mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 11:16:47 +00:00
3210ef2eee
Django's login form gives the username its max_length after the field is built, so a longer username was not refused and reached authentication. django-axes then stored it in its 255-character column, which PostgreSQL refuses: a login with a 300-character username was a 500 (SQLite does not enforce the length). Both login forms, with and without OTP, now check the length, so such a username is a form error and never reaches authentication, the lockout or the Logs page. This also turns the PostgreSQL leg of CI green again: the S-16 test from #167 hit exactly this.
45 lines
2.1 KiB
Python
45 lines
2.1 KiB
Python
"""The login form used when OTP_ENABLED.
|
|
|
|
django-otp's ``OTPAuthenticationForm`` requires every user to present a token
|
|
and, since 1.6, to name the device explicitly, so the single-field login page
|
|
cannot satisfy it and a user who never enrolled is locked out. This form makes
|
|
OTP per user: a user with a confirmed TOTP device must enter a valid code, one
|
|
without a device logs in with the password alone. The device is chosen by the
|
|
server, so the page needs only the token field and a posted device id (which
|
|
django-otp does not check for confirmed status or ownership-by-type) is
|
|
ignored.
|
|
"""
|
|
|
|
from django.contrib.auth.signals import user_login_failed
|
|
from django.core.exceptions import ValidationError
|
|
from django_otp.forms import OTPAuthenticationForm
|
|
from django_otp.plugins.otp_totp.models import TOTPDevice
|
|
|
|
from accounts.forms import BoundedUsernameMixin
|
|
|
|
|
|
class SingleDeviceOTPForm(BoundedUsernameMixin, OTPAuthenticationForm):
|
|
def _confirmed_totp(self, user, for_verify=False):
|
|
"""The user's oldest confirmed TOTP device, or None. With for_verify
|
|
the row is locked (select_for_update) so the token's replay and
|
|
throttling counters cannot race; call it only inside clean_otp's
|
|
transaction."""
|
|
devices = TOTPDevice.objects.filter(user=user, confirmed=True)
|
|
if for_verify:
|
|
devices = devices.select_for_update()
|
|
return devices.order_by("id").first()
|
|
|
|
def _chosen_device(self, user):
|
|
# Ignore a posted otp_device: it is verified within clean_otp's
|
|
# transaction, where the lock belongs.
|
|
return self._confirmed_totp(user, for_verify=True)
|
|
|
|
def clean_otp(self, user):
|
|
if user is not None and self._confirmed_totp(user) is None:
|
|
return # no confirmed device: the password is the only factor
|
|
try:
|
|
return super().clean_otp(user)
|
|
except ValidationError:
|
|
# a wrong code is a failed login: counted by django-axes and logged
|
|
user_login_failed.send(sender=__name__, credentials={"username": user.get_username()}, request=self.request)
|
|
raise
|