UserCreationForm doesn't call normalize_email

[Mitar]

UserCreationForm seems to not be calling normalize_email, which is called otherwise by the UserManager.create_user.

[Claude Paroz]

Same for normalize_username in 1.10. What about applying the normalization in an AbstractUser.clean() method?

[Tim Graham]

​PR

[Tim Graham]

Promoting to release blocker in light of Claude's concern of the lack of normalize_username as a possible security issue.

[Mitar]

Can you elaborate on the security concern?

[Claude Paroz]

The security concern is about unicode username not being normalized, which could allow a user to create a new account with a visually similar username as another one.
You can also find more information on this ​django-developers thread.

[Tim Graham]

I wrote ​a separate patch for moving username normalization to AbstractBaseUser.clean(). I'll refocus this ticket to moving email normalization since this isn't a blocker for 1.10.

[Tim Graham <timograham@…>]

In 39805686:

Refs #21379, #26719 -- Moved username normalization to AbstractBaseUser.

Thanks Huynh Thanh Tam for the initial patch and Claude Paroz for review.

[Tim Graham <timograham@…>]

In 1b0b6f03:

[1.10.x] Refs #21379, #26719 -- Moved username normalization to AbstractBaseUser.

Thanks Huynh Thanh Tam for the initial patch and Claude Paroz for review.

Backport of 39805686b364358af725b695924a5a6dfa7f5302 from master

[Tim Graham]

Not sure I understand the premise of the report because UserCreationForm only has fields = ("username",) (no email field).

[Mitar]

Yes, but you can extend it and add it to fields in Meta. It is a ModelForm. So the list of fields exposed is just a default.

[Tim Graham <timograham@…>]

In 09119dff:

Fixed #26719 -- Normalized email in AbstractUser.clean().