123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205 |
- import functools
- import gzip
- import re
- from difflib import SequenceMatcher
- from pathlib import Path
-
- from django.conf import settings
- from django.core.exceptions import (
- FieldDoesNotExist, ImproperlyConfigured, ValidationError,
- )
- from django.utils.functional import lazy
- from django.utils.html import format_html, format_html_join
- from django.utils.module_loading import import_string
- from django.utils.translation import gettext as _, ngettext
-
-
- @functools.lru_cache(maxsize=None)
- def get_default_password_validators():
- return get_password_validators(settings.AUTH_PASSWORD_VALIDATORS)
-
-
- def get_password_validators(validator_config):
- validators = []
- for validator in validator_config:
- try:
- klass = import_string(validator['NAME'])
- except ImportError:
- msg = "The module in NAME could not be imported: %s. Check your AUTH_PASSWORD_VALIDATORS setting."
- raise ImproperlyConfigured(msg % validator['NAME'])
- validators.append(klass(**validator.get('OPTIONS', {})))
-
- return validators
-
-
- def validate_password(password, user=None, password_validators=None):
- """
- Validate whether the password meets all validator requirements.
-
- If the password is valid, return ``None``.
- If the password is invalid, raise ValidationError with all error messages.
- """
- errors = []
- if password_validators is None:
- password_validators = get_default_password_validators()
- for validator in password_validators:
- try:
- validator.validate(password, user)
- except ValidationError as error:
- errors.append(error)
- if errors:
- raise ValidationError(errors)
-
-
- def password_changed(password, user=None, password_validators=None):
- """
- Inform all validators that have implemented a password_changed() method
- that the password has been changed.
- """
- if password_validators is None:
- password_validators = get_default_password_validators()
- for validator in password_validators:
- password_changed = getattr(validator, 'password_changed', lambda *a: None)
- password_changed(password, user)
-
-
- def password_validators_help_texts(password_validators=None):
- """
- Return a list of all help texts of all configured validators.
- """
- help_texts = []
- if password_validators is None:
- password_validators = get_default_password_validators()
- for validator in password_validators:
- help_texts.append(validator.get_help_text())
- return help_texts
-
-
- def _password_validators_help_text_html(password_validators=None):
- """
- Return an HTML string with all help texts of all configured validators
- in an <ul>.
- """
- help_texts = password_validators_help_texts(password_validators)
- help_items = format_html_join('', '<li>{}</li>', ((help_text,) for help_text in help_texts))
- return format_html('<ul>{}</ul>', help_items) if help_items else ''
-
-
- password_validators_help_text_html = lazy(_password_validators_help_text_html, str)
-
-
- class MinimumLengthValidator:
- """
- Validate whether the password is of a minimum length.
- """
- def __init__(self, min_length=8):
- self.min_length = min_length
-
- def validate(self, password, user=None):
- if len(password) < self.min_length:
- raise ValidationError(
- ngettext(
- "This password is too short. It must contain at least %(min_length)d character.",
- "This password is too short. It must contain at least %(min_length)d characters.",
- self.min_length
- ),
- code='password_too_short',
- params={'min_length': self.min_length},
- )
-
- def get_help_text(self):
- return ngettext(
- "Your password must contain at least %(min_length)d character.",
- "Your password must contain at least %(min_length)d characters.",
- self.min_length
- ) % {'min_length': self.min_length}
-
-
- class UserAttributeSimilarityValidator:
- """
- Validate whether the password is sufficiently different from the user's
- attributes.
-
- If no specific attributes are provided, look at a sensible list of
- defaults. Attributes that don't exist are ignored. Comparison is made to
- not only the full attribute value, but also its components, so that, for
- example, a password is validated against either part of an email address,
- as well as the full address.
- """
- DEFAULT_USER_ATTRIBUTES = ('username', 'first_name', 'last_name', 'email')
-
- def __init__(self, user_attributes=DEFAULT_USER_ATTRIBUTES, max_similarity=0.7):
- self.user_attributes = user_attributes
- self.max_similarity = max_similarity
-
- def validate(self, password, user=None):
- if not user:
- return
-
- for attribute_name in self.user_attributes:
- value = getattr(user, attribute_name, None)
- if not value or not isinstance(value, str):
- continue
- value_parts = re.split(r'\W+', value) + [value]
- for value_part in value_parts:
- if SequenceMatcher(a=password.lower(), b=value_part.lower()).quick_ratio() >= self.max_similarity:
- try:
- verbose_name = str(user._meta.get_field(attribute_name).verbose_name)
- except FieldDoesNotExist:
- verbose_name = attribute_name
- raise ValidationError(
- _("The password is too similar to the %(verbose_name)s."),
- code='password_too_similar',
- params={'verbose_name': verbose_name},
- )
-
- def get_help_text(self):
- return _("Your password can't be too similar to your other personal information.")
-
-
- class CommonPasswordValidator:
- """
- Validate whether the password is a common password.
-
- The password is rejected if it occurs in a provided list of passwords,
- which may be gzipped. The list Django ships with contains 20000 common
- passwords (lowercased and deduplicated), created by Royce Williams:
- https://gist.github.com/roycewilliams/281ce539915a947a23db17137d91aeb7
- The password list must be lowercased to match the comparison in validate().
- """
- DEFAULT_PASSWORD_LIST_PATH = Path(__file__).resolve().parent / 'common-passwords.txt.gz'
-
- def __init__(self, password_list_path=DEFAULT_PASSWORD_LIST_PATH):
- try:
- with gzip.open(str(password_list_path)) as f:
- common_passwords_lines = f.read().decode().splitlines()
- except IOError:
- with open(str(password_list_path)) as f:
- common_passwords_lines = f.readlines()
-
- self.passwords = {p.strip() for p in common_passwords_lines}
-
- def validate(self, password, user=None):
- if password.lower().strip() in self.passwords:
- raise ValidationError(
- _("This password is too common."),
- code='password_too_common',
- )
-
- def get_help_text(self):
- return _("Your password can't be a commonly used password.")
-
-
- class NumericPasswordValidator:
- """
- Validate whether the password is alphanumeric.
- """
- def validate(self, password, user=None):
- if password.isdigit():
- raise ValidationError(
- _("This password is entirely numeric."),
- code='password_entirely_numeric',
- )
-
- def get_help_text(self):
- return _("Your password can't be entirely numeric.")
|