Required field error added to new_password1 on forms that inherit SetPasswordForm with additional new_password1 level validation.

[אורי]

Hi,

I ran Speedy Net's tests with Django 5.1a1. Some tests failed with an unexpected error messages. These tests passed with Django versions 4.2.13 and 5.0.6.

To run these tests, run ./tests_manage_all_sites_with_all_warnings.sh test speedy.core.accounts.tests.test_views.EditProfileCredentialsViewEnglishTestCase --shuffle --test-all-languages with Django==5.1a1 installed. Here are the error messages:

'new_password1': ['This password is too short. It must contain at least 8 characters.', 'This field is required.'] (the actual error message received)
'new_password1': ['This password is too short. It must contain at least 8 characters.'] (the expected error message)

It looks like the error message "This field is required." is unexpected and doesn't appear with Django versions 4.2.13 and 5.0.6. Notice that this field was not missing but too short. A similar problem happens when the new password is too long.

I confirm the extra error message appears on the site with Django 5.1a1 and I created screenshots which I'm attaching here. The first screenshot I attached is with Django 5.1a1 and the second one with Django 4.2.13 (and is the expected error messages).

[Sarah Boyce]

Hi אורי, I spent quite a while with this. Next time please share links to your tests or code in the ticket.

git bisect confirmed this is a regression in e626716c28b6286f8cf0f8174077f3d2244f3eb3 (ref #34429)

Here is a test case:

tests/auth_tests/test_forms.py

@@ -3 +3 @@
 import urllib.parse
 from unittest import mock
 
+from django.contrib.auth import password_validation
 from django.contrib.auth.forms import (
     AdminPasswordChangeForm,
     AuthenticationForm,
@@ -865 +866 @@
                     form.fields[field_name].widget.attrs["autocomplete"], autocomplete
                 )
 
+    @override_settings(
+        AUTH_PASSWORD_VALIDATORS=[
+            {
+                "NAME": (
+                    "django.contrib.auth.password_validation.MinimumLengthValidator"
+                ),
+                "OPTIONS": {"min_length": 12},
+            },
+        ]
+    )
+    def test_extra_validation(self):
+        class ModifiedSetPasswordForm(SetPasswordForm):
+            def clean_new_password1(self):
+                new_password = self.cleaned_data["new_password1"]
+                password_validation.validate_password(password=new_password)
+                return new_password
+
+        user = User.objects.get(username="testclient")
+        form = ModifiedSetPasswordForm(
+            user, {"new_password1": "abc", "new_password2": "abc"}
+        )
+        self.assertIs(form.is_valid(), False)
+        self.assertEqual(
+            form["new_password1"].errors,
+            ["This password is too short. It must contain at least 12 characters."],
+        )
+        self.assertEqual(
+            form["new_password2"].errors,
+            ["This password is too short. It must contain at least 12 characters."],
+        )
+
 
 class PasswordChangeFormTest(TestDataMixin, TestCase):
     def test_incorrect_password(self):

[Sarah Boyce]

Thank you for testing 5.1 and raising the ticket אורי 👍

[אורי]

Replying to Sarah Boyce:

Hi אורי, I spent quite a while with this. Next time please share links to your tests or code in the ticket.

Sorry about that. Code is under ​https://github.com/speedy-net/speedy-net. Tests are in relevant test files. Recent tests I ran are under ​https://github.com/speedy-net/speedy-net/actions.

The tests I mentioned in this ticket (speedy.core.accounts.tests.test_views.EditProfileCredentialsViewEnglishTestCase) are under ​https://github.com/speedy-net/speedy-net/blob/main/speedy/core/accounts/tests/test_views.py. Notice that there are also tests for French, German and other languages.

[nessita <124304+nessita@…>]

In 339977d4:

Fixed #35477 -- Corrected 'required' errors in auth password set/change forms.

The auth forms using SetPasswordMixin were incorrectly including the
'This field is required.' error when additional validations (e.g.,
overriding clean_password1) were performed and failed.
This fix ensures accurate error reporting for password fields.

Co-authored-by: Natalia <124304+nessita@…>

[Natalia <124304+nessita@…>]

In 9996bb1e:

[5.1.x] Fixed #35477 -- Corrected 'required' errors in auth password set/change forms.

The auth forms using SetPasswordMixin were incorrectly including the
'This field is required.' error when additional validations (e.g.,
overriding clean_password1) were performed and failed.
This fix ensures accurate error reporting for password fields.

Co-authored-by: Natalia <124304+nessita@…>

Backport of 339977d4441fd353e20950b98bad3d42afb1f126 from main.