Ticket #12113: 12113.diff

docs/topics/auth.txt

@@ -99 +99 @@
         This doesn't control whether or not the user can log in. Nothing in the
         authentication path checks the ``is_active`` flag, so if you want to
         reject a login based on ``is_active`` being ``False``, it is up to you
-        to check that in your own login view. However, permission checking
-        using the methods like :meth:`~models.User.has_perm` does check this
-        flag and will always return ``False`` for inactive users.
+        to check that in your own login view. The
+        :class:`~django.contrib.auth.forms.AuthenticationForm` used by the
+        by the :func:`~django.contrib.auth.views.login` view *does* perform this
+        check and therefore rejects inactive users from logging in. Permission
+        checking using the methods like :meth:`~models.User.has_perm` also
+        checks this flag and will always return ``False`` for inactive users.
 
     .. attribute:: models.User.is_superuser
 
@@ -970 +973 @@
 
     A form for logging a user in.
 
+    The ``AuthenticationForm`` rejects users whose 
+    :attr:`~django.contrib.auth.models.User.is_active` flag is set to ``False``.
+
 .. class:: PasswordChangeForm
 
     A form for allowing a user to change their password.