How to set-up django-registration that an account needs to be manually activated?

Question

How to set-up django-registration that an account needs to be manually activated by an admin?

After the account-holder clicks in the link in the e-mail I would like that an e-mail is sent to the admin, and he also needs to click a link and only then the account would be active.

Is it possible with django-registration, or do I need to use something else, and what to use?

Answer 1

django-registration allows you to write a custom backend to handle custom activation needs.

So what you'd do is create your own backend, implementing the register and activate yourself.

Here's an example of how you could implement the register function:

def register(self, request, **kwargs):
    username, email, password = kwargs['username'], kwargs['email'], kwargs['password1']
    if Site._meta.installed:
        site = Site.objects.get_current()
    else:
        site = RequestSite(request)
    new_user = RegistrationProfile.objects.create_inactive_user(username, email,
                                                                password, site, 
                                                                send_email=False)
    # send an email to the admins with user information
    send_new_user_notification(new_user) # you would write this function
    signals.user_registered.send(sender=self.__class__,
                                 user=new_user,
                                 request=request)
    return new_user

The key point is to make sure send_email is set to false; that will prevent the user from getting an activation link. Then you can decide whether the email sent to the admins has an activation link or if you're content with them going to admin and just checking the "Active" box.

If you use AuthenticationForm from django.contrib.auth then it will automatically reject users whose is_active is False, but if you're not using that then make sure to run the following check for any request where an active user is required:

def restricted_view(request):
    if request.user and request.user.is_active:
        #continue with the code

You can also write your own decorator (look at @login_required for pointers). Note that @login_required does not check for is_active.