Question

我正在尝试在Django中构建自定义用户模型。我的 models.py 如下所示：

class UserManager(BaseUserManager):

    def _create_user(self, username, email, password, is_staff, is_superuser, **extra_fields):
        now = timezone.now()
        if not username:
            raise ValueError(_('The given username must be set'))
        if not email:
            raise ValueError(_('The given email must be set'))
        email = self.normalize_email(email)
        user = self.model(
            username=username, email=email,
            is_staff=is_staff, is_active=False,
            is_superuser=is_superuser, last_login=now,
            date_joined=now, **extra_fields
        )
        user.set_password(password)
        user.save(using=self._db)
        return user

    def create_user(self, username, email, password=None, **extra_fields):
        return self._create_user(username, email, password, False, False, **extra_fields)

    def create_superuser(self, username, email, password, **extra_fields):
        user=self._create_user(username, email, password, True, True, **extra_fields)
        user.is_active=True
        user.save(using=self._db)
        return user

class User(AbstractBaseUser, PermissionsMixin):
    # Standard fields
    username = models.CharField(_('username'), max_length=30, unique=True,
        help_text=_('Required. 30 characters or fewer. Letters, numbers and @/./+/-/_ characters'),
        validators=[
        validators.RegexValidator(re.compile('^[\w.@+-]+$'), _('Enter a valid username.'), _('invalid'))
    ])
    first_name = models.CharField(_('first name'), max_length=30, blank=True, null=True)
    last_name = models.CharField(_('last name'), max_length=30, blank=True, null=True)
    email = models.EmailField(_('email address'), max_length=255)
    is_staff = models.BooleanField(_('staff status'), default=False,
        help_text=_('Designates whether the user can log into this admin site.'))
    is_active = models.BooleanField(_('active'), default=True,
        help_text=_('Designates whether this user should be treated as active. Unselect this instead of deleting accounts.'))
    date_joined = models.DateTimeField(_('date joined'), default=timezone.now)

    # Custom fields
    is_publisher = models.BooleanField(_('publisher status'), default=False)

    # User manager
    objects = UserManager()

    USERNAME_FIELD = 'username'
    REQUIRED_FIELDS = ['email']

    class Meta:
        verbose_name = _('user')
        verbose_name_plural = _('users')

    def get_full_name(self):
        full_name = '%s %s' % (self.first_name, self.last_name)
        return full_name.strip()

    def get_short_name(self):
        return self.first_name

    def email_user(self, subject, message, from_email=None):
        send_mail(subject, message, from_email, [self.email])

无论如何，如果我使用createsuperuser命令创建超级用户，一切正常：创建用户，并正确地对密码进行哈希处理并保护。但是，如果我从管理面板创建用户，则创建的用户将完全公开他/她的密码。此外，确认密码字段不会显示，它在Django中使用的常规用户模型中显示。我怎么解决这个问题？

另外，是的，我的settings.py中有AUTH_USER_MODEL ='myapp.User'。

Answer 1

您需要自定义ModelForm和ModelAdmin来创建/更新用户模型项。

请参阅：Custom User Models with Admin Site

Answer 2

def home(request): if request.method == 'POST': uf = UserForm(request.POST, prefix='user') upf = UserProfileForm(request.POST, prefix='userprofile') if uf.is_valid() * upf.is_valid(): userform = uf.save(commit=False) userform.password = make_password(uf.cleaned_data['password']) userform.save() messages.success(request, 'successful Registration', extra_tags='safe') else: uf = UserForm(prefix='user') return render_to_response('base.html', dict(userform=uf ), context_instance=RequestContext(request))

在你的views.py中尝试使用它并在forms.py中尝试从django表单获取密码。希望这有效

Answer 3

没有自定义代码且可直接访问password字段的表单直接写入密码字段。 没有调用createuser或createsuperuser ，因此永远不会调用set_password（默认情况下，ModelForm在其中调用save时会调用模型中的save）。回想一下，写入用户密码不会写出安全密码（这就是createuser和createsuperuser在某处调用set_password的原因。要做到这一点，请避免直接在字段上书写，而是调用：

myuserinstance.set_password('new pwd')
# not this:
# myuserinstance.password = 'new pwd'

因此，您必须在自定义表单中使用自定义逻辑。 See the implementation for details; you will notice those forms have custom logic calling set_password and check_password。 Django中的BTW默认UserAdmin以两个步骤创建用户：user / password / password_confirm（此类密码创建），然后是整个用户数据。有一个非常自定义的实现。

在Django中使用自定义用户模型时，为什么我的密码不受保护？

3 个答案: