1
0
Fork 0
mirror of https://github.com/retspen/webvirtcloud synced 2026-11-08 19:26:48 +00:00
webvirtcloud/admin
catborise 6dabd69445 fix(accounts): first-login password change is stored, not in the session
The forced change of the generated admin password was a session flag
set at login when the password still matched data/admin_password. A
new session after the file was gone bypassed it.

- UserAttributes.must_change_password (migration 0007) holds it; the
  admin created with a generated password gets it, and a password
  change clears it. ForcePasswordChangeMiddleware reads it.
- A system check (accounts.E001) stops the server unless the middleware
  follows AuthenticationMiddleware; the README has the settings change.
- If the generated password cannot be stored privately, provisioning
  stops without printing it and without creating the admin (one
  transaction for the user and its attributes).
- The admin is provisioned on any real migrate run while no user
  exists, so running migrate again after a failure creates it; flush
  (plan=None) and rollbacks of accounts are skipped.
- The post_migrate receivers check the migration state for the models
  they use, so a targeted migrate on a fresh database (e.g. migrate
  appsettings) no longer fails with 'no such table'.
2026-10-04 01:08:11 +03:00
..
migrations Added Technicians group 2022-06-14 15:10:33 +02:00
templates/admin fix: require POST for user block/unblock and OTP email, flag console cookie 2026-10-02 22:44:00 +03:00
__init__.py fix typo error 2022-09-05 15:36:37 +03:00
apps.py format python code with black 2022-11-02 08:54:35 +03:00
decorators.py feat(security): apply Codex review hardening to console tokens and superuser authorization 2026-09-27 11:30:03 +03:00
forms.py fix(accounts): first-login password change is stored, not in the session 2026-10-04 01:08:11 +03:00
models.py format python code with black 2022-11-02 08:54:35 +03:00
permissions.py feat(security): apply Codex review hardening to console tokens and superuser authorization 2026-09-27 11:30:03 +03:00
tests.py fix: require POST for user block/unblock and OTP email, flag console cookie 2026-10-02 22:44:00 +03:00
urls.py format python code with black 2022-11-02 08:54:35 +03:00
views.py fix: require POST for user block/unblock and OTP email, flag console cookie 2026-10-02 22:44:00 +03:00