mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-07-24 13:44:32 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Fixed #24855 -- Allowed using contrib.auth.login() without credentials.

Browse source 
Added an optional `backend` argument to login().
This commit is contained in:
Paulo Poiati 2015-07-05 17:54:25 -03:00 • committed by Tim Graham
parent bd3c2900fc
commit b643386668
7 changed files with 95 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

41
docs/topics/auth/default.txt
View file

@ -322,7 +322,7 @@ How to log a user in
If you have an authenticated user you want to attach to the current session
- this is done with a :func:`~django.contrib.auth.login` function.
.. function:: login(request, user)
.. function:: login(request, user, backend=None)
To log a user in, from a view, use :func:`~django.contrib.auth.login()`. It
takes an :class:`~django.http.HttpRequest` object and a
@ -354,18 +354,35 @@ If you have an authenticated user you want to attach to the current session
# Return an 'invalid login' error message.
...
.. admonition:: Calling ``authenticate()`` first
.. versionchanged:: 1.10
When you're manually logging a user in, you *must* successfully authenticate
the user with :func:`~django.contrib.auth.authenticate()` before you call
:func:`~django.contrib.auth.login()`.
:func:`~django.contrib.auth.authenticate()`
sets an attribute on the :class:`~django.contrib.auth.models.User` noting
which authentication backend successfully authenticated that user (see the
:ref:`backends documentation <authentication-backends>` for details), and
this information is needed later during the login process. An error will be
raised if you try to login a user object retrieved from the database
directly.
In older versions, when you're manually logging a user in, you *must*
successfully authenticate the user with
:func:`~django.contrib.auth.authenticate()` before you call
:func:`~django.contrib.auth.login()`. Now you can set the backend using
the new ``backend`` argument.
Selecting the :ref:`authentication backend <authentication-backends>`
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
When a user logs in, the user's ID and the backend that was used for
authentication are saved in the user's session. This allows the same
authentication backend to fetch the user's details on a future request. The
authentication backend to save in the session is selected as follows:
#. Use the value of the optional ``backend`` argument, if provided.
#. Use the value of the ``user.backend`` attribute, if present. This allows
pairing :func:`~django.contrib.auth.authenticate()` and
:func:`~django.contrib.auth.login()`:
:func:`~django.contrib.auth.authenticate()`
sets the ``user.backend`` attribute on the ``User`` object it returns.
#. Use the ``backend`` in :setting:`AUTHENTICATION_BACKENDS`, if there is only
one.
#. Otherwise, raise an exception.
In cases 1 and 2, the value of the ``backend`` argument or the ``user.backend``
attribute should be a dotted import path string (like that found in
:setting:`AUTHENTICATION_BACKENDS`), not the actual backend class.
How to log a user out
---------------------