accounts): failed logins lock a user for the address they come from ... Nothing limited failed logins: a password could be guessed at the speed the server answers. django-axes (8.3.1, Django 5.2, Python 3.10-3.13) now counts them. - A user is locked for the address the failed logins come from (username and IP together), so an attacker cannot lock someone out from elsewhere and users behind one NAT address do not share a lock. A successful login resets the count. axes sits in front of every authentication: the login page with or without OTP, LDAP and the API. - The number of failed logins (default 5) and the lock time in minutes (default 15) are on the Settings page (LOGIN_FAILURE_LIMIT, LOGIN_LOCKOUT_MINUTES, added by migration appsettings.0014) and apply at once; an invalid value falls back to the default. Unlock with "manage.py axes_reset_username <username>". - Behind the bundled nginx every request comes from 127.0.0.1; the client address is read from X-Real-IP, which nginx sets, but only for requests from a loopback address or from LOGIN_TRUSTED_PROXIES, so a forged header does not escape a lock. settings.py.template gets the app, middleware, backend and AXES_* settings; README tells existing installations what to copy. Tests that call client.login now pass a request, which the axes backend needs. The new tests fail with axes disabled.		2026-10-06 11:05:03 +03:00
..
0001_initial.py	edit choices field length	2020-09-21 16:22:44 +04:00
0002_auto_20200527_1603.py	replaced ugettext_lazy with gettext_lazy	2020-10-14 18:27:57 +06:00
0003_auto_20200615_0637.py	edit choices field length	2020-09-21 16:22:44 +04:00
0004_auto_20200716_0637.py	replaced ugettext_lazy with gettext_lazy	2020-10-14 18:27:57 +06:00
0005_auto_20200911_1233.py	change choices size from 50 to 70	2020-09-11 15:35:32 +03:00
0006_auto_20220630_0717.py	fix identation	2022-09-05 15:38:00 +03:00
0007_auto_20220905_0918.py	ci: replace super-linter with ruff	2026-10-04 01:08:11 +03:00
0008_auto_20220905_1459.py	make adding cd-rom optional while vm creating. Add default value for cd-rom bus	2022-09-07 13:46:50 +03:00
0009_alter_appsettings_id.py	Global setting for NIC type	2023-11-01 18:08:38 -04:00
0010_auto_20231030_1305.py	Global setting for NIC type	2023-11-01 18:08:38 -04:00
0011_alter_appsettings_id.py	if nic type is default then make it virtio	2024-02-28 08:16:44 +03:00
0012_remove_spice_qemu_console_type.py	feat(console): remove deprecated SPICE support in favor of noVNC	2026-09-26 22:43:40 +03:00
0013_remove_qemu_console_default_type.py	feat(console): VNC is the only console type	2026-10-04 01:08:11 +03:00
0014_login_lockout_settings.py	feat(accounts): failed logins lock a user for the address they come from	2026-10-06 11:05:03 +03:00
__init__.py	Add Settings page: Move theme & lang changer to settings page	2020-06-04 12:03:26 +03:00