User accounts with is_active

[dave@…]

My thought on how to fix this is to change this line in django.contrib.auth.forms.isValidUser from this:

            self.user_cache = User.objects.get(username=field_data)

to this:

            self.user_cache = User.objects.filter(is_active=True).get(username=field_data)

Or add a second Manager to django.contrib.auth.models :

class ActiveUser(models.Manager):
    def get_query_set(self):
        return super(ActiveUser, self).get_query_set().filter(is_active=True)

and add these two lines to django.contrib.auth.models.Article :

    objects = models.Manager()
    published = ActiveUser()

and instead of the line above for isValidUser, put this:

            self.user_cache = ActiveUser.objects.get(username=field_data)

Don't forget to do: from django.contrib.auth.users.models import ActiveUser

[germish@…]

Both of those solutions would reveal the existsence of the username to a potential attacker, whether they knew the username password or not. Here is an alternative solution, which will only notify the person logging that the username is inactive when they correctly guess the username password:

def isValidPasswordForUser(self, field_data, all_data):
    if self.user_cache is not None and not self.user_cache.check_password(field_data):
        self.user_cache = None
        raise validators.ValidationError, _("Please enter a correct username and password. Note that both fields are case-sensitive.")
    elif self.user_cache is not None and not self.user_cache.is_active:
        self.user_cache = None
        raise validators.ValidationError, _("This account is incative.")

[Adrian Holovaty]

(In [3058]) Fixed #1991 -- Changed AuthenticationForm to disallow users with is_active=False from logging in. Thanks, dave@… and germish@…

[Smith]

test

[anonymous]

test script, sorry

[Russell Keith-Magee]

Please refrain from 'testing' on this ticket database - it is a live entity that we use for real work.

[(none)]

Milestone Version 1.0 deleted