mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-09 11:46:49 +00:00
3210ef2eee
Django's login form gives the username its max_length after the field is built, so a longer username was not refused and reached authentication. django-axes then stored it in its 255-character column, which PostgreSQL refuses: a login with a 300-character username was a 500 (SQLite does not enforce the length). Both login forms, with and without OTP, now check the length, so such a username is a form error and never reaches authentication, the lockout or the Logs page. This also turns the PostgreSQL leg of CI green again: the S-16 test from #167 hit exactly this.
57 lines
1.8 KiB
Python
57 lines
1.8 KiB
Python
from django.conf import settings
|
|
from django.contrib.auth.views import LoginView, LogoutView
|
|
from django.urls import path
|
|
|
|
from . import views
|
|
from .forms import LoginForm
|
|
from .otp import SingleDeviceOTPForm
|
|
|
|
app_name = "accounts"
|
|
|
|
urlpatterns = [
|
|
path("logout/", LogoutView.as_view(template_name="logout.html"), name="logout"),
|
|
path("profile/", views.profile, name="profile"),
|
|
path("profile/<int:user_id>/", views.account, name="account"),
|
|
path("change_password/", views.change_password, name="change_password"),
|
|
path(
|
|
"user_instance/create/<int:user_id>/",
|
|
views.user_instance_create,
|
|
name="user_instance_create",
|
|
),
|
|
path(
|
|
"user_instance/<int:pk>/update/",
|
|
views.user_instance_update,
|
|
name="user_instance_update",
|
|
),
|
|
path(
|
|
"user_instance/<int:pk>/delete/",
|
|
views.user_instance_delete,
|
|
name="user_instance_delete",
|
|
),
|
|
path("ssh_key/create/", views.ssh_key_create, name="ssh_key_create"),
|
|
path("ssh_key/<int:pk>/delete/", views.ssh_key_delete, name="ssh_key_delete"),
|
|
path("email_otp/", views.email_otp, name="email_otp"),
|
|
path(
|
|
"admin_email_otp/<int:user_id>/",
|
|
views.admin_email_otp,
|
|
name="admin_email_otp",
|
|
),
|
|
]
|
|
|
|
if settings.OTP_ENABLED:
|
|
urlpatterns += [
|
|
path(
|
|
"login/",
|
|
LoginView.as_view(
|
|
template_name="accounts/otp_login.html",
|
|
authentication_form=SingleDeviceOTPForm,
|
|
redirect_authenticated_user=True,
|
|
),
|
|
name="login",
|
|
),
|
|
]
|
|
else:
|
|
urlpatterns += (
|
|
path("login/", LoginView.as_view(template_name="login.html", authentication_form=LoginForm,
|
|
redirect_authenticated_user=True), name="login"),
|
|
)
|