def test_get_password_validators_custom(self):
validator_config = [{'NAME': 'django.contrib.auth.password_validation.CommonPasswordValidator'}]
validators = get_password_validators(validator_config)
self.assertEqual(len(validators), 1)
self.assertEqual(validators[0].__class__.__name__, 'CommonPasswordValidator')
self.assertEqual(get_password_validators([]), [])
class PreferencesForm(forms.Form):
language = forms.ChoiceField(label=_("language"),
initial="auto",
choices=User.languageList)
pagesize = forms.IntegerField(label=_('Page size'),
required=False,
initial=100)
theme = forms.ChoiceField(
label=_('Theme'),
required=False,
choices=[(i, capfirst(i)) for i in settings.THEMES],
)
cur_password = forms.CharField(
#. Translators: Translation included with Django
label=_("Change password"),
required=False,
#. Translators: Translation included with Django
help_text=_('Old password'),
widget=forms.PasswordInput())
new_password1 = forms.CharField(
label="",
required=False,
#. Translators: Translation included with Django
help_text=password_validators_help_text_html(
get_password_validators(settings.AUTH_PASSWORD_VALIDATORS)),
widget=forms.PasswordInput())
new_password2 = forms.CharField(
label="",
required=False,
#. Translators: Translation included with Django
help_text=_('New password confirmation'),
widget=forms.PasswordInput())
def __init__(self, *args, **kwargs):
super(PreferencesForm, self).__init__(*args, **kwargs)
if len(
settings.THEMES
) == 1: #If there is only one theme make this choice unavailable
self.fields.pop('theme')
def clean(self):
newdata = super(PreferencesForm, self).clean()
if newdata.get('pagesize', 0) > 10000:
raise forms.ValidationError("Maximum page size is 10000.")
if newdata.get('pagesize', 25) < 25:
raise forms.ValidationError("Minimum page size is 25.")
if newdata['cur_password']:
if not self.user.check_password(newdata['cur_password']):
#. Translators: Translation included with Django
raise forms.ValidationError(
_("Your old password was entered incorrectly. Please enter it again."
))
# Validate_password raises a ValidationError
validate_password(
newdata['new_password1'], self.user,
get_password_validators(settings.AUTH_PASSWORD_VALIDATORS))
if newdata['new_password1'] != newdata['new_password2']:
#. Translators: Translation included with Django
raise forms.ValidationError(
"The two password fields didn't match.")
def get_django_validators(self):
validator_config = [
{
"NAME":
"django.contrib.auth.password_validation"
".UserAttributeSimilarityValidator",
},
{
"NAME": "django.contrib.auth.password_validation"
".MinimumLengthValidator",
"OPTIONS": {
"min_length": PasswordField.MIN_LENGTH
},
},
{
"NAME":
"django.contrib.auth.password_validation"
".CommonPasswordValidator",
},
{
"NAME":
"django.contrib.auth.password_validation"
".NumericPasswordValidator",
},
]
return get_password_validators(validator_config)
def post(self, request, *args, **kwargs):
serializer = self.serializer_class(data=request.data)
serializer.is_valid(raise_exception=True)
password = serializer.validated_data['password']
token = serializer.validated_data['token']
# find token
reset_password_token = ResetPasswordToken.objects.filter(
key=token).first()
# change users password (if we got to this code it means that the user is_active)
if reset_password_token.user.eligible_for_reset():
pre_password_reset.send(sender=self.__class__,
user=reset_password_token.user)
try:
# validate the password against existing validators
validate_password(password,
user=reset_password_token.user,
password_validators=get_password_validators(
settings.AUTH_PASSWORD_VALIDATORS))
except ValidationError as e:
# raise a validation error for the serializer
raise exceptions.ValidationError({'password': e.messages})
reset_password_token.user.set_password(password)
reset_password_token.user.save()
post_password_reset.send(sender=self.__class__,
user=reset_password_token.user)
# Delete all password reset tokens for this user
ResetPasswordToken.objects.filter(
user=reset_password_token.user).delete()
return Response({'status': 'OK'})
class JoinTeamForm(forms.Form):
team_name = forms.CharField(max_length=64, help_text='Create or join this team. Team name may be changed later.')
