AuthenticationForm bug when USERNAME_FIELD is an IntegerField

[Gavin Wahl]

In my custom user model, my USERNAME field is an IntegerField (the users log in with their account number). I also subclass AuthenticationForm to make the username a forms.IntegerField.

django.contrib.auth.forms.AuthenticationForm.clean attempts to check if the username field was filled out by using the truthiness of the submitted value:

    def clean(self):
        username = self.cleaned_data.get('username')
        password = self.cleaned_data.get('password')

        if username and password:
            self.user_cache = authenticate(username=username,
                                           password=password)

So, if someone attempts to log in with a username of 0, authentication is never even attempted (but the form passes validation!), and the login view fails when triying to call auth.login.

The code should explicitly check for None as a sentinel value (if username is not None and password is not None:, rather than the truthiness of the submitted value.

[Olexander Yermakov]

Please review the ​PR

[Tim Graham <timograham@…>]

In 975a76a9:

Fixed #26951 -- Allowed AuthenticationForm to work with a username of 0.