check_password() from a user again

Question

I have the following form. How can I check the password from the user again, before the user can change his email address finally? Even if the user is logged in, I just want to be sure that it is really the user. Just a security thing.

How do I do it with .check_password()?

'EmailChangeForm' object has no attribute 'user'

/home/craphunter/workspace/project/trunk/project/auth/user/email_change/forms.py in clean_password, line 43

from django import forms
from django.db.models.loading import cache
from django.utils.translation import ugettext_lazy as _
from django.contrib.auth.models import User


class EmailChangeForm(forms.Form):
    
    email = forms.EmailField(label='New E-mail', max_length=75)
    password = forms.CharField(widget=forms.PasswordInput)

    def __init__(self, user, *args, **kwargs):
        super(EmailChangeForm, self).__init__(*args, **kwargs)
        self.user = user

    def clean_password(self):
        valid = self.user.check_password(self.cleaned_data['password'])
        if not valid:
            raise forms.ValidationError("Password Incorrect")
        return valid
    
    def __init__(self, username=None, *args, **kwargs):
        """Constructor.
        
        **Mandatory arguments**
        
        ``username``
            The username of the user that requested the email change.
        
        """
        self.username = username
        super(EmailChangeForm, self).__init__(*args, **kwargs)
    
    def clean_email(self):
        """Checks whether the new email address differs from the user's current
        email address.
        
        """
        email = self.cleaned_data.get('email')
        
        User = cache.get_model('auth', 'User')
        user = User.objects.get(username__exact=self.username)
        
        # Check if the new email address differs from the current email address.
        if user.email == email:
            raise forms.ValidationError('New email address cannot be the same \
                as your current email address')
        
        return email

Answer 1

I would refactor your code to look something like this:

View:

@login_required def view(request, extra_context=None, ...):      form = EmailChangeForm(user=request.user, data=request.POST or None)      if request.POST and form.is_valid():         send_email_change_request(request.user,                                   form.cleaned_data['email'],                                   https=request.is_secure())         return redirect(success_url)     ... 

Password validation goes to form:

class EmailChangeForm(Form):     email = ...     old_password = CharField(..., widget=Password())      def __init__(self, user, data=None):         self.user = user         super(EmailChangeForm, self).__init__(data=data)      def clean_old_password(self):         password = self.cleaned_data.get('password', None)         if not self.user.check_password(password):             raise ValidationError('Invalid password') 

Extract logic from view:

 def send_email_change_request(user, new_email, https=True):      site = cache.get_model('sites', 'Site')      email = new_email     verification_key = generate_key(user, email)      current_site = Site.objects.get_current()     site_name = current_site.name     domain = current_site.domain      protocol = 'https' if https else 'http'      # First clean all email change requests made by this user     qs = EmailChangeRequest.objects.filter(user=request.user)     qs.delete()      # Create an email change request     change_request = EmailChangeRequest(        user = request.user,        verification_key = verification_key,        email = email     )     change_request.save()      # Prepare context     c = {         'email': email,         'site_domain': 'dev.tolisto.de',         'site_name': 'tolisto',         'user': self.user,         'verification_key': verification_key,         'protocol': protocol,     }     c.update(extra_context)     context = Context(c)      # Send success email     subject = "Subject" # I don't think that using template for                          # subject is good idea     message = render_to_string(email_message_template_name, context_instance=context)      send_mail(subject, message, None, [email]) 

Don't put complicated things inside views (such as rendering and sending email).

Answer 2

I feel like you answered your own question : )

The docs on the check_password method are here: https://docs.djangoproject.com/en/dev/topics/auth/customizing/#django.contrib.auth.models.AbstractBaseUser.check_password

success = user.check_password(request.POST['submitted_password']) if success:     # do your email changing magic else:    return http.HttpResponse("Your password is incorrect")     # or more appropriately your template with errors 

Since you're already passing in request.user into your form constructor (looks like you've overriden __init__ for your own reasons) you could put all of your logic in the form without any trouble.

class MyForm(forms.Form):      # ...      password = forms.CharField(widget=forms.PasswordInput)            def __init__(self, user, *args, **kwargs):           super(MyForm, self).__init__(*args, **kwargs)           self.user = user                 def clean_password(self):          valid = self.user.check_password(self.cleaned_data['password'])          if not valid:              raise forms.ValidationError("Password Incorrect")          return valid 

update after seeing your forms

OK. The main problem is that __init__ has been defined twice, making the first statement useless. Second problem I see is that we'd be doing multiple queries for user when we really don't have to.

We've strayed from your original question quite a bit, but hopefully this is a learning experience.

I've changed only a few things:

• Removed the extra __init__ definition
• Changed __init__ to accept a User instance instead of a text username
• Removed the query for User.objects.get(username=username) since we're passing in a user object.

Just remember to pass the form constructor user=request.user instead of username=request.user.username

class EmailChangeForm(forms.Form):     email = forms.EmailField(label='New E-mail', max_length=75)     password = forms.CharField(widget=forms.PasswordInput)          def __init__(self, user=None, *args, **kwargs):         self.user = user         super(EmailChangeForm, self).__init__(*args, **kwargs)              def clean_password(self):         valid = self.user.check_password(self.cleaned_data['password'])         if not valid:             raise forms.ValidationError("Password Incorrect")              def clean_email(self):         email = self.cleaned_data.get('email')                  # no need to query a user object if we're passing it in anyways.         user = self.user                   # Check if the new email address differs from the current email address.         if user.email == email:             raise forms.ValidationError('New email address cannot be the same \                 as your current email address')                          return email 

Finally since we're talking about good practice here, I'd recommend following through with Skirmantas suggestions about moving your current view code to a form method so you can simply call myform.send_confirmation_email.

Sounds like a good exercise!

Answer 3

thanks again to Yuji. It works when I don't have in my first def __init__ the variable user. I also added in def clean_password the first 2 lines from the def clean_email

from django import forms
from django.db.models.loading import cache
from django.utils.translation import ugettext_lazy as _
from django.contrib.auth.models import User


class EmailChangeForm(forms.Form):

    email = forms.EmailField(label='New E-mail', max_length=75)
    password = forms.CharField(widget=forms.PasswordInput)

    def __init__(self, *args, **kwargs):
        self.user = user
        super(EmailChangeForm, self).__init__(*args, **kwargs)

    def clean_password(self):
        User = cache.get_model('auth', 'User')
        user = User.objects.get(username__exact=self.username)
        valid = user.check_password(self.cleaned_data['password'])
        if not valid:
            raise forms.ValidationError("Password Incorrect")
        return valid

    def __init__(self, username=None, *args, **kwargs):
        """Constructor.

        **Mandatory arguments**

        ``username``
            The username of the user that requested the email change.

        """
        self.username = username
        super(EmailChangeForm, self).__init__(*args, **kwargs)

    def clean_email(self):
        """Checks whether the new email address differs from the user's current
        email address.

        """
        email = self.cleaned_data.get('email')

        User = cache.get_model('auth', 'User')
        user = User.objects.get(username__exact=self.username)

        # Check if the new email address differs from the current email address.
        if user.email == email:
            raise forms.ValidationError('New email address cannot be the same \
                as your current email address')

        return email