django.git/django/contrib/auth/forms.py, branch main

Fixed #34643 -- Moved inputs beneath labels and errors in admin forms.

2026-02-27T12:43:45Z

Thanks Sarah Boyce and Jacob Walls for reviews. Co-authored-by: Hrushikesh Vaidya

Refs #31223 -- Added __class_getitem__() to SetPasswordMixin.

2025-10-14T12:13:52Z

Fixed #35959 -- Displayed password reset button in admin only when user has sufficient permissions.

2025-04-17T15:00:20Z

This change ensures that the "Reset password" button in the admin is shown only when the user has the necessary permission to perform a password change operation. It reuses the password hashing rendering logic in `display_for_field` to show the appropriate read-only widget for users with view-only access.

Refs #35959 -- Added render_password_as_hash auth template tag for password rendering.

2025-04-17T15:00:20Z

Fixed #36140 -- Allowed BaseUserCreationForm to define non required password fields.

2025-02-02T01:49:07Z

Regression in e626716c28b6286f8cf0f8174077f3d2244f3eb3. Thanks buffgecko12 for the report and Sarah Boyce for the review.

Fixed #36087 -- Supported password reset on a custom user model with a composite primary key.

2025-01-13T14:51:21Z

Refs #28215 -- Marked auth form passwords as sensitive variables.

2024-11-15T12:53:13Z

Fixed CVE-2024-45231 -- Avoided server error on password reset when email sending fails.

2024-09-03T12:22:32Z

On successful submission of a password reset request, an email is sent to the accounts known to the system. If sending this email fails (due to email backend misconfiguration, service provider outage, network issues, etc.), an attacker might exploit this by detecting which password reset requests succeed and which ones generate a 500 error response. Thanks to Thibaut Spriet for the report, and to Mariusz Felisiak, Adam Johnson, and Sarah Boyce for the reviews.

Fixed #35678 -- Removed "usable_password" field from BaseUserCreationForm.

2024-08-19T15:39:57Z

Refs #34429: Following the implementation allowing the setting of unusable passwords via the admin site, the `BaseUserCreationForm` and `UserCreationForm` were extended to include a new field for choosing whether password-based authentication for the new user should be enabled or disabled at creation time. Given that these forms are designed to be extended when implementing custom user models, this branch ensures that this new field is moved to a new, admin-dedicated, user creation form `AdminUserCreationForm`. Regression in e626716c28b6286f8cf0f8174077f3d2244f3eb3. Thanks Simon Willison for the report, Fabian Braun and Sarah Boyce for the review.

Fixed #35477 -- Corrected 'required' errors in auth password set/change forms.

2024-05-30T19:31:01Z

The auth forms using SetPasswordMixin were incorrectly including the 'This field is required.' error when additional validations (e.g., overriding `clean_password1`) were performed and failed. This fix ensures accurate error reporting for password fields. Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>