Allow django.contrib.auth's LOGIN_URL, LOGOUT_URL and ACCOUNT_URL to be set in settings.py

[Vasily Sulatskov <redvasily@…>]

Currently it's impossible to change LOGIN_URL varaible which is used in django.contrib.auth

I found ​this discussion on mailing list.

Adrian Holovaty said that LOGIN_URL should be made configurable. I made tiny patch to make it possible to specify LOGIN_URL in site settings.py module. This patch works at least for me and doesn't break anything else (as far as I know).

[Gary Wilson <gary.wilson@…>]

While we're at it we should go ahead and make the profile URL configurable too, which is currently hardcoded in the contrib.auth.views.login view.

[Vasily Sulatskov <redvasily@…>]

I noticed that I myself use custom version of django.contrib.auth.views.login() that used different account URL, so I made it configurable also.

Patch: login_url2.diff

[Gary Wilson <gary.wilson@…>]

using getattr instead of try/except

[Gary Wilson <gary.wilson@…>]

Adrian gave the ok in the thread mentioned in the ticket description.

[Marc Fargas <telenieko@…>]

Documentation for this ticket.

[Marc Fargas <telenieko@…>]

Documentation added, please take one thing in account:
I set a link to @login_decorator twice (in the ACCOUNT_URL and LOGIN_URL sections) thus the line ".. _@login_decorator" is at the bottom of the file, I have no idea if this works, and this silly PC doesn't want to download docutils now to let me check... so please take this into account before appliying!

Also, I have no idea if the "@" can be there on the link... ;)

Hope I didn't miss anything to change.

[Vasily Sulatskov <redvasily@…>]

Some more advocacy for this ticket: in this thread ​Why I'm giving up on Django one of the reasons for giving Django up was:

"This is a biggie for me. I can't believe that the authentication
module forces you to use hard coded urls for login/logout pages --
that's just maddening!"

Ahd that's what this patch fixes.

[Gary Wilson <gary.wilson@…>]

Replying to Marc Fargas <telenieko@telenieko.com>:

Documentation added, please take one thing in account:
I set a link to @login_decorator twice (in the ACCOUNT_URL and LOGIN_URL sections) thus the line ".. _@login_decorator" is at the bottom of the file, I have no idea if this works, and this silly PC doesn't want to download docutils now to let me check... so please take this into account before appliying!

Also, I have no idea if the "@" can be there on the link... ;)

Seems to work for me. Thanks for the patch.

[Gary Wilson <gary.wilson@…>]

code and docs in one patch

[Gary Wilson <gary.wilson@…>]

use relative link, as mentioned in #3333

[Gary Wilson <gary.wilson@…>]

After playing around with contrib.comments, it appears that we should probably have a LOGOUT_URL also since in the comment app's form.html template there is a hardcoded /accounts/logout/. This would be simple enough to add, that we should just add it to this ticket instead of creating a new one.

[Marc Fargas <telenieko@…>]

+1
Adding need documentation to document the settings.LOGOUT_URL when the patch comes in.

[Vasily Sulatskov <redvasily@…>]

Added LOGOUT_URL variable to auth/init.py. Modified comments app to use it.

[Vasily Sulatskov <redvasily@…>]

I didn't test 3185_3.diff because I don't use comments app myself. But changes were obvious so perhaps patch will work fine.

[anonymous]

Thanks for the patch Vasily.

[Gary Wilson <gary.wilson@…>]

The above comments were made by me :)

[Jannis Leidel <jl@…>]

+1 from me

[Jacob]

It's not clear to me which of these patches should be applied, and in which order. Can one of the patch authors upload an über-patch that does it all in one fell swoop?

[Vasily Sulatskov <redvasily@…>]

Uber patch. Everything included

[Vasily Sulatskov <redvasily@…>]

I think that ACCOUNT_URL variable name is misleading, because it's not necessary to redirect user after successful login to account page. So I changed it to POSTLOGIN_REDIRECT_URL in 3185_4.diff.

3185_4.diff contains all needed changes.

[Marc Fargas <telenieko@…>]

Removing "needs better patch" as Vasily uploaded what jacob requested ;)

[Malcolm Tredinnick]

The most recent patch still has a few subtle problems:

1. Anything that is configurable should always be read from settings, not shoved in as a constant into some other module (it's not a constant any longer, after all). I realise LOGIN_URL is already a constant in the auth module, but that now becomes a proxy for the value from settings for backwards compatibility reasons. Everything else comes straight out of settings (including all current internal uses of LOGIN_URL).

2. We should not be reading anything from settings at import time; only at execution time. The reason for this is manually configured settings. The developer needs to be able to import the necessary modules and then call settings.configure(). The current code reads from settings at import time and so will raise a configuration error. This problem exists in other parts of Django as well, but that's not a reason to perpetuate the problem.

[Collin Grady <cgrady@…>]

Took a stab at fixing the patch based on comments, as I would like this as well :)

[Malcolm Tredinnick]

(In [5072]) Fixed #3185 -- Made values for login, logout and post-login redirect URLs
configurable. This is a combined patch from Vasily Sulatskov, Marc Fargas and
Collin Grady.