Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Block API endpoints access to users when their password has been invalidated by a superuser #4573

Merged
merged 29 commits into from Sep 7, 2023

Conversation

noliveleger
Copy link
Contributor

@noliveleger noliveleger commented Aug 8, 2023

Related issues

Closes #4473

@noliveleger noliveleger changed the base branch from feature/password-complexity to 4477-invalidated-password-screen August 8, 2023 13:51
@noliveleger noliveleger marked this pull request as draft August 8, 2023 13:51
Base automatically changed from 4477-invalidated-password-screen to feature/password-complexity August 8, 2023 19:01
@noliveleger noliveleger changed the base branch from feature/password-complexity to beta August 8, 2023 19:38
@noliveleger noliveleger changed the base branch from beta to feature/password-complexity August 8, 2023 19:38
@noliveleger noliveleger force-pushed the 4473-block-api-with-invalid-password branch from e2062bf to 78791db Compare August 8, 2023 19:44
@noliveleger noliveleger changed the title WIP - 4473 block api with invalid password Block access to API endpoints to users when their password has been invalidated by a superuser Aug 8, 2023
@noliveleger noliveleger changed the title Block access to API endpoints to users when their password has been invalidated by a superuser Block API endpoints access to users when their password has been invalidated by a superuser Aug 8, 2023
@noliveleger noliveleger marked this pull request as ready for review August 8, 2023 20:02
@noliveleger noliveleger requested a review from jnm August 8, 2023 20:02
@noliveleger noliveleger added API Changes related to API endpoints Back end blocked labels Aug 8, 2023
kpi/serializers/current_user.py Outdated Show resolved Hide resolved
@jnm jnm self-requested a review August 30, 2023 05:52
Copy link
Member

@jnm jnm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

When I try to unset validated_password in the admin interface, it blocks me saying that fields are required—but they shouldn't be:
image

@jnm
Copy link
Member

jnm commented Aug 30, 2023

Discovered by accident: if you become logged out somehow and then attempt to change your password from within the SPA, you get a 500 error: NotImplementedError: Django doesn't provide a DB representation for AnonymousUser. It comes from

if not self.instance.check_password(current_password):

@jnm jnm merged commit 5cd9f6b into feature/password-complexity Sep 7, 2023
4 checks passed
@jnm jnm deleted the 4473-block-api-with-invalid-password branch September 7, 2023 15:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
API Changes related to API endpoints Back end
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants