Ticket #12103: 12103_at_r17205.diff

docs/topics/auth.txt

@@ -1210 +1210 @@
 
     A form for logging a user in.
 
+    The ``AuthenticationForm`` rejects users whose ``is_active`` flag is set to ``False``.
+    You may override this behavior with a custom policy to determine which users can log in.
+    Do this with a custom form that subclasses ``AuthenticationForm`` and overrides the
+    ``confirm_login_allowed(self, user)`` method.  This method will raise a ``forms.ValidationError``
+    if the given user may not log in.
+
+    For example, to allow all users to log in, regardless of activation status::
+
+    .. code-block:: python
+
+        class AuthenticationFormWithInactiveUsersOkay(AuthenticationForm):
+            def confirm_login_allowed(self, user):
+                pass
+
+    Or to allow only some active users to log in:
+
+    .. code-block:: python
+
+        class PickyAuthenticationForm(AuthenticationForm):
+            def confirm_login_allowed(self, user):
+                if not user.is_active:
+                    raise forms.ValidationError(_("This account is inactive."))
+                if user.username.startswith('b'):
+                    raise forms.ValidationError(_("Sorry, accounts starting with 'b' aren't welcome here."))
+
 .. class:: PasswordChangeForm
 
     A form for allowing a user to change their password.

django/contrib/auth/tests/forms.py

@@ -115 +115 @@
                 self.assertEqual(form.non_field_errors(),
                                  [force_unicode(form.error_messages['inactive'])])
 
+    def test_custom_login_allowed_policy(self):
+        # The user is inactive, but our custom form policy allows him to log in.
+        data = {
+            'username': 'inactive',
+            'password': 'password',
+            }
+
+        class AuthenticationFormWithInactiveUsersOkay(AuthenticationForm):
+            def confirm_login_allowed(self, user):
+                pass
+
+        form = AuthenticationFormWithInactiveUsersOkay(None, data)
+        self.assertTrue(form.is_valid())
+
+        # If we want to disallow some logins according to custom logic,
+        # we should raise a django.forms.ValidationError in the form.
+        from django.forms import ValidationError
+        from django.utils.translation import ugettext_lazy as _
+        class PickyAuthenticationForm(AuthenticationForm):
+            def confirm_login_allowed(self, user):
+                if user.username == "inactive":
+                    raise ValidationError(_("This user is disallowed."))
+                raise ValidationError(_("Sorry, nobody's allowed in."))
+        
+        form = PickyAuthenticationForm(None, data)
+        self.assertFalse(form.is_valid())
+        self.assertEqual(form.non_field_errors(), 
+                         [u'This user is disallowed.'])
+        
+        data = {
+            'username': 'testclient',
+            'password': 'password',
+            }
+        form = PickyAuthenticationForm(None, data)
+        self.assertFalse(form.is_valid())
+        self.assertEqual(form.non_field_errors(), 
+                         [u"Sorry, nobody's allowed in."])
+        
     def test_success(self):
         # The success case
         data = {

django/contrib/auth/forms.py

@@ -145 +145 @@
             self.user_cache = authenticate(username=username, password=password)
             if self.user_cache is None:
                 raise forms.ValidationError(self.error_messages['invalid_login'])
-            elif not self.user_cache.is_active:
-                raise forms.ValidationError(self.error_messages['inactive'])
+            else:
+                self.confirm_login_allowed(self.user_cache)
         self.check_for_test_cookie()
         return self.cleaned_data
 
@@ -154 +154 @@
         if self.request and not self.request.session.test_cookie_worked():
             raise forms.ValidationError(self.error_messages['no_cookies'])
 
+    def confirm_login_allowed(self, user):
+        """
+        Controls whether the given ``auth.User`` object may log in. This is a policy setting,
+        independent of end-user authentication. This default behavior is to allow login by
+        active users, and reject login by inactive users.
+
+        If the given user cannot log in, this method should raise a ``forms.ValidationError``.
+
+        If the given user may log in, this method should return None.
+        """
+        if not user.is_active:
+            raise forms.ValidationError(self.error_messages['inactive'])
+
     def get_user_id(self):
         if self.user_cache:
             return self.user_cache.id