Python 再次来自用户的 check_password()

check_password() from a user again

提问by craphunter

I do have the following form. How can I check the password from the user again, before the user can change his emailadsress finally. Even he is logged in, I just want to be sure that it is really the user. Just a securtiy thing.

我确实有以下表格。在用户最终可以更改他的电子邮件地址之前，我如何再次检查用户的密码。即使他已登录，我也只是想确定它确实是用户。只是一个安全的事情。

How do I do it with .check_password()?

我该怎么做.check_password()？

    'EmailChangeForm' object has no attribute 'user'

    /home/craphunter/workspace/project/trunk/project/auth/user/email_change/forms.py in clean_password, line 43

from django import forms
from django.db.models.loading import cache
from django.utils.translation import ugettext_lazy as _
from django.contrib.auth.models import User


class EmailChangeForm(forms.Form):

    email = forms.EmailField(label='New E-mail', max_length=75)
    password = forms.CharField(widget=forms.PasswordInput)

    def __init__(self, user, *args, **kwargs):
        super(EmailChangeForm, self).__init__(*args, **kwargs)
        self.user = user

    def clean_password(self):
        valid = self.user.check_password(self.cleaned_data['password'])
        if not valid:
            raise forms.ValidationError("Password Incorrect")
        return valid

    def __init__(self, username=None, *args, **kwargs):
        """Constructor.

        **Mandatory arguments**

        ``username``
            The username of the user that requested the email change.

        """
        self.username = username
        super(EmailChangeForm, self).__init__(*args, **kwargs)

    def clean_email(self):
        """Checks whether the new email address differs from the user's current
        email address.

        """
        email = self.cleaned_data.get('email')

        User = cache.get_model('auth', 'User')
        user = User.objects.get(username__exact=self.username)

        # Check if the new email address differs from the current email address.
        if user.email == email:
            raise forms.ValidationError('New email address cannot be the same \
                as your current email address')

        return email

采纳答案by Ski

I would refactor your code to look something like this:

我会重构你的代码看起来像这样：

View:

看法：

@login_required
def view(request, extra_context=None, ...):

    form = EmailChangeForm(user=request.user, data=request.POST or None)

    if request.POST and form.is_valid():
        send_email_change_request(request.user,
                                  form.cleaned_data['email'],
                                  https=request.is_secure())
        return redirect(success_url)
    ...

Password validation goes to form:

密码验证形成：

class EmailChangeForm(Form):
    email = ...
    old_password = CharField(..., widget=Password())

    def __init__(self, user, data=None):
        self.user = user
        super(EmailChangeForm, self).__init__(data=data)

    def clean_old_password(self):
        password = self.cleaned_data.get('password', None)
        if not self.user.check_password(password):
            raise ValidationError('Invalid password')

Extract logic from view:

从视图中提取逻辑：

 def send_email_change_request(user, new_email, https=True):

    site = cache.get_model('sites', 'Site')

    email = new_email
    verification_key = generate_key(user, email)

    current_site = Site.objects.get_current()
    site_name = current_site.name
    domain = current_site.domain

    protocol = 'https' if https else 'http'

    # First clean all email change requests made by this user
    qs = EmailChangeRequest.objects.filter(user=request.user)
    qs.delete()

    # Create an email change request
    change_request = EmailChangeRequest(
       user = request.user,
       verification_key = verification_key,
       email = email
    )
    change_request.save()

    # Prepare context
    c = {
        'email': email,
        'site_domain': 'dev.tolisto.de',
        'site_name': 'tolisto',
        'user': self.user,
        'verification_key': verification_key,
        'protocol': protocol,
    }
    c.update(extra_context)
    context = Context(c)

    # Send success email
    subject = "Subject" # I don't think that using template for 
                        # subject is good idea
    message = render_to_string(email_message_template_name, context_instance=context)

    send_mail(subject, message, None, [email])

Don't put complicated things inside views (such as rendering and sending email).

不要把复杂的东西放在视图中（比如渲染和发送电子邮件）。

回答by Yuji 'Tomita' Tomita

I feel like you answered your own question : )

我觉得你回答了你自己的问题:)

The docs on the check_passwordmethod are here: http://docs.djangoproject.com/en/dev/topics/auth/#django.contrib.auth.models.User.check_password

该check_password方法的文档在这里：http: //docs.djangoproject.com/en/dev/topics/auth/#django.contrib.auth.models.User.check_password

success = user.check_password(request.POST['submitted_password'])
if success: 
   # do your email changing magic
else:
   return http.HttpResponse("Your password is incorrect") 
   # or more appropriately your template with errors

Since you're already passing in request.user into your form constructor (looks like you've overriden __init__for your own reasons) you could put all of your logic in the form without any trouble.

