Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
|Build status|
.. |Build status| image:: https://github.com/fusionbox/django-authtools/actions/workflows/ci.yml/badge.svg :target: https://github.com/fusionbox/django-authtools/actions/workflows/ci.yml :alt: Build Status
A custom user model app for Django 2.2+ that features email as username and other things. It tries to stay true to the built-in user model for the most part.
Read the django-authtools documentation <https://django-authtools.readthedocs.org/en/latest/>
_.
Before you use this, you should probably read the documentation about custom User models <https://docs.djangoproject.com/en/dev/topics/auth/customizing/#substituting-a-custom-user-model>
_.
Install the package:
.. code-block:: bash
$ pip install django-authtools
Add authtools
to your INSTALLED_APPS
.
Add the following to your settings.py:
.. code-block:: python
AUTH_USER_MODEL = 'authtools.User'
Enjoy.
SHA1PasswordHasher
deprecation warning for Django 4.0 and abovepkg_resources
deprecation warning for Python 3.8 and aboveubuntu-latest
** BREAKING **
Remove views and URLs. You can now use the ones built in to Django. Removes support for Django 1.11 and Python 2.
Added Django 1.7 compatibility (Antoine Catton, Rocky Meza, #35)
LoginView.disallow_authenticated
was changed to LoginView.allow_authenticated
LoginView.disallow_authenticated
was deprecated.
Backwards Incompatible: LoginView.allow_authenticated
is now True
by default (which is the default behavior in Django)
Create migrations for authtools.
If updating from an older authtools, these migrations must be run on your apps::
$ python manage.py migrate --fake authtools 0001_initial
$ python manage.py migrate
next
URL parameter (#24)name
field.Django 1.6 support.
Django 1.6 broke backwards compatibility <https://docs.djangoproject.com/en/dev/releases/1.6/#django-contrib-auth-password-reset-uses-base-64-encoding-of-user-pk>
_
of the password_reset_confirm
view. Be sure to update any references to
this URL. Rather than using a separate view for each encoding, authtools uses
a single view <https://django-authtools.readthedocs.org/en/latest/views.html#authtools.views.PasswordResetConfirmView>
_
that works with both.
Bugfix: if LOGIN_URL was a URL name, it wasn't being reversed in the PasswordResetConfirmView.
prefetch_related
in the
UserChangeForm <https://django-authtools.readthedocs.org/en/latest/forms.html#authtools.forms.UserChangeForm>
_
to avoid doing hundreds of ContentType
queries. The form from
Django has the same feature, it wasn't copied over correctly in our
original form.UserManager.normalize_email
on an instance, not a class.authtools.models.User
should inherit its parent's Meta
.FAQs
Custom user model app for Django featuring email as username.
We found that django-authtools demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.