[patch] Erroneous values stored in contrib.auth fields: date_joined, last_login

[Tim Goh]

Problem:

The date_joined and last_login fields in the contrib.auth package are both declared as "default=models.LazyDate()", which results in the following incorrect behavior:

1. date_joined and last_login are updated to the current date/time whenever the User model is saved.
2. last_login is updated when the user logs into the admin interface, but any application front-ends hooking on to contrib.auth will have to update it themselves upon authenticating. This is not what the name "last_login" implies.

Patch description:

(patched against r4077)

The attached patch defines date_joined and last_login as auto_now_add=True, so they are timestamped upon creation of the user object. Subsequently, upon successful authentication, last_login is updated with the current time.

[Chris Beaven]

You can't assume that user will have a last_login property - you're assuming it will be django.auth.models.User, when it could be any model passed from an alternate auth backend.

[Tim Goh <timgoh@…>]

against r4085

[Tim Goh <timgoh@…>]

You're right. The last_login update code should go in ModelBackend instead. Updated diff attached.

[Gary Wilson <gary.wilson@…>]

Updating last_login in the backend's authenticate method is not quite right either. The AuthenticationForm manipulator can still raise errors after authenticate() has been called, in which case last_login gets updated when it should not.

[James Bennett]

LazyDate is gone and those fields now default to datetime.datetime.now which only happens on the initial save, so this is fixed.