#28571: Allow createsuperuser to bypass password validation
--------------------------------------+------------------------------------
Reporter: Daniel Hahler | Owner: nobody
Type: Cleanup/optimization | Status: new
Component: contrib.auth | Version: 1.11
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
--------------------------------------+------------------------------------
Changes (by Tim Graham):
* type: Bug => Cleanup/optimization
* component: Uncategorized => contrib.auth
* stage: Unreviewed => Accepted
Comment:
This was discussed at length on django-developers. I think
[https://groups.google.com/d/msg/django-
developers/9GBhgGXmEKs/KYvOpdARFAAJ Carl's suggestion] is fine:
My favorite option is for the createsuperuser command specifically (and
nothing else) to implement password validation as a confirm dialog rather
than a hard block. If your password fails validation, it tells you how
and asks you to confirm that you really want to use that password. This
makes sense to me because the createsuperuser command (unlike any site web
UI) can only ever be used by someone who would also have the ability to
set their password directly via shell if they want. So it's good to
remind them of the validation fail, but there's no reason to make their
life difficult.
--
Ticket URL: <https://code.djangoproject.com/ticket/28571#comment:2>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/065.c052d67e2783872888dca92e203e8b66%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
