mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 19:26:48 +00:00
e94d69a524
django-login-required-middleware is dropped; Django 5.1+ ships the same middleware. The login page is already marked login_not_required by Django; email_otp gets the decorator, which replaces LOGIN_REQUIRED_IGNORE_VIEW_NAMES. The datasource still requires login. Existing settings.py files still name the old middleware. A system check (accounts.E002) stops migrate and the server until MIDDLEWARE uses Django's middleware, instead of an ImportError at startup; the README has the steps. A new matrix test walks every URL anonymously: everything outside a short allowlist (login pages, the OpenAPI docs) sends the visitor to the login page, and API views deny with 401/403. It passed with the old middleware first and passes unchanged now.
38 lines
1.5 KiB
Python
38 lines
1.5 KiB
Python
from django.conf import settings
|
|
from django.core.checks import Error, Tags, register
|
|
|
|
|
|
@register(Tags.security)
|
|
def password_change_middleware_check(app_configs, **kwargs):
|
|
middleware = list(settings.MIDDLEWARE)
|
|
required = "accounts.middleware.ForcePasswordChangeMiddleware"
|
|
authentication = "django.contrib.auth.middleware.AuthenticationMiddleware"
|
|
if required not in middleware or (
|
|
authentication in middleware
|
|
and middleware.index(required) < middleware.index(authentication)
|
|
):
|
|
return [
|
|
Error(
|
|
"ForcePasswordChangeMiddleware must follow AuthenticationMiddleware.",
|
|
hint=f"Add '{required}' to MIDDLEWARE in webvirtcloud/settings.py; see README.md.",
|
|
id="accounts.E001",
|
|
)
|
|
]
|
|
return []
|
|
|
|
|
|
@register(Tags.security)
|
|
def login_required_middleware_check(app_configs, **kwargs):
|
|
middleware = list(settings.MIDDLEWARE)
|
|
required = "django.contrib.auth.middleware.LoginRequiredMiddleware"
|
|
old = "login_required.middleware.LoginRequiredMiddleware"
|
|
if old in middleware or required not in middleware:
|
|
return [
|
|
Error(
|
|
"MIDDLEWARE must use Django's LoginRequiredMiddleware.",
|
|
hint=f"In webvirtcloud/settings.py replace '{old}' with '{required}' "
|
|
"and delete LOGIN_REQUIRED_IGNORE_VIEW_NAMES; see README.md.",
|
|
id="accounts.E002",
|
|
)
|
|
]
|
|
return []
|