Commit Graph

17 Commits

Author SHA1 Message Date
Raphael Michel
af23d6e4bf Upgrade to Django 3.0 and other dependencies (#1568)
* Upgrade Django to 3.0 and other dependencies to recent versions

* Fix otp version contsraint

* Remove six dependency

* Resolve some warnings

* Fix failing tests

* Update django-countries

* Resolve all RemovedInDjango31Warnings in test suite

* Run isort

* Fix import

* Update PostgreSQL version on travis
2020-03-23 15:02:20 +01:00
Maico Timmerman
82feca6e38 Fix #1521 -- External authenticated users cannot delete events (#1523)
* Remove check password for event deletion, instead require recent login.

* Reauthenticate for backends using authentication_url.

* Require recent login for data shredder and prompt slug instead of password.

* Fix tests for recent login required on event delete and data shred.

* Pull request remarks for recent login required for event delete and data shred.

* Remove unused imported check_password.
2019-12-16 10:45:01 +01:00
Maico Timmerman
28242e52aa Fix #1522 -- Login button redirects to authentication url with… (#1525) 2019-12-16 10:42:51 +01:00
Raphael Michel
8a6a515b6a Refs #775 -- Pluggable authentication backends (#1447)
* Drag-and-drop: Force csrf_token to be present

* Rough design

* Missing file

* b.visble

* Forms

* Docs

* Tests

* Fix variable
2019-10-17 09:11:03 +02:00
Sohalt
591ed969b8 Autofocus login form (#1346) 2019-07-22 14:31:18 +02:00
Raphael Michel
01a6861453 Always query emails case-insensitively 2019-01-02 15:12:48 +01:00
Lukas Bockstaller
a643abe293 Prevent email enumeration (#1000)
Here is my attempt to prevent user enumeration. 
I've made the following changes:

**Application:**
- replaces success and failure messages in the form with two (with/without redis) information messages 
- adds logging for attempted password resets of unknown users
- adds logging for failing emails

**Tests:**
- test_unknown asserts a redirect instead of a ok
- adds test_email_reset_twice_redis to assert the correct logging of a twice reset email 
- adds a FakeRedis class similiar to the one implemented in test_metrics.py. I could refactor them into the testutils folder if prefered. 

Please excuse the commit mess. I am currently fighting with my tooling.
2018-08-31 10:28:39 +02:00
Raphael Michel
afd766999c Upgrade to Django 2.1 (#710)
* Upgrade to Django 2.0

* more models

* i18n foo

* Update setup.py

* Fix Sentry exception PRETIXEU-JC

* Enforce slug uniqueness

* Import sorting

* Upgrade to Django 2.1

* Travis config

* Try to fix PostgreSQL failure

* Smaller test matrix

* staticfiles→static

* Include request in all authenticate() calls
2018-08-06 12:48:46 +02:00
Raphael Michel
2f15d410fe Add optional timeouts for backend sessions 2017-09-04 19:50:32 +02:00
Tobias Kunze
bfc721978d Fixed minor documentation errors and mistakes (#151) 2016-07-14 20:01:38 +02:00
Raphael Michel
09e5c43c55 Fixed #143 -- Password strength validation errors in the right place 2016-06-10 15:33:32 +02:00
Raphael Michel
e5edf53f00 Disable Chrome's autofill for various form fields 2016-06-06 23:07:49 +02:00
Jason Estibeiro
e685f8e819 Added basic Django password validations and updated .gitignore (#136) 2016-05-11 13:38:31 +02:00
Raphael Michel
79ad8b40ed Added python3.5-style type annotations to pretix.base 2015-11-04 23:39:59 +01:00
Raphael Michel
c47008cc18 Added password reset to control.auth 2015-10-04 13:52:08 +02:00
Raphael Michel
264c1e034f Used Django's token generator for passwort resets 2015-09-29 00:59:33 +02:00
Raphael Michel
7def097dcd Refs #96 -- Completely removed local users 2015-09-17 00:55:00 +02:00