| Age | Commit message (Collapse) | Author |
|---|
|
tests/auth_tests/test_handlers.py.
Backport of d08ae991a83950aba5043f5a34f5af12d2effe9e from main.
|
|
Backport of d0c8f89c942d1379724bdd37127076d13452f71d from main.
|
|
Regression in f02b49d2f3bf84f5225de920ca510149f1f9f1da.
Co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>
|
|
|
|
|
|
|
|
contrib.auth.alogout().
|
|
- Changed EmailMessage.message() to construct a "modern email API"
email.message.EmailMessage and added policy keyword arg.
- Added support for modern MIMEPart objects in EmailMessage.attach()
(and EmailMessage constructor, EmailMessage.attachments list).
- Updated SMTP EmailBackend to use modern email.policy.SMTP.
Deprecated:
- Attaching MIMEBase objects (replace with MIMEPart)
- BadHeaderError (modern email uses ValueError)
- SafeMIMEText, SafeMIMEMultipart (unnecessary for modern email)
- django.core.mail.forbid_multi_line_headers()
(undocumented, but exposed via `__all__` and in wide use)
- django.core.mail.message.sanitize_address()
(undocumented, but in wide use)
Removed without deprecation (all undocumented):
- EmailMessage.mixed_subtype
- EmailMultiAlternatives.alternative_subtype
- Support for setting (undocumented) EmailMessage.encoding property
to a legacy email.charset.Charset object
Related changes:
- Dropped tests for incorrect RFC 2047 encoding of non-ASCII email
address localparts. This is specifically prohibited by RFC 2047, and
not supported by any known MTA or email client. (Python still
mis-applies encoded-word to non-ASCII localparts, but it is a bug that
may be fixed in the future.)
- Added tests that try to discourage using Python's legacy email APIs
in future updates to django.core.mail.
|
|
Rewrapped long docstrings and block comments to 79 characters + newline
using script from https://github.com/medmunds/autofix-w505.
|
|
|
|
Co-authored-by: Screamadelica <1621456391@sjtu.edu.cn>
|
|
In public mail APIs, changed less frequently used parameters from
keyword-or-positional to keyword-only, emitting a warning during the
required deprecation period.
|
|
aprocess_request().
Regression in 50f89ae850f6b4e35819fe725a08c7e579bfd099.
Thank you to shamoon for the report and Natalia Bidart for the review.
|
|
sufficient permissions.
This change ensures that the "Reset password" button in the admin is
shown only when the user has the necessary permission to perform a
password change operation. It reuses the password hashing rendering
logic in `display_for_field` to show the appropriate read-only widget
for users with view-only access.
|
|
rendering.
|
|
Regression in ec7d69035a408b357f1803ca05a7c991cc358cfa.
Thank you Gabriel Trouvé for the report and Claude Paroz for the review.
|
|
|
|
https://github.com/psf/black/releases/tag/25.1.0
|
|
auth/common-passwords.txt.gz.
|
|
datetime.UTC was added in Python 3.11.
|
|
fields.
Regression in e626716c28b6286f8cf0f8174077f3d2244f3eb3.
Thanks buffgecko12 for the report and Sarah Boyce for the review.
|
|
|
|
composite primary key.
|
|
|
|
|
|
unavailable.
Thanks Mariusz Felisiak and Jacob Tyler Walls for reviews.
|
|
|
|
asyncio.iscoroutinefunction().
Fixes DeprecationWarning:
'asyncio.iscoroutinefunction' is deprecated and slated for removal in
Python 3.16; use inspect.iscoroutinefunction() instead.
|
|
HttpResponse.text property.
Signed-off-by: SaJH <wogur981208@gmail.com>
|
|
|
|
|
|
sending fails.
On successful submission of a password reset request, an email is sent
to the accounts known to the system. If sending this email fails (due to
email backend misconfiguration, service provider outage, network issues,
etc.), an attacker might exploit this by detecting which password reset
requests succeed and which ones generate a 500 error response.
Thanks to Thibaut Spriet for the report, and to Mariusz Felisiak, Adam
Johnson, and Sarah Boyce for the reviews.
|
|
This improves the screen reader experience.
|
|
|
|
Refs #34429: Following the implementation allowing the setting of
unusable passwords via the admin site, the `BaseUserCreationForm` and
`UserCreationForm` were extended to include a new field for choosing
whether password-based authentication for the new user should be enabled
or disabled at creation time.
Given that these forms are designed to be extended when implementing
custom user models, this branch ensures that this new field is moved to
a new, admin-dedicated, user creation form `AdminUserCreationForm`.
Regression in e626716c28b6286f8cf0f8174077f3d2244f3eb3.
Thanks Simon Willison for the report, Fabian Braun and Sarah Boyce for
the review.
|
|
model.
This work also allows to subclass BaseUserCreationFormTest to reuse the
tests and assertions for testing forms that extend BaseUserCreationForm,
which is now used for UserCreationFormTest, increasing its coverage.
|
|
|
|
unusable passwords.
This is a follow up for the fix of CVE-2024-39329
(5d8645857936c142a3973694799c52165e2bdcdb) where the timing of
verify_password() was standardized when checking unusable passwords.
|
|
checking unusuable passwords.
Refs #20760.
Thanks Michael Manfre for the fix and to Adam Johnson for the review.
|
|
|
|
|
|
The auth forms using SetPasswordMixin were incorrectly including the
'This field is required.' error when additional validations (e.g.,
overriding `clean_password1`) were performed and failed.
This fix ensures accurate error reporting for password fields.
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
|
|
|
|
Co-authored-by: Adam Johnson <me@adamj.eu>
Co-authored-by: Mehmet İnce <mehmet@mehmetince.net>
Co-authored-by: Sarah Boyce <42296566+sarahboyce@users.noreply.github.com>
|
|
|
|
co-authored-by: Mariusz Felisiak <felisiak.mariusz@gmail.com>
|
|
the reset password link with a button.
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
|
|
functions.
|
|
|
|
Co-authored-by: Natalia <124304+nessita@users.noreply.github.com>
|