team_password = forms.CharField(max_length=128,
widget=forms.PasswordInput,
help_text='Password to join the team.',
validators=[klass.validate for klass in get_password_validators(settings.AUTH_PASSWORD_VALIDATORS)]
)
def __init__(self, *args, **kwargs):
self.player = kwargs.pop('player', None)
super().__init__(*args, **kwargs)
def clean(self):
super().clean()
team_name = self.cleaned_data.get('team_name')
team_password = self.cleaned_data.get('team_password')
if team_name and team_password:
team = Team.objects.filter(name=team_name).first()
if team is not None:
if len(team.player_set.all()) >= settings.MAX_TEAM_SIZE:
raise forms.ValidationError('{} is full! Teams can have at most {} players.'.format(team_name, settings.MAX_TEAM_SIZE))
if not check_password(team_password, team.password):
raise forms.ValidationError('Incorrect password for existing team: {}'.format(team_name))
error_msg = 'You must <a class="alert-anchor" href="{}"><strong>appoint a new team captain</strong></a> before changing teams!'
if self.player is not None \
and self.player.team is not None \
and self.player.is_authenticated() \
and len(self.player.team.player_set.all()) > 1 \
and self.player.standing == Player.CAPTAIN:
raise forms.ValidationError(error_msg.format(reverse('team', args=[self.player.team.slug])))
def post(self, request, *args, **kwargs):
url_token = kwargs["token"]
try:
data = signing.TimestampSigner(salt="radiologo").unsign(url_token)
decoded = signing.b64_decode(data.encode())
pk = (struct.unpack(str("!i"), decoded[:4])[0], decoded[4:])[0]
except BadSignature:
raise BadInviteTokenException
user = get_object_or_404(get_user_model(), pk=pk)
invite = Invite.objects.get(invited_user=user)
self.check_different_token(url_token, invite.sent_token)
self.check_expired(invite)
self.check_accepted(invite)
password = request.data["password"]
validate_password(password, user=user,
password_validators=get_password_validators(settings.AUTH_PASSWORD_VALIDATORS))
user.set_password(password)
invite.accepted = True
user.is_registered = True
user.save()
invite.save()
return Response(status=status.HTTP_200_OK)
def update(self, request):
"""
TODO: Separate validations in own method
"""
old_password = request.data['old_password']
new_password1 = request.data['new_password1']
new_password2 = request.data['new_password2']
if not request.user.check_password(old_password):
raise serializers.ValidationError(
{"old_password": ["The old password is incorect."]})
if new_password1 != new_password2:
raise serializers.ValidationError(
{"new_password2": ["The passwords did not match."]})
try:
validate_password(new_password1,
user=request.user,
password_validators=get_password_validators(
settings.AUTH_PASSWORD_VALIDATORS))
except ValidationError as e:
raise exceptions.ValidationError({'new_password1': e.messages})
request.user.set_password(request.data['new_password1'])
request.user.save()
return Response({"message": "Password save successfully"},
status=status.HTTP_200_OK)
def post(self, request, *args, **kwargs):
serializer = self.serializer_class(data=request.data)
serializer.is_valid(raise_exception=True)
try:
invitation_token = request.data['invitation_token']
decoded_token = base64.urlsafe_b64decode(
invitation_token.encode()).decode()
invitation_token = get_object_or_404(InvitationToken,
id=decoded_token)
except Exception as e:
raise serializers.ValidationError(
{'detail': 'Invalid Invitation Token'})
try:
password = request.data['password']
validate_password(password,
user=invitation_token.user,
password_validators=get_password_validators(
settings.AUTH_PASSWORD_VALIDATORS))
