Fixed #29628 -- Made createsuperuser validate password against username and required fields.

2 files changed, 88 insertions, 4 deletions

diff --git a/tests/auth_tests/models/custom_user.py b/tests/auth_tests/models/custom_user.py
index ad8b4c1212..a46f1d5a9c 100644
--- a/tests/auth_tests/models/custom_user.py
+++ b/tests/auth_tests/models/custom_user.py
@@ -9,7 +9,7 @@ from django.db import models
 # that every user provide a date of birth. This lets us test
 # changes in username datatype, and non-text required fields.
 class CustomUserManager(BaseUserManager):
-    def create_user(self, email, date_of_birth, password=None):
+    def create_user(self, email, date_of_birth, password=None, **fields):
         """
         Creates and saves a User with the given email and password.
         """
@@ -19,14 +19,15 @@ class CustomUserManager(BaseUserManager):
         user = self.model(
             email=self.normalize_email(email),
             date_of_birth=date_of_birth,
+            **fields
         )
 
         user.set_password(password)
         user.save(using=self._db)
         return user
 
-    def create_superuser(self, email, password, date_of_birth):
-        u = self.create_user(email, password=password, date_of_birth=date_of_birth)
+    def create_superuser(self, email, password, date_of_birth, **fields):
+        u = self.create_user(email, password=password, date_of_birth=date_of_birth, **fields)
         u.is_admin = True
         u.save(using=self._db)
         return u
@@ -37,11 +38,12 @@ class CustomUser(AbstractBaseUser):
     is_active = models.BooleanField(default=True)
     is_admin = models.BooleanField(default=False)
     date_of_birth = models.DateField()
+    first_name = models.CharField(max_length=50)
 
     custom_objects = CustomUserManager()
 
     USERNAME_FIELD = 'email'
-    REQUIRED_FIELDS = ['date_of_birth']
+    REQUIRED_FIELDS = ['date_of_birth', 'first_name']
 
     def __str__(self):
         return self.email
diff --git a/tests/auth_tests/test_management.py b/tests/auth_tests/test_management.py
index da0ec73626..0c9ad81f3f 100644
--- a/tests/auth_tests/test_management.py
+++ b/tests/auth_tests/test_management.py
@@ -29,6 +29,8 @@ MOCK_INPUT_KEY_TO_PROMPTS = {
     # @mock_inputs dict key: [expected prompt messages],
     'bypass': ['Bypass password validation and create user anyway? [y/N]: '],
     'email': ['Email address: '],
+    'date_of_birth': ['Date of birth: '],
+    'first_name': ['First name: '],
     'username': ['Username: ', lambda: "Username (leave blank to use '%s'): " % get_default_username()],
 }
 
@@ -327,6 +329,7 @@ class CreatesuperuserManagementCommandTestCase(TestCase):
             interactive=False,
             email="joe@somewhere.org",
             date_of_birth="1976-04-01",
+            first_name='Joe',
             stdout=new_io,
         )
         command_output = new_io.getvalue().strip()
@@ -552,6 +555,85 @@ class CreatesuperuserManagementCommandTestCase(TestCase):
 
         test(self)
 
+    @override_settings(AUTH_PASSWORD_VALIDATORS=[
+        {'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator'},
+    ])
+    def test_validate_password_against_username(self):
+        new_io = StringIO()
+        username = 'supremelycomplex'
+
+        def bad_then_good_password(index=[0]):
+            """Return username the first two times, then a valid password."""
+            index[0] += 1
+            if index[0] <= 2:
+                return username
+            return 'superduperunguessablepassword'
+
+        @mock_inputs({
+            'password': bad_then_good_password,
+            'username': username,
+            'email': '',
+            'bypass': 'n',
+        })
+        def test(self):
+            call_command(
+                'createsuperuser',
+                interactive=True,
+                stdin=MockTTY(),
+                stdout=new_io,
+                stderr=new_io,
+            )
+            self.assertEqual(
+                new_io.getvalue().strip(),
+                'The password is too similar to the username.\n'
+                'Superuser created successfully.'
+            )
+
+        test(self)
+
+    @override_settings(
+        AUTH_USER_MODEL='auth_tests.CustomUser',
+        AUTH_PASSWORD_VALIDATORS=[
+            {'NAME': 'django.contrib.auth.password_validation.UserAttributeSimilarityValidator'},
+        ]
+    )
+    def test_validate_password_against_required_fields(self):
+        new_io = StringIO()
+        username = 'josephine'
+
+        # Returns the username the first two times it's called, then a valid
+        # password.
+        def bad_then_good_password(index=[0]):
+            """Return username the first two times, then a valid password."""
+            index[0] += 1
+            if index[0] <= 2:
+                return username
+            return 'superduperunguessablepassword'
+
+        @mock_inputs({
+            'password': bad_then_good_password,
+            'username': username,
+            'first_name': 'josephine',
+            'date_of_birth': '1970-01-01',
+            'email': 'joey@example.com',
+            'bypass': 'n',
+        })
+        def test(self):
+            call_command(
+                'createsuperuser',
+                interactive=True,
+                stdin=MockTTY(),
+                stdout=new_io,
+                stderr=new_io,
+            )
+            self.assertEqual(
+                new_io.getvalue().strip(),
+                "The password is too similar to the first name.\n"
+                "Superuser created successfully."
+            )
+
+        test(self)
+
     def test_blank_username(self):
         """Creation fails if --username is blank."""
         new_io = StringIO()