User.objects.create_user() allows empty usernames

[honza]

This code will work:

User.objects.create_user(username='', email='test@test.com', password='password')

It should raise some kind of exception.

I searched for this in the tracker and didn't find any references. I'm happy to work on this given some direction from the core.

[Preston Holmes]

I do think the manager function should validate the model - attached is a very quick patch that does this - it is not a complete patch

[honza]

I added a better patch. Passing in an empty string will raise an IntegrityError. Includes tests. Marking as ready for checkin.

[Julien Phalip]

Please do not promote your own patches to RFC and let someone else do it if it passes review. From looking at the patch, it feels like the validation shouldn't be done in the manager but deeper down at the model level. Also ValidationError would seem more appropriate than IntegrityError.

[nerdap]

Does validation in the User.save() method, and raises a validation error if the username is empty.

[Jakub Wiśniowski]

Kwadrat's patch looks OK and works as intended.

I wondered about using self.full_clean() in save, instead of the above. However, according to JKocherhans comment here: https://code.djangoproject.com/ticket/13100 using full_clean would break backward compatibility.

[Piotr Banaszkiewicz]

Reviewed the latest patch patch_for_17046_another.diff, it works as intended.

[HM]

I'd say "design decision needed" on this one. It is not so uncommon to use the email-address as a "username", possibly copying it to the username-field after the create().

[Simon Charette]

Replying to HM:

I'd say "design decision needed" on this one. It is not so uncommon to use the email-address as a "username", possibly copying it to the username-field after the create().

Isn't there a unique constraint on the username field? Doing so might raise constraint violations in a multi-threaded environment if you are trying to have two users in the copying email to username state at the same time since both share an empty string username while doing it.

[Jannis Leidel]

In [17628]:

Fixed #17046 -- Added a check if the username passed to User.objects.create_user is empty or not. Thanks, kwadrat.