invitation_token.user.set_password(password)
invitation_token.user.is_active = True
invitation_token.user.save()
InvitationToken.objects.filter(user=invitation_token.user).delete()
except ValidationError as e:
raise serializers.ValidationError({'detail': e.messages})
return Response({'detail': 'Password sucessfully created.'},
status=status.HTTP_201_CREATED)
def post(self, request, *args, **kwargs):
serializer = self.serializer_class(data=request.data)
serializer.is_valid(raise_exception=True)
password = serializer.validated_data['password']
token = serializer.validated_data['token']
response_dict = dict({"status_code": None, "message": None, "status": None})
# get token validation time
password_reset_token_validation_time = get_password_reset_token_expiry_time()
# find token
reset_password_token = ResetPasswordToken.objects.filter(key=token).first()
if reset_password_token is None:
message = get_response_message("TOKEN_NOT_FOUND")
response_dict.update({"status_code": 404, 'status': 'notfound', "message": message})
return Response(response_dict, status=status.HTTP_404_NOT_FOUND)
# check expiry date
expiry_date = reset_password_token.created_at + timedelta(hours=password_reset_token_validation_time)
if timezone.now() > expiry_date:
# delete expired token
reset_password_token.delete()
message = get_response_message("TOKEN_EXPIRED")
response_dict.update({"status_code": 404, 'status': 'expired', "message": message})
return Response(response_dict, status=status.HTTP_404_NOT_FOUND)
# change users password (if we got to this code it means that the user is_active)
if reset_password_token.user.eligible_for_reset():
pre_password_reset.send(sender=self.__class__, user=reset_password_token.user)
try:
# validate the password against existing validators
validate_password(
password,
user=reset_password_token.user,
password_validators=get_password_validators(settings.AUTH_PASSWORD_VALIDATORS)
)
except ValidationError as e:
# raise a validation error for the serializer
raise exceptions.ValidationError({
'password': e.messages
})
reset_password_token.user.set_password(password)
reset_password_token.user.save()
post_password_reset.send(sender=self.__class__, user=reset_password_token.user)
# Delete all password reset tokens for this user
ResetPasswordToken.objects.filter(user=reset_password_token.user).delete()
# done
message = get_response_message("PASSWORD_CHANGED")
response_dict.update({"status_code": 200, "status": "OK", "message": message})
return Response(response_dict)
def post(self, request, *args, **kwargs):
username = ''
try:
user = request.user
username = request.user.get_username()
new_password = request.data['new_password']
confirm_password = request.data['confirm_password']
# required password validator configuration
validator_config = [{
'NAME':
'django.contrib.auth.password_validation.MinimumLengthValidator',
'OPTIONS': {
'min_length': 8
}
}]
# check to see if password confirmation matches with new password
if new_password == confirm_password:
# gets password validators
validators = get_password_validators(validator_config)
# validates password (raises ValidationError if invalid)
validate_password(new_password,
user=user,
password_validators=validators)
# sets and saves new password for user
user.set_password(new_password)
user.save()
# log password change
activityLogger.info(
f'Password change: User "{username}" changed password.')
return Response(status=status.HTTP_200_OK)
else:
# log unsuccessful password change
activityLogger.info(
f'Failed password change: User "{username}" attempted to '
f'change their password but did not enter matching passwords.'
