再次检查用户的密码（）

Question

我有以下表格。在用户最终更改其电子邮件地址之前，如何再次检查用户的密码。即使他已经登录，我也只想确定他是真正的用户。只是一件安全的事。

我怎么处理.check_password()？

    'EmailChangeForm' object has no attribute 'user'

    /home/craphunter/workspace/project/trunk/project/auth/user/email_change/forms.py in clean_password, line 43

from django import forms
from django.db.models.loading import cache
from django.utils.translation import ugettext_lazy as _
from django.contrib.auth.models import User


class EmailChangeForm(forms.Form):

    email = forms.EmailField(label='New E-mail', max_length=75)
    password = forms.CharField(widget=forms.PasswordInput)

    def __init__(self, user, *args, **kwargs):
        super(EmailChangeForm, self).__init__(*args, **kwargs)
        self.user = user

    def clean_password(self):
        valid = self.user.check_password(self.cleaned_data['password'])
        if not valid:
            raise forms.ValidationError("Password Incorrect")
        return valid

    def __init__(self, username=None, *args, **kwargs):
        """Constructor.

        **Mandatory arguments**

        ``username``
            The username of the user that requested the email change.

        """
        self.username = username
        super(EmailChangeForm, self).__init__(*args, **kwargs)

    def clean_email(self):
        """Checks whether the new email address differs from the user's current
        email address.

        """
        email = self.cleaned_data.get('email')

        User = cache.get_model('auth', 'User')
        user = User.objects.get(username__exact=self.username)

        # Check if the new email address differs from the current email address.
        if user.email == email:
            raise forms.ValidationError('New email address cannot be the same \
                as your current email address')

        return email

Answer 1

我觉得你回答了你自己的问题：）

关于check_password方法的文档如下： http://docs.djangoproject.com/en/dev/topics/auth/#django.contrib.auth.models.User.check_password

success = user.check_password(request.POST['submitted_password'])
if success: 
   # do your email changing magic
else:
   return http.HttpResponse("Your password is incorrect") 
   # or more appropriately your template with errors

由于您已经将request.user传递到表单构造函数中（看起来您已经出于自己的原因重写了__init__），因此您可以毫无困难地将所有逻辑放入表单中。

class MyForm(forms.Form):
     # ...
     password = forms.CharField(widget=forms.PasswordInput)

     def __init__(self, user, *args, **kwargs):
          super(MyForm, self).__init__(*args, **kwargs)
          self.user = user

     def clean_password(self):
         valid = self.user.check_password(self.cleaned_data['password'])
         if not valid:
             raise forms.ValidationError("Password Incorrect")
         return valid

查看表单后更新

好的。主要问题是__init__被定义了两次，使得第一条语句无用。我看到的第二个问题是，当我们真的不需要时，我们将对user执行多个查询。

我们有点偏离了你最初的问题，但希望这是一个学习的经验。

我只改变了几件事：

• 删除了额外的__init__定义
• 将__init__更改为接受User实例而不是文本username
• 因为我们传入了一个用户对象，所以删除了对User.objects.get(username=username)的查询。

只需记住传递表单构造函数user=request.user，而不是username=request.user.username

class EmailChangeForm(forms.Form):
    email = forms.EmailField(label='New E-mail', max_length=75)
    password = forms.CharField(widget=forms.PasswordInput)

    def __init__(self, user=None, *args, **kwargs):
        self.user = user
        super(EmailChangeForm, self).__init__(*args, **kwargs)

    def clean_password(self):
        valid = self.user.check_password(self.cleaned_data['password'])
        if not valid:
            raise forms.ValidationError("Password Incorrect")

    def clean_email(self):
        email = self.cleaned_data.get('email')

        # no need to query a user object if we're passing it in anyways.
        user = self.user 

        # Check if the new email address differs from the current email address.
        if user.email == email:
            raise forms.ValidationError('New email address cannot be the same \
                as your current email address')

        return email

最后，由于我们在这里讨论的是良好的实践，我建议您按照Skirmantas的建议将当前视图代码移动到表单方法中，这样您就可以简单地调用myform.send_confirmation_email。

听起来是个不错的锻炼！