mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 19:26:48 +00:00
6dabd69445
The forced change of the generated admin password was a session flag set at login when the password still matched data/admin_password. A new session after the file was gone bypassed it. - UserAttributes.must_change_password (migration 0007) holds it; the admin created with a generated password gets it, and a password change clears it. ForcePasswordChangeMiddleware reads it. - A system check (accounts.E001) stops the server unless the middleware follows AuthenticationMiddleware; the README has the settings change. - If the generated password cannot be stored privately, provisioning stops without printing it and without creating the admin (one transaction for the user and its attributes). - The admin is provisioned on any real migrate run while no user exists, so running migrate again after a failure creates it; flush (plan=None) and rollbacks of accounts are skipped. - The post_migrate receivers check the migration state for the models they use, so a targeted migrate on a fresh database (e.g. migrate appsettings) no longer fails with 'no such table'.
21 lines
817 B
Python
21 lines
817 B
Python
from django.conf import settings
|
|
from django.core.checks import Error, Tags, register
|
|
|
|
|
|
@register(Tags.security)
|
|
def password_change_middleware_check(app_configs, **kwargs):
|
|
middleware = list(settings.MIDDLEWARE)
|
|
required = "accounts.middleware.ForcePasswordChangeMiddleware"
|
|
authentication = "django.contrib.auth.middleware.AuthenticationMiddleware"
|
|
if required not in middleware or (
|
|
authentication in middleware
|
|
and middleware.index(required) < middleware.index(authentication)
|
|
):
|
|
return [
|
|
Error(
|
|
"ForcePasswordChangeMiddleware must follow AuthenticationMiddleware.",
|
|
hint=f"Add '{required}' to MIDDLEWARE in webvirtcloud/settings.py; see README.md.",
|
|
id="accounts.E001",
|
|
)
|
|
]
|
|
return []
|