)
return Response(status=status.HTTP_400_BAD_REQUEST)
except AttributeError:
debugLogger.exception(f'User "{username}" password change failed.',
exc_info=True)
return Response(status=status.HTTP_400_BAD_REQUEST)
except KeyError:
debugLogger.exception(f'User "{username}" password change failed.',
exc_info=True)
return Response(status=status.HTTP_400_BAD_REQUEST)
except ValueError:
debugLogger.exception(f'User "{username}" password change failed.',
exc_info=True)
return Response(status=status.HTTP_400_BAD_REQUEST)
except ValidationError:
debugLogger.exception(f'User "{username}" password change failed.',
exc_info=True)
return Response(status=status.HTTP_400_BAD_REQUEST)
def is_password_valid(password1, password2):
if password1 != password2:
raise ValidationError(
{'password': '******'})
validate_password(password1,
password_validators=get_password_validators(
settings.AUTH_PASSWORD_VALIDATORS))
return True
def validate_pass(password):
"""
checks if the password is valid
"""
try:
validate_password(password,
get_password_validators(AUTH_PASSWORD_VALIDATORS))
except valerr:
return False
return True
def post(self, request, *args, **kwargs):
serializer = self.serializer_class(data=request.data)
serializer.is_valid(raise_exception=True)
password = serializer.validated_data['password']
password2 = serializer.validated_data['password2']
if password != password2:
raise serializers.ValidationError("Passwords must match")
token = serializer.validated_data['token']
# get token validation time
password_reset_token_validation_time = get_password_reset_token_expiry_time(
)
# find token
reset_password_token = ResetPasswordToken.objects.filter(
key=token).first()
if reset_password_token is None:
return Response({'status': 'notfound'},
status=status.HTTP_404_NOT_FOUND)
# check expiry date
expiry_date = reset_password_token.created_at + timedelta(
hours=password_reset_token_validation_time)
if timezone.now() > expiry_date:
# delete expired token
reset_password_token.delete()
return Response({'status': 'expired'},
status=status.HTTP_404_NOT_FOUND)
# change users password
if reset_password_token.user.has_usable_password():
pre_password_reset.send(sender=self.__class__,
user=reset_password_token.user)
try:
# validate the password against existing validators
validate_password(password,
user=reset_password_token.user,
password_validators=get_password_validators(
settings.AUTH_PASSWORD_VALIDATORS))
except ValidationError as e:
# raise a validation error for the serializer
raise exceptions.ValidationError({'password': e.messages})
reset_password_token.user.set_password(password)
reset_password_token.user.save()
post_password_reset.send(sender=self.__class__,
user=reset_password_token.user)
# Delete all password reset tokens for this user
ResetPasswordToken.objects.filter(
user=reset_password_token.user).delete()
return Response({'status': 'OK'})
def validate_password(self, user, password):
""" validate the password against the user and converts the Django ValidationError in a DRF ValidationError """
try:
# validate the password against existing validators
validate_password(password=password,
user=user,
password_validators=get_password_validators(
settings.AUTH_PASSWORD_VALIDATORS))
except ValidationError as e:
# raise a validation error for the serializer
raise exceptions.ValidationError({'password': e.messages})
def validate_password(self, value):
if len(get_password_validators(settings.AUTH_PASSWORD_VALIDATORS)) > 0:
try:
validate_password(value)
return value
except ValidationError as e:
raise BusinessException(
code=BusinessException.PASSWORD_VALIDATION_ERROR,
message="\n".join(e.messages))
else:
return value
def post(self, request, *args, **kwargs):
serializer = self.serializer_class(data=request.data)
serializer.is_valid(raise_exception=True)
password = serializer.validated_data["password"]
token = serializer.validated_data["token"]
# get token validation time
password_reset_token_validation_time = get_password_reset_token_expiry_time(
)
# find token
reset_password_token = ResetPasswordToken.objects.filter(
key=token).first()
if reset_password_token is None:
return Response({"status": "notfound"},
status=status.HTTP_404_NOT_FOUND)
# check expiry date
expiry_date = reset_password_token.created_at + timedelta(
hours=password_reset_token_validation_time)
if timezone.now() > expiry_date:
# delete expired token
reset_password_token.delete()
return Response({"status": "expired"},
status=status.HTTP_404_NOT_FOUND)
# change users password (if we got to this code it means that the user is_active)
if reset_password_token.user.eligible_for_reset():
pre_password_reset.send(sender=self.__class__,
user=reset_password_token.user)
try:
# validate the password against existing validators
validate_password(
password,
user=reset_password_token.user,
password_validators=get_password_validators(
settings.AUTH_PASSWORD_VALIDATORS),
)
except ValidationError as e:
# raise a validation error for the serializer
raise exceptions.ValidationError({"password": e.messages})
reset_password_token.user.set_password(password)
reset_password_token.user.save()
post_password_reset.send(sender=self.__class__,
user=reset_password_token.user)
# Delete all password reset tokens for this user
ResetPasswordToken.objects.filter(
user=reset_password_token.user).delete()
return Response({"status": "OK"})
def clean(self):
cleaned_data = super(UserForm, self).clean()
password = cleaned_data.get('password')
password_confirm = cleaned_data.get('password_confirm')
validators = get_password_validators(settings.AUTH_PASSWORD_VALIDATORS)
validate_password(password, user=None, password_validators=validators)
if password and password_confirm:
if password != password_confirm:
msg = "The two password fields must match."
