django.git/django/contrib/auth/views.py, branch stable/5.2.x

Fixed #36087 -- Supported password reset on a custom user model with a composite primary key.

2025-01-13T14:51:21Z

Fixed 35467 -- Replaced urlparse with urlsplit where appropriate.

2024-05-29T13:48:27Z

This work should not generate any change of functionality, and `urlsplit` is approximately 6x faster. Most use cases of `urlparse` didn't touch the path, so they can be converted to `urlsplit` without any issue. Most of those which do use `.path`, simply parse the URL, mutate the querystring, then put them back together, which is also fine (so long as urlunsplit is used).

Fixed #31405 -- Added LoginRequiredMiddleware.

2024-05-22T06:51:17Z

Co-authored-by: Adam Johnson Co-authored-by: Mehmet İnce Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>

Refs #15619 -- Removed support for logging out via GET requests.

2023-01-17T10:49:15Z

Per deprecation timeline.

Refactored out RedirectURLMixin.get_success_url().

2022-04-20T08:04:29Z

This also adds a default implementation of get_default_redirect_url().

Simplified LogoutView.get_success_url().

2022-04-20T08:04:29Z

This preserves the behavior of redirecting to the logout URL without query string parameters when an insecure ?next=... parameter is given. It changes the behavior of a POST to the logout URL, as shown by the test that is changed. Currently, this results in a GET to the logout URL. However, such GET requests are deprecated. This change would be necessary in Django 5.0 anyway. This commit merely anticipates it.

Unified LoginView/LogoutView.get_default_redirect_url() methods.

2022-04-20T08:04:29Z

This might change the behavior when self.next_page == "". However, resolve_url(self.next_page) would almost certainly fail in that case. It is technically possible to define a logout URLpattern whose name is "": path('logout/', LogoutView.as_view(), name=''), and then to refer to this pattern with next_page = "". However this feels like a pathological case, so we decided not to handle it. Most checks on next_page, LOGIN_REDIRECT_URL, and LOGOUT_REDIRECT_URL are performed with boolean evaluation rather than comparison with None. That's why we standardizing that way.

Renamed LogoutView.get_next_page() to get_success_url().

2022-04-20T08:04:29Z

This aligns it with LoginView. Also, it removes confusion with the get_next_page() method of paginators. get_next_page() was a private API, therefore this refactoring is allowed.

Refactored out RedirectURLMixin.get_redirect_url().

2022-04-20T08:04:29Z

This also renames SuccessURLAllowedHostsMixin to RedirectURLMixin. This doesn't change the behavior of LogoutView.get_next_page() because next_page == "" implies url_is_safe == False before the refactoring.

Removed unnecessary default argument from GET.get() call in LoginView.get_redirect_url().

2022-04-19T04:25:38Z

The default argument is unnecessary because url_has_allowed_host_and_scheme() returns False when its first argument is "" or None, so get_redirect_url() still returns "". This also aligns LoginView.get_redirect_url() and LogoutView.get_next_page().