Ticket #12113: 12113.3.diff

docs/topics/auth.txt

@@ -99 +99 @@
         Boolean. Designates whether this user account should be considered
         active. Set this flag to ``False`` instead of deleting accounts.
 
-        This doesn't control whether or not the user can log in. Nothing in the
-        authentication path checks the ``is_active`` flag, so if you want to
-        reject a login based on ``is_active`` being ``False``, it is up to you
-        to check that in your own login view. However, permission checking
-        using the methods like :meth:`~models.User.has_perm` does check this
-        flag and will always return ``False`` for inactive users.
+        This doesn't control whether or not the user can log in. Authentication
+        backends are not required to check for ``is_active`` flag, so if you
+        want to reject a login based on ``is_active`` being ``False``, it is up
+        to you to check that in your own login view. However the
+        :class:`~django.contrib.auth.forms.AuthenticationForm` used by the
+        :func:`~django.contrib.auth.views.login` view *does* perform this
+        check and therefore rejects inactive users from logging in. Permission
+        checking using the methods like :meth:`~models.User.has_perm` and
+        authentication in admin application also check this flag and will
+        always reject inactive users.
 
     .. attribute:: models.User.is_superuser
 
@@ -994 +998 @@
 
     A form for logging a user in.
 
+    The ``AuthenticationForm`` rejects users whose
+    :attr:`~django.contrib.auth.models.User.is_active` flag is set to ``False``.
+
 .. class:: PasswordChangeForm
 
     A form for allowing a user to change their password.