self.add_error('password', msg)
return cleaned_data
def test_password_complexity_validator(password, raises_exception):
VALIDATOR_CONFIG = [{
"NAME":
"administration.validators.PasswordComplexityValidator"
}]
validators = get_password_validators(VALIDATOR_CONFIG)
if raises_exception:
with pytest.raises(ValidationError):
_ = validate_password(password, password_validators=validators)
else:
_ = validate_password(password, password_validators=validators)
def validate_password(self, password):
"""Validating it to django set policies."""
# validate the password against existing validators
validate_password(
password,
user=None,
password_validators=get_password_validators(
getattr(settings, 'AUTH_PASSWORD_VALIDATORS', None)
)
)
return password
def validate(self, data):
"""
Checks that both passwords match and satisfy AUTH_PASSWORD_VALIDATORS.
"""
if data["password1"] != data["password2"]:
raise serializers.ValidationError("Passwords must match.")
validate_password(
data["password1"],
password_validators=get_password_validators(
settings.AUTH_PASSWORD_VALIDATORS
),
)
return data
def validate_password(self, value):
"""
This is generic function to validate all serializer fields.
Here we validate the password, We check in 'validate' function because this field is not declared in Meta class.
:param value:
:return:
"""
if self.password:
password_validators = password_validation.get_password_validators(
settings.AUTH_PASSWORD_VALIDATORS)
password_validation.validate_password(
self.password, password_validators=password_validators)
return value
class ChangeTeamPassword(forms.Form):
new_team_password = forms.CharField(max_length=128,
widget=forms.PasswordInput,
validators=[klass.validate for klass in get_password_validators(settings.AUTH_PASSWORD_VALIDATORS)]
)
def __init__(self, *args, **kwargs):
self.player = kwargs.pop('player', None)
super().__init__(*args, **kwargs)
def clean(self):
super().clean()
if self.player.standing != Player.CAPTAIN and self.player.standing != Player.MODERATOR:
raise forms.ValidationError('Only the Captain or Moderators can change the team password!')
def clean(self):
newdata = super(PreferencesForm, self).clean()
if newdata.get('pagesize',0) > 10000:
raise forms.ValidationError("Maximum page size is 10000.")
if newdata.get('pagesize',25) < 25:
raise forms.ValidationError("Minimum page size is 25.")
if newdata['cur_password']:
if not self.user.check_password(newdata['cur_password']):
#. Translators: Translation included with Django
raise forms.ValidationError(_("Your old password was entered incorrectly. Please enter it again."))
# Validate_password raises a ValidationError
validate_password(newdata['new_password1'], self.user, get_password_validators(settings. AUTH_PASSWORD_VALIDATORS))
if newdata['new_password1'] != newdata['new_password2']:
#. Translators: Translation included with Django
raise forms.ValidationError("The two password fields didn't match.")
def clean(self):
newdata = super(PreferencesForm, self).clean()
if newdata.get('pagesize',0) > 10000:
raise forms.ValidationError("Maximum page size is 10000.")
if newdata.get('pagesize',25) < 25:
raise forms.ValidationError("Minimum page size is 25.")
if newdata['cur_password']:
if not self.user.check_password(newdata['cur_password']):
#. Translators: Translation included with Django
raise forms.ValidationError(_("Your old password was entered incorrectly. Please enter it again."))
# Validate_password raises a ValidationError
validate_password(newdata['new_password1'], self.user, get_password_validators(settings. AUTH_PASSWORD_VALIDATORS))
if newdata['new_password1'] != newdata['new_password2']:
#. Translators: Translation included with Django
raise forms.ValidationError("The two password fields didn't match.")
