Django

Code

Ticket #8379 (closed: fixed)

Opened 4 months ago

Last modified 3 months ago

'change user' admin form doesn't validate username

Reported by: Mirrorball Assigned to: kratorius
Milestone: 1.0 Component: Authentication
Version: 1.0-beta-1 Keywords:
Cc: Triage Stage: Accepted
Has patch: 0 Needs documentation: 0
Needs tests: 0 Patch needs improvement: 0

Description

The form for changing a user in the admin interface doesn't validate the username. Any character may be entered.

Attachments

r8520-validate-username.patch (1.9 kB) - added by kratorius on 08/24/08 06:14:48.

Change History

08/18/08 05:06:43 changed by thejaswi_puthraya

  • needs_better_patch changed.
  • needs_tests changed.
  • needs_docs changed.

The details provided are vague. Can you give us more details regarding your 'expectations' and the 'result'? This will help in fixing the problem (if any).

08/18/08 18:56:10 changed by ericholscher

  • status changed from new to closed.
  • resolution set to invalid.

Do you mean that there is no javascript validation? There shouldn't be any in javascript. Closed as invalid because there isn't enough information. Please re-open if it's a bug, with a way to repeat.

08/22/08 17:57:27 changed by Mirrorball

  • status changed from closed to reopened.
  • resolution deleted.

No, there's no backend validation. You can enter invalid characters for the username field (for instance, "Mirrorball ") and it's going to be saved even though it doesn't validate.

08/22/08 17:59:28 changed by Mirrorball

My invalid characters were deleted when I sent the above message with an instance of invalid username, but any will do. "Mirrorball at at", for instance.

08/22/08 18:01:54 changed by brosner

  • owner changed from nobody to brosner.
  • status changed from reopened to new.
  • stage changed from Unreviewed to Accepted.

08/24/08 06:03:28 changed by kratorius

  • owner changed from brosner to kratorius.

08/24/08 06:14:48 changed by kratorius

  • attachment r8520-validate-username.patch added.

08/24/08 06:26:11 changed by kratorius

The above patch should fix the issue. Anyway my first thought has been that this kind of validation should be made at model-level (whenever it lands) so we can allow someone that is using some custom backend or that is inheriting the User class to specify what kind of characters are allowed in these fields. But of course this is a post-1.0 thing...

08/25/08 12:10:22 changed by jacob

  • status changed from new to closed.
  • resolution set to fixed.

(In [8544]) Fixed #8379: the admin user change form now properly validates the username. Thanks, kratorius.

Add/Change #8379 ('change user' admin form doesn't validate username)




Change Properties
Action