Validation inactive user Django

Question

I looking for a resolving of my issue. I have custom User model:

class User(AbstractUser):
    username = models.CharField(max_length=150, unique=True, blank=False, null=False)
    first_name = models.CharField(max_length=150, blank=True)
    last_name = models.CharField(max_length=150, blank=True)
    password = models.CharField(max_length=150, blank=False)
    email = models.EmailField(unique=True, blank=False)
    date_create = models.DateTimeField(auto_now_add=True)
    address = models.CharField(blank=True, max_length=128)
    phone = PhoneNumberField(unique=True)
    photo = models.ImageField(upload_to='images/', blank=True)
    is_active = models.BooleanField(default=True)

In my app I have e-mail-confirmation. When I create user I hit the "is_active=False". When user activate account then flag "is_active=True". Everything works good. But when INactive user tries to log in I wanna get message from Django in Login form. Django has it(source code):

def confirm_login_allowed(self, user):
        if not user.is_active:
            raise ValidationError(
                self.error_messages['inactive'],
                code='inactive',
            )

But doesn't work for me. Update: When inactive user tried to log in I get same message as user with incorrect username or password. I tried to override AuthenticationForm:

User = get_user_model()
class CustomAuthenticationForm(AuthenticationForm):
    class Meta:                # tried with Meta and without
        model = User
    def confirm_login_allowed(self, user):
        if not user.is_active:
            raise forms.ValidationError('There was a problem with your login.')

View:

class CustomLoginView(SuccessMessageMixin, LoginView):
    form_class = CustomAuthenticationForm
    success_url = reverse_lazy('home')
    success_message = "You was logged in successfully"

url:

path('login/', CustomLoginView.as_view(), name='login'),

Update, templates base and login:


{% load static %}


    
    
    

    {% block mystyle %}
    {% endblock %}



    Site
    
    
        
            Home
            {% if user.is_authenticated %}
            Cabinet
            LogOut
            {% else%}
            SignUp
            LogIn
            {% endif %}
        
    

{% if messages %}
{% for message in messages %}
{{ message }}
{% endfor %}
{% endif %}
{% block content %}
{% endblock %}



{% extends "base.html" %}
{% load crispy_forms_tags %}

{% block title %}Log In{% endblock %}
{% block content %}
Log In

    
        
            {% csrf_token %}
            {{ form|crispy }}
            
                Forgot your password?
            
            
                
            
        
    

{% endblock %}

Could someone help me? Thanks.

koko · Accepted Answer

I understood it from point of security. I resolved it just override ModelBackend

from django.contrib.auth.backends import ModelBackend  
from django.contrib.auth import get_user_model 
UserModel = get_user_model()
class CustomModelBackend(ModelBackend):
    def authenticate(self, request, username=None, password=None, **kwargs):
        if username is None:
            username = kwargs.get(UserModel.USERNAME_FIELD)
        if username is None or password is None:
            return
        try:
            user = UserModel._default_manager.get_by_natural_key(username)
        except UserModel.DoesNotExist:
            # Run the default password hasher once to reduce the timing
            # difference between an existing and a nonexistent user (#20760).
            UserModel().set_password(password)
        else:
            if user.check_password(password):   # here (remove 'and self.user_can_authenticate(user):')
                return user

Settings

AUTHENTICATION_BACKENDS = [
    'django.contrib.auth.backends.ModelBackend',
    'accounts.backends.CustomModelBackend',
]

Validation inactive user Django

Answers (1)

Related Questions