为什么我无法验证除 django 中的超级用户之外的其他用户？

Question

我在 django 中使用默认的path('',include("django.contrib.auth.urls")) 为我的项目执行登录、密码重置操作，我已经彻底检查了我的注册表单和数据库，注册部分一切正常，但我无法验证所有除了超级用户之外的其他用户，这个问题可能是什么原因？

myproject/urls.py:

from django.contrib import admin
from django.urls import path,include

urlpatterns = [
    path('admin/', admin.site.urls),
    path('home/', include('home.urls')),
    path('accounts/',include('accounts.urls')),
    path('',include("django.contrib.auth.urls"))
]

在注册目录的模板中，我的登录表单看起来像

{% extends 'base.html' %}

{% block title %}Login{% endblock %}

{% block content %}
<h2>Login</h2>
<form method="post">
  {% csrf_token %}
  {{ form.as_p }}
  <button type="submit">Login</button>
</form>
{% endblock %}

我的注册视图是：

class UserFormView(View):
    form_class = RegForm
    template_name = 'signup.html'

    def get(self, request):
        form = self.form_class()
        return render(request, self.template_name, {'form': form})

    def post(self, request):
        form = self.form_class(request.POST)
        if (form.is_valid()):
            form.save()
            return redirect('login')
        return render(request, self.template_name, {'form': form})

然后是我的表格：

class RegForm(forms.ModelForm):
    password = forms.CharField(widget=forms.PasswordInput())
    confirm_password=forms.CharField(widget=forms.PasswordInput())
    class Meta:
        model= User
        fields=['first_name','last_name','username','email','date_joined','password','confirm_password']
    def clean_password(self):
        password=self.cleaned_data.get("password")
        confirm_password = self.cleaned_data.get("confirm_password")
        if(len(password)<8):
            raise forms.ValidationError("The length of the password should be minimum 8 characters")

        return password
    def clean_email(self):
        email=self.cleaned_data.get('email')
        if(validate_email(email)==False):
            raise forms.ValidationError("The Email Format is In Correct")
        return email
    def clean_confirm_password(self):
        password = self.cleaned_data.get("password")
        confirm_password = self.cleaned_data.get("confirm_password")
        if (password != confirm_password):
            raise forms.ValidationError('Password doesn\'t match')

Answer 1

正如我在 cmets 中所说，您需要像这样保存用户：

 def post(self, request):
    form = self.form_class(request.POST)
    if form.is_valid():
        user = form.save(commit=False)
        password = form.cleaned_data['password']
        user.set_password(password)
        user.save()
        return redirect('login')
    return render(request, self.template_name, {'form': form})

Answer 2

Django 期望 User 模型的 password 字段包含散列密码。您的表单以明文形式存储密码（这是一个很大的安全问题）。

我建议你看看django.contrib.auth.forms.UserCreationForm的source code，了解如何正确创建用户。

编辑：我猜你可以使用超级用户登录，因为你是用createsuperuser 命令创建的。

Answer 3

这是因为您错误地保存了密码。在 django 中，它对密码执行散列。您要么使用 django 用户密码字段（参考链接 https://docs.djangoproject.com/en/2.1/ref/contrib/auth/#django.contrib.auth.models.User.password），因此您的 RegForm 看起来像

class RegForm(forms.ModelForm):

    confirm_password=forms.CharField(widget=forms.PasswordInput())
    class Meta:
        model= User
        fields=['first_name','last_name','username','email','date_joined','password','confirm_password']
    def clean_password(self):
        password=self.cleaned_data.get("password")
        confirm_password = self.cleaned_data.get("confirm_password")
        if(len(password)<8):
            raise forms.ValidationError("The length of the password should be minimum 8 characters")

        return password
    def clean_email(self):
        email=self.cleaned_data.get('email')
        if(validate_email(email)==False):
            raise forms.ValidationError("The Email Format is In Correct")
        return email
    def clean_confirm_password(self):
        password = self.cleaned_data.get("password")
        confirm_password = self.cleaned_data.get("confirm_password")
        if (password != confirm_password):
            raise forms.ValidationError('Password doesn\'t match')

或者

在 post 方法中保存输入密码的哈希值。所以代码看起来像

def post(self, request):
    form = self.form_class(request.POST)
    if (form.is_valid()):
        user_form = form.save(commit=False)
        user_form.set_password(request.POST.get('password'))
        user_form.save()
        return redirect('login')
    return render(request, self.template_name, {'form': form})