Minor Problem with Auth Documentation

[xmnr]

Hello,

In the Django documentation about the authentication system, there are several snippets of code which may mislead the uninitiated.

​https://docs.djangoproject.com/en/1.7/topics/auth/default/#auth-web-requests

For instance:

def email_check(user):

return '@…' in user.email

This is later used by user_passes_test() to authorize a user.

This is a very clear example, but if put into production it would be a security liability because it doesn't prevent a user from registering with the email "hacker@…", or with the upcoming "hacker@…". I think most developers are wiser than that, but a novice may not be.

I think this should be emended with the use of user.email.endswith("@example.com")

[Sasha Romijn]

Makes sense to me. Our documentation should always give the best possible example. Could you make a pull request with all the example changes you think we should make?

[Berker Peksag]

​https://github.com/django/django/pull/3629

[Erik Romijn <eromijn@…>]

In 87bd13617c57a806deb550e3af1c06ce00517a9c:

Fixed #23847 -- Improved the email_check example in the auth documentation.

[Erik Romijn <eromijn@…>]

In 8819f6f7c9ffb78a13ed3e19803d89b6637358c6:

[1.7.x] Fixed #23847 -- Improved the email_check example in the auth documentation.

Backport of 87bd13617c57a806deb550e3af1c06ce00517a9c from master.