由于您已经将 request.user 传递到表单构造函数中（看起来您__init__出于自己的原因已覆盖），因此您可以将所有逻辑放入表单中而不会遇到任何麻烦。

class MyForm(forms.Form):
     # ...
     password = forms.CharField(widget=forms.PasswordInput)

     def __init__(self, user, *args, **kwargs):
          super(MyForm, self).__init__(*args, **kwargs)
          self.user = user

     def clean_password(self):
         valid = self.user.check_password(self.cleaned_data['password'])
         if not valid:
             raise forms.ValidationError("Password Incorrect")
         return valid

update after seeing your forms

看到你的表格后更新

OK. The main problem is that __init__has been defined twice, making the first statement useless. Second problem I see is that we'd be doing multiple queries for userwhen we really don't have to.

好的。主要问题是__init__已经定义了两次，使得第一个语句无用。我看到的第二个问题是，user当我们真的不需要时，我们会进行多次查询。

We've strayed from your original question quite a bit, but hopefully this is a learning experience.

我们已经偏离了您最初的问题，但希望这是一次学习经验。

I've changed only a few things:

我只改变了几件事：

• Removed the extra __init__definition
• Changed __init__to accept a Userinstance instead of a text username
• Removed the query for User.objects.get(username=username)since we're passing in a user object.

• 删除了额外的__init__定义
• 更改__init__为接受User实例而不是文本username
• User.objects.get(username=username)因为我们传入了一个用户对象，所以删除了查询。

Just remember to pass the form constructor user=request.userinstead of username=request.user.username

只要记住传递表单构造函数user=request.user而不是username=request.user.username

class EmailChangeForm(forms.Form):
    email = forms.EmailField(label='New E-mail', max_length=75)
    password = forms.CharField(widget=forms.PasswordInput)

    def __init__(self, user=None, *args, **kwargs):
        self.user = user
        super(EmailChangeForm, self).__init__(*args, **kwargs)

    def clean_password(self):
        valid = self.user.check_password(self.cleaned_data['password'])
        if not valid:
            raise forms.ValidationError("Password Incorrect")

    def clean_email(self):
        email = self.cleaned_data.get('email')

        # no need to query a user object if we're passing it in anyways.
        user = self.user 

        # Check if the new email address differs from the current email address.
        if user.email == email:
            raise forms.ValidationError('New email address cannot be the same \
                as your current email address')

        return email

Finally since we're talking about good practice here, I'd recommend following through with Skirmantas suggestions about moving your current view code to a form method so you can simply call myform.send_confirmation_email.

最后，由于我们在这里讨论的是良好实践，我建议遵循 Skirmantas 的建议，将当前视图代码移动到表单方法，以便您可以简单地调用myform.send_confirmation_email.

Sounds like a good exercise!

听起来是个不错的锻炼！

回答by craphunter

thanks again to Yuji. It works when I don't have in my first def __init__the variable user. I also added in def clean_passwordthe first 2 lines from the def clean_email

再次感谢 Yuji。当我没有在我的第def __init__一个变量用户中时它起作用。我还添加def clean_password了前两行def clean_email

from django import forms
from django.db.models.loading import cache
from django.utils.translation import ugettext_lazy as _
from django.contrib.auth.models import User


class EmailChangeForm(forms.Form):

    email = forms.EmailField(label='New E-mail', max_length=75)
    password = forms.CharField(widget=forms.PasswordInput)

    def __init__(self, *args, **kwargs):
        self.user = user
        super(EmailChangeForm, self).__init__(*args, **kwargs)

    def clean_password(self):
        User = cache.get_model('auth', 'User')
        user = User.objects.get(username__exact=self.username)
        valid = user.check_password(self.cleaned_data['password'])
        if not valid:
            raise forms.ValidationError("Password Incorrect")
        return valid

    def __init__(self, username=None, *args, **kwargs):
        """Constructor.

        **Mandatory arguments**

        ``username``
            The username of the user that requested the email change.

        """
        self.username = username
        super(EmailChangeForm, self).__init__(*args, **kwargs)

    def clean_email(self):
        """Checks whether the new email address differs from the user's current
        email address.

        """
        email = self.cleaned_data.get('email')

        User = cache.get_model('auth', 'User')
        user = User.objects.get(username__exact=self.username)

        # Check if the new email address differs from the current email address.
        if user.email == email:
            raise forms.ValidationError('New email address cannot be the same \
                as your current email address')

        return email