Django密码更改表格为旧密码管理员提供错误的POST值

时间:2016-05-06 07:10:52

标签: python django django-templates django-admin

我使用以下方法创建了密码更改表单的链接:

<a href="{% url 'web_password_change' %}">{% trans 'Change password' %}</a>

并将其包含在urls.py中:

from django.contrib.auth import views as auth_views

url(r'^password_change', auth_views.password_change, {"template_name": "web/password_change_form.html"}, name='web_password_change'),

我的密码更改表格是:

{% extends "base_site.html" %}
{% load i18n static bootstrapped_goodies_tags %}
{% load url from future %}
{% block extrastyle %}{{ block.super }}<link rel="stylesheet" type="text/css" href="{% static "admin/css/forms.css" %}" />{% endblock %}
{% block breadcrumbs %}
<ul class="breadcrumb">
<li><a href="{% url 'web_index' %}">{% trans 'Home' %}</a></li>
<li>{% trans 'Password change' %}</li>
</ul>
{% endblock %}

{% block title %}{% trans 'Password change' %}{% endblock %}
{% block content_title %}<a class="navbar-brand">{% trans 'Password change' %}</a>{% endblock %}

{% block content %}<div id="content-main">

<form class="form-horizontal" action="" method="post">{% csrf_token %}
{% if form.errors %}
<div class="alert alert-danger">
    {% if form.errors.items|length == 1 %}{% trans "Please correct the error below." %}{% else %}{% trans "Please correct the errors below." %}{% endif %}
</div>
{% endif %}

<div class="alert alert-info">{% trans "Please enter your old password, for security's sake, and then enter your new password twice so we can verify you typed it in correctly." %}</div>

<fieldset class="_module _aligned wide">

<div class="form-group">
    <div class="control-label col-sm-2">
        {{ form.old_password.label_tag }}
    </div>
    <div class="controls col-sm-10">
        {% dab_field_rendering form.old_password %}
        {% if form.old_password.errors %}<span class="text-danger">{{ form.old_password.errors|striptags }}</span>{% endif %}
    </div>
</div>

<div class="form-group">
    <div class="control-label col-sm-2">
        {{ form.new_password1.label_tag }}
    </div>
    <div class="controls col-sm-10">
        {% dab_field_rendering form.new_password1 %}
        {% if form.new_password1.errors %} <span class="text-danger">{{ form.new_password1.errors|striptags }}</span>{% endif %}
        {% if form.new_password1.help_text %}<span class="text-info">{{ form.new_password1.help_text }}</span>{% endif %}
    </div>
</div>

<div class="form-group">
    <div class="control-label col-sm-2">
        {{ form.new_password2.label_tag }}
    </div>
    <div class="controls col-sm-10">
        {% dab_field_rendering form.new_password2 %}
        {% if form.new_password2.errors %} <span class="text-danger">{{ form.new_password2.errors|striptags }}</span>{% endif %}
        {% if form.new_password2.help_text %}<span class="text-info">{{ form.new_password2.help_text }}</span>{% endif %}
    </div>
</div>

</fieldset>

<div class="form-actions">
    <div class="controls col-sm-offset-2 col-sm-10">
        <input type="submit" value="{% trans 'Change my password' %}" class="default btn btn-primary" />
    </div>
</div>

<script type="text/javascript">document.getElementById("id_old_password").focus();</script>
</form></div>

{% endblock %}

问题是: 它适用于所有网络用户,但如果我以管理员身份登录然后更改密码,请说出原始密码是:'admin'...现在我将其更改为'1234',它可以工作,我可以再次登录。

但是当我再次转到change_password并尝试从'1234'更改为其他内容时,它会给出'不正确的旧密码'。

在调试时,我发现收到的POST请求的old_password字段值为'admin',而我输入'1234'。

当我尝试在html页面上添加另一个字段并更新old_password部分时,如下所示:

<div class="form-group">
    <div class="control-label col-sm-2">
        {{ form.old_password.label_tag }}
    </div>
    <div class="controls col-sm-10">
        {% dab_field_rendering form.old_password %}
        {{ form.old_password }}
        {% if form.old_password.errors %}<span class="text-danger">{{ form.old_password.errors|striptags }}</span>{% endif %}
    </div>
</div>

它完全正常并收到正确的请求,但我不能要求用户输入两次旧密码。

0 个答案:

没有答案