Django密码重置电子邮件链接重定向到登录页面

Question

我使用自定义表单来覆盖Django模板，但当用户单击重置密码并收到带有密码重置链接的电子邮件时，等等(编辑后的问题将订单从reset-password更改为password-reset)

/reset/OA/50l-94673624f6b9fa5a060a/

单击该链接时，它将重定向到

/account/login/

它应该将他们引导到

/password-reset/confirm/

然后再到

/password-reset/complete/

单击重置链接时，命令行如下所示

GET /reset/OA/50l-94673624f6b9fa5a060a/ HTTP/1.1" 302 0
GET /account/login/ HTTP/1.1" 200 2237

LOGIN_EXEMPT_URLS

LOGIN_EXEMPT_URLS = {
    r'^account/logout/$',
    r'^account/register/$',
    r'^account/password-reset/$',
    r'^account/password-reset/done/$',
    r'^account/password-reset/confirm/(?P<uidb64>[0-9A-Za-z]+)-(?P<token>,+)/$',
    r'^account/password-reset/complete/$',

}

urls.py

app_name='accounts'

from django.conf.urls import url
from . import views
from django.contrib.auth.views import LoginView, LogoutView, PasswordResetView, PasswordResetDoneView, PasswordResetConfirmView, PasswordResetCompleteView
from django.conf import settings
from django.conf.urls.static import static
from django.urls import reverse_lazy

urlpatterns = [
    url(r'^$', views.home, name='home'),
    url(r'^login/$', LoginView.as_view(template_name='accounts/login.html'), name='login'),
    url(r'^logout/$', LogoutView.as_view(template_name='accounts/logout.html'), name='logout'),
    url(r'^register/$', views.register, name='register'),
    url(r'^profile/$', views.view_profile, name='view_profile'),
    url(r'^profile/edit$', views.edit_profile, name='edit_profile'),
    url(r'^change-password/$', views.change_password, name='change_password'),

    url(r'^password-reset/$',
    PasswordResetView.as_view(template_name='accounts/password_reset.html',
    success_url=reverse_lazy('accounts:password_reset_done')),
    {'email_template_name': 'accounts/password_reset_email.html'},
    name='password_reset'),

    url(r'^password-reset/done/$',
    PasswordResetDoneView.as_view(template_name='accounts/password_reset_done.html'),
    name='password_reset_done'),

    url(r'^password-reset/confirm/(?P<uidb64>[0-9A-Za-z]+)-(?P<token>,+)/$',
    PasswordResetConfirmView.as_view(template_name='accounts/password_reset_confirm.html'),
    name='password_reset_confirm'),

    url(r'^password-reset/complete/$',
    PasswordResetCompleteView.as_view(template_name='accounts/password_reset_complete.html'),
    name='password_reset_complete'),

]

settings.py

INSTALLED_APPS = [
    'accounts',
    'django.contrib.admin',
    'django.contrib.auth',
    'django.contrib.contenttypes',
    'django.contrib.sessions',
    'django.contrib.messages',
    'django.contrib.staticfiles',
]

middleware.py

import re

from django.conf import settings
from django.urls import reverse
from django.shortcuts import redirect
from django.contrib.auth import logout

EXEMPT_URLS = [re.compile(settings.LOGIN_URL.lstrip('/'))]
if hasattr(settings, 'LOGIN_EXEMPT_URLS'):
    EXEMPT_URLS += [re.compile(url) for url in settings.LOGIN_EXEMPT_URLS]

class LoginRequiredMiddleware:

    def __init__(self, get_response):
        self.get_response = get_response

    def __call__(self, request):
        response = self.get_response(request)
        return response

    def process_view(self, request, view_func, view_args, view_kwargs):
        assert hasattr(request, 'user')
        path = request.path_info.lstrip('/')
        url_is_exempt = any(url.match(path) for url in EXEMPT_URLS)

        if path == reverse('accounts:logout').lstrip('/'):
            logout(request)

        if request.user.is_authenticated and url_is_exempt:
            return redirect(settings.LOGIN_REDIRECT_URL)
        elif request.user.is_authenticated or url_is_exempt:
            return None

        else:
            return redirect(settings.LOGIN_URL)

password_reset_email.html

{% load i18n %}{% autoescape off %}
{% blocktrans %} You're recieving this email because you requested a password reset
for your user account at {{ site_name }}.{% endblocktrans %}

{% trans "Please go to the following page and choose a new password:" %}
{% block reset_link %}
{{ protocol }}://{{ domain }}{% url 'password_reset_confirm' uidb64=uid token=token %}
{% endblock %}
{% trans "Your username, in case you've forgotten:" %} {{ user.get_username }}

{% trans "Thank you for using x!" %}

{% blocktrans %}The {{ site_name }} team{% endblocktrans %}

{% endautoescape %}

Answer 1

将设置选项中的确认部分更改为仅帐户/密码-休息/确认/没有美元符号，这样url之后的所有内容都将被豁免。

LOGIN_EXEMPT_URLS = {
  r'^account/logout/$',
  r'^account/register/$',
  r'^account/password-reset/$',
  r'^account/password-reset/done/$',
  r'^account/password-reset/confirm/',
  r'^account/password-reset/complete/$',
}

Answer 2

您应该从PasswordResetConfirmView更改为PasswordResetCompleteView。

PasswordResetCompleteView显示一个视图，通知用户密码已成功更改。您不需要编写两次PasswordResetConfirmView。

更改为

url(r'^reset-password/complete/$',
PasswordResetCompleteView.as_view(template_name='accounts/reset_password_complete.html'),
name='reset_password_complete'),

有关更多详细信息，请查看django文档。(https://docs.djangoproject.com/en/2.1/topics/auth/default/#django.contrib.auth.views.PasswordResetCompleteView)

Answer 3

您已将密码重置URL包含在具有app_name = 'accounts'的urls.py中，因此在反转URL时需要包含accounts命名空间。

{% url 'accounts:password_reset_confirm' uidb64=uid token=token %}

顺便说一句，我在Stack Overflow上看到了几个问题，其中命名空间密码重置URL导致了问题。在我看来，在不使用名称空间的urls.py中包含密码重置URL会更简单。

日志行GET /reset/OA/50l-94673624f6b9fa5a060a/表明您已将密码重置URL放在第二个位置。我会尝试找到这个额外的包含并删除它。