1
0
Fork 0
mirror of https://github.com/retspen/webvirtcloud synced 2026-11-08 19:26:48 +00:00
webvirtcloud/admin
catborise 99dabbdcec fix(accounts): migrate no longer overrides the change-password permission
SHOW_PROFILE_EDIT_PASSWORD was replaced in 2020 by the change_password
permission, settable per user or group. A post_migrate hook applied the
old setting to all users so existing installs kept their behavior, and
asked to remove the setting afterwards; but the settings template still
set it to True. Every migrate, so every upgrade, therefore granted the
permission to all users again and undid an admin's per-user or
per-group choice (with False it would have revoked it from everyone).

- Migration accounts.0008 applies the setting one last time, if a
  settings.py still has it; the post_migrate hook is gone.
- New users get the permission when they are created (any path,
  including LDAP); the admin user form ticks it and saves the admin's
  choice afterwards.
- The template no longer sets SHOW_PROFILE_EDIT_PASSWORD; a check
  (accounts.W001) asks to remove it from existing settings, and the
  README upgrade notes say so.

The test that removes the permission and runs migrate fails on the
previous code. An upgrade from master with users was simulated: the
setting is applied once, and a permission removed afterwards stays
removed through the next migrate.
2026-10-04 20:26:53 +03:00
..
migrations ci: replace super-linter with ruff 2026-10-04 01:08:11 +03:00
templates/admin fix: require POST for user block/unblock and OTP email, flag console cookie 2026-10-02 22:44:00 +03:00
__init__.py fix typo error 2022-09-05 15:36:37 +03:00
apps.py format python code with black 2022-11-02 08:54:35 +03:00
decorators.py feat(security): apply Codex review hardening to console tokens and superuser authorization 2026-09-27 11:30:03 +03:00
forms.py fix(accounts): migrate no longer overrides the change-password permission 2026-10-04 20:26:53 +03:00
models.py format python code with black 2022-11-02 08:54:35 +03:00
permissions.py feat(security): apply Codex review hardening to console tokens and superuser authorization 2026-09-27 11:30:03 +03:00
tests.py fix: require POST for user block/unblock and OTP email, flag console cookie 2026-10-02 22:44:00 +03:00
urls.py format python code with black 2022-11-02 08:54:35 +03:00
views.py fix: require POST for user block/unblock and OTP email, flag console cookie 2026-10-02 22:44:00 +03:00