id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
16996	login_required decorator should check user.is_active	Preston Holmes	nobody	"This decorator only checks that user.is_authenticated

changing the decorator to also check user.is_active would be somewhat backwards incompatible, but would in general be what people would expect of the decorator.

Instead of the meaning being ""the decorator ensures that the user needs to be logged in, or requires that they be an active user at their next login""

instead would be:

""decorator ensures that the user is logged in and active""

(those aren't proposed docs, just semantic meaning repr)

Basically, if a user is already logged in, and they have a long lived auth cookie, if you mark that user as inactive, they will continue to be able to access decorated views until they next need to login, as is_active is only checked in the login form.
"	Bug	closed	contrib.auth	dev	Normal	duplicate			Unreviewed	0	0	0	0	0	0