Allow customization of password_change_form in the Django admin site

[Mohammadreza Eskandari]

The Django admin site currently provides the ability to customize the login_form through the AdminSite.login_form attribute. However, no similar mechanism exists to customize the password_change_form used in the admin for password changes.

This inconsistency limits flexibility for developers who want to provide custom logic or fields for password changes in the admin interface. For example, a developer may want to enforce additional security checks, integrate password strength validation, or provide a more user-friendly design.

Proposed Solution:
Introduce a new attribute, AdminSite.password_change_form, which developers can override to specify a custom form for the password change functionality. This attribute would function similarly to AdminSite.login_form, allowing developers to define and register a custom form class.

Benefits:

• Enhances consistency with existing AdminSite customization options.
• Provides more flexibility for developers working with the Django admin site.
• Simplifies the implementation of custom password change logic.

Example:

from django.contrib.admin import AdminSite
from myapp.forms import CustomPasswordChangeForm

class MyAdminSite(AdminSite):
    password_change_form = CustomPasswordChangeForm

Potential Backwards Compatibility Issues:
The proposed change should not introduce any breaking changes, as the default behavior would remain unchanged unless password_change_form is explicitly set.

My Contribution:
I have submitted a pull request which is available at ​https://github.com/django/django/pull/19081

[Natalia Bidart]

Thank you Mohammadreza Eskandari for taking the time to create this ticket.

Considering that we already have password_change_template and password_change_done_template definitions in AdminSite, I'm inclined to accept this ticket. But, I would need that a test project is shared so you can showcase the concrete use case for this. Mohammadreza could you please provide that?

Specifically for the PR, it would need tests and proper docs for:

1. A small release note in the 6.0.txt file.
2. A somehow complete example in the docs of overriding the forms to better exemplify its value (to be part of /ref/contrib/admin/).

[Mohammadreza Eskandari]

Hi Natalia

Thank you so much for accepting my ticket and considering the changes!

I’ve created a GitHub repository to demonstrate the changes I’ve made in relation to this ticket. In this repo, you will find a test project with the necessary customizations for overriding the password_change_form as discussed.

link of repository: ​https://github.com/mohammadrezaesk/django-ticket-36121-show-case

PR changes:
Additionally, I’ve added test cases to the PR to check for security-related changes, and I’ve updated the release notes and documentation as requested 🫡.

Regarding the documentation, when I checked the existing docs for the login_form customization, I noticed there were no detailed examples provided for similar attributes. So, I followed the same format as the login_form example and avoided adding unnecessary text. This way, the documentation remains consistent with the current structure, and the example is clear and concise.

Feel free to check out the project and let me know if further adjustments are needed!

Looking forward to your feedback.

[Mohammadreza Eskandari]

Hi Natalia

Thank you so much for accepting my ticket and considering the changes!

I’ve created a GitHub repository to demonstrate the changes I’ve made in relation to this ticket. In this repo, you will find a test project with the necessary customizations for overriding the password_change_form as discussed.

link of repository: ​https://github.com/mohammadrezaesk/django-ticket-36121-show-case

PR changes:
Additionally, I’ve added test cases to the PR to check for security-related changes, and I’ve updated the release notes and documentation as requested 🫡.

Regarding the documentation, when I checked the existing docs for the login_form customization, I noticed there were no detailed examples provided for similar attributes. So, I followed the same format as the login_form example and avoided adding unnecessary text. This way, the documentation remains consistent with the current structure, and the example is clear and concise.

Feel free to check out the project and let me know if further adjustments are needed!

Looking forward to your feedback.

Replying to Natalia Bidart:

Thank you Mohammadreza Eskandari for taking the time to create this ticket.

Considering that we already have password_change_template and password_change_done_template definitions in AdminSite, I'm inclined to accept this ticket. But, I would need that a test project is shared so you can showcase the concrete use case for this. Mohammadreza could you please provide that?

Specifically for the PR, it would need tests and proper docs for:

1. A small release note in the 6.0.txt file.
2. A somehow complete example in the docs of overriding the forms to better exemplify its value (to be part of /ref/contrib/admin/).

[Antoliny]

It seems like ticket owner are waiting for fellow's review, so I have unset "Needs documentation" and "Patch needs improvement".
Additionally, I recommend this document for you. ​contributing workflow detail docs

[Mohammadreza Eskandari]

Hi Antoliny,

Thank you so much for your guidance and for recommending the contributing workflow detail docs! This is my first contribution to Django, and I truly appreciate the help and support from the community throughout the process.

Replying to Antoliny:

It seems like ticket owner are waiting for fellow's review, so I have unset "Needs documentation" and "Patch needs improvement".
Additionally, I recommend this document for you. ​contributing workflow detail docs

[Sarah Boyce <42296566+sarahboyce@…>]

In 12b9ef38:

Fixed #36121 -- Allowed customizing the admin site password change form.