active_login_required

[wim@…]

When a user is inactived in the admin interface, he should not be able to access login_required views.

The user should be authenticated and active in order to see these views. The additional decorator active_login_required solves this.

I am sorry for the duplicating of code, but it looked much better this way, than actually calling login_required with an additional parameter.

[wim@…]

a patch for ticket 16797: adding a stronger login_required decorator

[Taavi Taijala]

Replying to anonymous:

Correct me if I'm wrong here, but doesn't inactivating a user mean that they can no longer login, and therefore not access any views decorated with login_required?

[anonymous]

The problem arises when the user is already logged in. In that case the user can use the site for as long as his session is valid. This is surprising as one might expect that just removing is_active is enough to get rid of a problematic user.

[Taavi Taijala]

That is surprising. I would think in that case the best option would be to logout a user when is_active is removed; however, that may not be such an easy solution. Does anyone know if there's any way to do this?

[anonymous]

Hi taavi,

As far as I know it is not possible. See ticket #13125 .

[Aymeric Augustin]

This was discussed on the mailing list (thread "plea for re-opening ticket 13125 marked as won't fix"), there is just a -0 from a core developer.

This would require some serious documentation, as the existence of two similar decorators could cause confusion.

[Jacob]

Thanks for the suggestion, Wim, but I think this is something that shouldn't go into Django. Every site is going to have their own slightly different auth needs, and that's the purpose of the generic user_passes_test meta-decorator. Including each and every slightly different permutation of auth logic in Django is a path that leads towards spaghetti code. Further, this is trivial to accomplish in your own code, so there isn't a much impetus to include it in Django.

Thanks again!