def post(self, request, *args, **kwargs):
serializer = self.serializer_class(data=request.data)
serializer.is_valid(raise_exception=True)
password = serializer.validated_data['new_password']
token = serializer.validated_data['token']
password_reset_token_validation_time = get_password_reset_token_expiry_time()
reset_password_token = ResetPasswordToken.objects.filter(
key=token).first()
if reset_password_token is None:
return Response({'status': 'notfound'}, status=status.HTTP_404_NOT_FOUND)
expiry_date = reset_password_token.created_at + \
timedelta(hours=password_reset_token_validation_time)
if timezone.now() > expiry_date:
reset_password_token.delete()
return Response({'status': 'expired'}, status=status.HTTP_404_NOT_FOUND)
if reset_password_token.user.eligible_for_reset():
pre_password_reset.send(
sender=self.__class__, user=reset_password_token.user)
try:
validate_password(
password,
user=reset_password_token.user,
password_validators=get_password_validators(
settings.AUTH_PASSWORD_VALIDATORS)
)
except ValidationError as e:
raise exceptions.ValidationError({
'password': e.messages
})
reset_password_token.user.set_password(password)
reset_password_token.user.save()
post_password_reset.send(
sender=self.__class__, user=reset_password_token.user)
ResetPasswordToken.objects.filter(
user=reset_password_token.user).delete()
return Response({'status': 'OK'})
def validate(self, data):
if not self.context.get('password1'):
raise serializers.ValidationError(
{"password1": "Password is required."})
if not self.context.get('password2'):
raise serializers.ValidationError(
{"password2": "Password Confirmation is required."})
if self.context.get('password1') != self.context.get('password2'):
raise serializers.ValidationError(
{"password2": "The password did not match."})
try:
validate_password(self.context.get('password1'),
password_validators=get_password_validators(
settings.AUTH_PASSWORD_VALIDATORS),
user=None)
except ValidationError as e:
raise serializers.ValidationError({'password1': e.messages})
return data
def clean(self):
newdata = super().clean()
if newdata.get("pagesize", 0) > 10000:
raise forms.ValidationError("Maximum page size is 10000.")
if newdata.get("pagesize", 25) < 25:
raise forms.ValidationError("Minimum page size is 25.")
if newdata["cur_password"]:
if not self.user.check_password(newdata["cur_password"]):
raise forms.ValidationError(
_("Your old password was entered incorrectly. Please enter it again."
))
# Validate_password raises a ValidationError
validate_password(
newdata["new_password1"],
self.user,
get_password_validators(settings.AUTH_PASSWORD_VALIDATORS),
)
if newdata["new_password1"] != newdata["new_password2"]:
raise forms.ValidationError(
"The two password fields didn't match.")
def post(self, request, *args, **kwargs):
serializer = self.serializer_class(data=request.data)
serializer.is_valid(raise_exception=True)
_d = request.data
try:
token = _d['token']
decoded_token = base64.urlsafe_b64decode(token.encode()).decode()
invite_token = get_object_or_404(InviteToken, id=decoded_token)
except Exception:
raise serializers.ValidationError(
{'detail': 'Invalid Invitation Token'})
expire_after = settings.INVITE_TOKEN_EXPIRY_TIME
now = datetime.utcnow().replace(tzinfo=pytz.utc)
valid_token_time = now - timedelta(hours=expire_after)
if invite_token.created_at < valid_token_time:
raise serializers.ValidationError({'detail': 'Token is expired'})
try:
_user = invite_token.user
if not ('firstname' in _d and len(_d['firstname']) > 0):
raise ValidationError("First name can't be blank")
if not ('lastname' in _d and len(_d['lastname']) > 0):
raise ValidationError("Last name can't be blank")
if not ('password' in _d):
raise ValidationError("Password can't be blank")
password = _d['password']
validate_password(password,
user=_user,
password_validators=get_password_validators(
settings.AUTH_PASSWORD_VALIDATORS))
_user.set_password(password)
_user.firstname = _d['firstname']
_user.lastname = _d['lastname']
_user.is_active = True
_user.save()
InviteToken.objects.filter(user=_user).delete()
except ValidationError as e:
raise serializers.ValidationError({'detail': e.messages})
return Response({'detail': 'Password successfully created.'},
