catborise 21bd56a9f9 fix(accounts): an admin still on the password "admin" must change it ... Every upstream release and this fork's up to v2.0.0 created the first user as admin/admin. The first-login password change only covered the password the panel generates itself (data/admin_password), so an upgraded installation whose admin never changed the default kept a working admin/admin login with no prompt, on the pages and through API tokens. Migration accounts.0013 marks a user named admin whose password is "admin" with must_change_password: the next login goes to the password change form, and the API refuses the user's tokens until then. Only that one name is checked, so the migration hashes one password at most. Found by upgrading an installation of the upstream release of September 2026 (installer and Docker) to this version: admin/admin still signed in.		2026-11-06 15:20:35 +03:00
..
0001_initial.py	lint with black python. convert f style strings to old one. some small fixes	2020-11-05 12:34:31 +03:00
0002_permissionset.py	Fixe migrations for new deployments	2020-05-28 18:19:25 +06:00
0003_auto_20200604_0930.py	Add all settings to appsettings page & Convert settings choices	2020-06-04 12:32:00 +03:00
0004_auto_20200615_0637.py	Added missing migrations	2020-06-15 12:38:44 +06:00
0005_auto_20200616_1039.py	Reworked some account views	2020-06-16 18:35:08 +06:00
0006_alter_userattributes_id_alter_userinstance_id_and_more.py	feat(security): enforce require_POST on power actions, prevent open redirects, and isolate instance permissions	2026-09-27 13:20:45 +03:00
0007_userattributes_must_change_password.py	fix(accounts): first-login password change is stored, not in the session	2026-10-04 01:08:11 +03:00
0008_apply_show_profile_edit_password_once.py	fix(accounts): migrate no longer overrides the change-password permission	2026-10-04 20:26:53 +03:00
0009_api_token.py	feat(accounts): API tokens for scripts and tools	2026-10-24 23:14:27 +03:00
0010_api_token_last_used.py	feat(accounts): API tokens show their last use, and a user has at most ten	2026-10-25 10:16:52 +03:00
0011_quota_help.py	fix(admin): the Users pages keep an administrator in and say what their fields mean	2026-10-25 22:38:40 +03:00
0012_user_instance_constraint.py	refactor(accounts): UserInstance's uniqueness is a UniqueConstraint	2026-11-06 13:46:27 +03:00
0013_default_admin_password.py	fix(accounts): an admin still on the password "admin" must change it	2026-11-06 15:20:35 +03:00
__init__.py	Refactor users page	2015-03-18 17:13:44 +02:00