catborise 6dabd69445 fix(accounts): first-login password change is stored, not in the session ... The forced change of the generated admin password was a session flag set at login when the password still matched data/admin_password. A new session after the file was gone bypassed it. - UserAttributes.must_change_password (migration 0007) holds it; the admin created with a generated password gets it, and a password change clears it. ForcePasswordChangeMiddleware reads it. - A system check (accounts.E001) stops the server unless the middleware follows AuthenticationMiddleware; the README has the settings change. - If the generated password cannot be stored privately, provisioning stops without printing it and without creating the admin (one transaction for the user and its attributes). - The admin is provisioned on any real migrate run while no user exists, so running migrate again after a failure creates it; flush (plan=None) and rollbacks of accounts are skipped. - The post_migrate receivers check the migration state for the models they use, so a targeted migrate on a fresh database (e.g. migrate appsettings) no longer fails with 'no such table'.		2026-10-04 01:08:11 +03:00
..
migrations	fix(accounts): first-login password change is stored, not in the session	2026-10-04 01:08:11 +03:00
templates	fix: require POST for user block/unblock and OTP email, flag console cookie	2026-10-02 22:44:00 +03:00
templatetags	lint with black python. convert f style strings to old one. some small fixes	2020-11-05 12:34:31 +03:00
__init__.py	Fixe migrations for new deployments	2020-05-28 18:19:25 +06:00
apps.py	fix(accounts): first-login password change is stored, not in the session	2026-10-04 01:08:11 +03:00
checks.py	fix(accounts): first-login password change is stored, not in the session	2026-10-04 01:08:11 +03:00
forms.py	format python code with black	2022-11-02 08:54:35 +03:00
middleware.py	fix(accounts): first-login password change is stored, not in the session	2026-10-04 01:08:11 +03:00
models.py	fix(accounts): first-login password change is stored, not in the session	2026-10-04 01:08:11 +03:00
test_admin_email_otp.py	fix: require POST for user block/unblock and OTP email, flag console cookie	2026-10-02 22:44:00 +03:00
test_admin_password.py	fix(accounts): first-login password change is stored, not in the session	2026-10-04 01:08:11 +03:00
test_first_login_password.py	fix(accounts): first-login password change is stored, not in the session	2026-10-04 01:08:11 +03:00
test_security_fixes.py	feat(security): enforce require_POST on power actions, prevent open redirects, and isolate instance permissions	2026-09-27 13:20:45 +03:00
test_utils.py	test: expand unit test coverage across admin, accounts, vrtManager, logs, appsettings, and datasource	2026-09-25 11:26:53 +03:00
tests.py	fix(tests): decouple tests from local libvirt, support configurable test host, and fix URL/logging bugs	2026-09-25 11:51:45 +03:00
urls.py	fix(tests): decouple tests from local libvirt, support configurable test host, and fix URL/logging bugs	2026-09-25 11:51:45 +03:00
utils.py	feat(security): enforce require_POST on power actions, prevent open redirects, and isolate instance permissions	2026-09-27 13:20:45 +03:00
views.py	fix(accounts): first-login password change is stored, not in the session	2026-10-04 01:08:11 +03:00