status=status.HTTP_201_CREATED)
def __init__(self, *args, **kargs):
"""
Show requirements for password, and change labels to more suitable names
"""
super().__init__(*args, **kargs)
validators = list(settings.AUTH_PASSWORD_VALIDATORS)
for ignored in settings.IGNORED_VALIDATORS_FOR_NEW_PASSWORD:
validators.remove(ignored)
new_config = get_password_validators(validators)
rule_list = password_validators_help_texts(
password_validators=new_config)
self.fields['username'].help_text = None
self.fields['first_name'].widget.attrs.update(required=True)
self.fields['last_name'].widget.attrs.update(required=True)
self.fields['email'].widget.attrs.update(required=True)
self.fields["new_password"].widget.attrs.update(
autocomplete="new-password")
self.fields["new_password"].help_text = "<br/>".join(rule_list)
self.fields["confirm_new_password"].widget.attrs.update(
autocomplete="new-password")
def post(self, request, *args, **kwargs):
try:
user = request.user
new_password = request.data['new_password']
confirm_password = request.data['confirm_password']
# required password validator configuration
validator_config = [
{
'NAME': 'django.contrib.auth.password_validation.MinimumLengthValidator',
'OPTIONS': {'min_length': 8}
}
]
# check to see if password conformation matches with new pasword
if new_password == confirm_password:
# gets password validators
validators = get_password_validators(validator_config)
# validates password (raises ValidationError if invalid)
validate_password(new_password,
user=user,
password_validators=validators)
# sets and saves new password for user
user.set_password(new_password)
user.save()
return Response(status=status.HTTP_200_OK)
else:
return Response(status=status.HTTP_400_BAD_REQUEST)
except AttributeError:
return Response(status=status.HTTP_400_BAD_REQUEST)
except KeyError:
return Response(status=status.HTTP_400_BAD_REQUEST)
except ValueError:
return Response(status=status.HTTP_400_BAD_REQUEST)
except ValidationError:
return Response(status=status.HTTP_400_BAD_REQUEST)
def clean_password1(self):
password1 = self.cleaned_data.get("password1")
auth_password_validators = password_validation.get_password_validators(settings.AUTH_PASSWORD_VALIDATORS)
password_validation.validate_password(password1, self.instance, auth_password_validators)
class PreferencesForm(forms.Form):
language = forms.ChoiceField(
label=_("language"), initial="auto", choices=User.languageList
)
pagesize = forms.IntegerField(label=_("Page size"), required=False, initial=100)
theme = forms.ChoiceField(
label=_("Theme"),
required=False,
choices=[(i, capfirst(i)) for i in settings.THEMES],
)
cur_password = forms.CharField(
label=_("Change password"),
required=False,
help_text=_("Old password"),
widget=forms.PasswordInput(),
)
new_password1 = forms.CharField(
label="",
required=False,
help_text=password_validators_help_text_html(
get_password_validators(settings.AUTH_PASSWORD_VALIDATORS)
),
widget=forms.PasswordInput(),
)
new_password2 = forms.CharField(
label="",
required=False,
help_text=_("New password confirmation"),
widget=forms.PasswordInput(),
)
avatar = forms.ImageField(label="", required=False)
def __init__(self, *args, **kwargs):
super().__init__(*args, **kwargs)
if len(settings.THEMES) == 1:
# If there is only one theme make this choice unavailable
self.fields.pop("theme")
def clean(self):
newdata = super().clean()
if newdata.get("pagesize", 0) > 10000:
raise forms.ValidationError("Maximum page size is 10000.")
if newdata.get("pagesize", 25) < 25:
raise forms.ValidationError("Minimum page size is 25.")
if newdata.get("avatar", None) and newdata["avatar"].size > 102400:
raise forms.ValidationError("Avatars are limited to 100kB")
if newdata["cur_password"]:
if not self.user.check_password(newdata["cur_password"]):
raise forms.ValidationError(
_(
"Your old password was entered incorrectly. Please enter it again."
)
)
# Validate_password raises a ValidationError
validate_password(
newdata["new_password1"],
self.user,
get_password_validators(settings.AUTH_PASSWORD_VALIDATORS),
)
if newdata["new_password1"] != newdata["new_password2"]:
raise forms.ValidationError("The two password fields didn't match.")
