This is a django.contrib.auth bug, but the relevant template is "django/contrib/admin/templates/registrations/password_change_form.html": this template uses the oldforms-style html_error_list instead of .errors to display error messsages.
The reason this isn't a simple trivial change is because a test should actually be written to test that form and ensure the problem doesn't occur again. To do that:
- put a new unittest class in django.contrib.auth.tests.views
- modify django.contrib.auth.tests.__init__ to include the class
- hook up a /login/ URL in django.contrib.auth.urls, since you can't change the password without logging in.
- work out a password for the testuser in the fixture data and update the fixture data's password hash. Then document what this password is for other test users somehow (in the fixture directory maybe?). It might be possible to guess the current password; I haven't tried. But just creating the hash for a know password (e.g. "test" would be fine.
- At least test that trying to change a password and failing displays the error messages.
