#26951: AuthenticationForm bug when USERNAME_FIELD is an IntegerField
------------------------------+--------------------
Reporter: gavinwahl | Owner: nobody
Type: Bug | Status: new
Component: contrib.auth | Version: 1.9
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Easy pickings: 0 | UI/UX: 0
------------------------------+--------------------
In my custom user model, my USERNAME field is an IntegerField (the users
log in with their account number). I also subclass AuthenticationForm to
make the username a forms.IntegerField.
`django.contrib.auth.forms.AuthenticationForm.clean` attempts to check if
the username field was filled out by using the truthiness of the submitted
value:
{{{#!python
def clean(self):
username = self.cleaned_data.get('username')
password = self.cleaned_data.get('password')
if username and password:
self.user_cache = authenticate(username=username,
password=password)
}}}
So, if someone attempts to log in with a username of `0`, authentication
is never even attempted (but the form passes validation!), and the login
view fails when triying to call auth.login.
The code should explicitly check for None as a sentinel value (`if
username is not None and password is not None:`, rather than the
truthiness of the submitted value.
--
Ticket URL: <https://code.djangoproject.com/ticket/26951>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/052.22cf646bd809a9b37be08d35b14a5d60%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
