Django HoneyPot更改密码问题

Question

如果你能给我任何线索，我将不胜感激！因为我没有这方面的经验，所以我可能误解了。

我正在使用蜜罐，更具体地说，在API中使用honeypot.middleware.HoneypotMiddleware和HONEYPOT_FIELD_NAME (settings.py)。

现在已经足够了，我使用的基本实现是登录、更改密码、从django.contrib.auth重置。在登录时，我做了一个小的定制，所以我将它添加到url (authentication_form=CustomAuthenticationForm)中。

所以我不知道我丢失了什么，因为登录页面可以工作(它也是一个表单)，但是密码更改，重置那些返回400坏的请求。蜜罐错误(honey_pot_fieldname)。请求中止。

django: 2.1.2

django-蜜罐: 0.7.0

用代码更新

settings.py

INSTALLED_APPS = [
    'django.contrib.admin',
    'django.contrib.auth',
....
    'honeypot',
    ]

MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
    'honeypot.middleware.HoneypotMiddleware',
]

HONEYPOT_FIELD_NAME = config('HONEYPOT_FIELD_NAME')

forms.py

from django.contrib.auth.forms import AuthenticationForm

class CustomAuthenticationForm(AuthenticationForm):
    error_messages = {
        'invalid_login': _(
            "Please enter a correct %(username)s and password. Note that both "
            "fields may be case-sensitive."
        ),
        'inactive': _("This account is inactive."),
        'suspended': _("Your account has been temporarily suspended. For more information,\
                   please contact us."),
    }

    def clean(self)
    def confirm_login_allowed(self, user)

urls.py

from django.contrib.auth import views as auth_view

urlpatterns = [
....

    # ---- BASIC USER AUTHENTICATION (DJANGO)
    path('api/login/', auth_view.LoginView.as_view(authentication_form=CustomAuthenticationForm), name='login'),
    path('api/logout/', auth_view.LogoutView.as_view(), name='logout'),

    # ---- PASSWORD CHANGE, RESET
    path('api/password_change/', auth_view.PasswordChangeView.as_view(), name='password_change'),
    path('api/password_change_done/', auth_view.PasswordChangeDoneView.as_view(),
         name='password_change_done'),
....
]

模板

模板/重新注册/login.html

{% extends 'base.html' %}
{% load i18n widget_tweaks %}

{% block head %}
    {% load bootstrap3 %}

    {{ form.media }}
{% endblock %}

{% block content %}
    <div class="col-sm-4 col-sm-offset-4" style="margin-top:20px;">
        <h1 class="display-4 text-center" >User login</h1>
        <legend></legend>
        <form method="post">
            {% csrf_token %}
            {% bootstrap_form form layout='inline' %}
            {% buttons %}
                <button type="submit" class="btn btn-primary center-block" style="margin-top: 20px">Log in</button>
            {% endbuttons %}
        </form>
    </div>
{% endblock %}

templates/resgistration/password_change_form.html

{% extends 'base.html' %}
{% load i18n widget_tweaks %}
{% block head %}
    {% load bootstrap3 %}

    {{ form.media }} 
{% endblock %}

{% block content %}
    <div class="col-sm-4 col-sm-offset-4" style="margin-top:20px;">
        <h1 class="display-4 text-center" >{{ title }}</h1>
        <legend></legend>
        <form method="post">
            {% csrf_token %}
            {% bootstrap_form form layout='inline' %}
            {% buttons %}
                <button type="submit" class="btn btn-primary center-block" style="margin-top: 20px">Change password</button>
            {% endbuttons %}
        </form>
    </div>
{% endblock %}

提前感谢！

Answer 1

用解决方案更新

我终于做到了！我只需在模板change_password_form.html顶部添加行

{% load honeypot %}

在表单中，包括标签：

{% render_honeypot_field "field_name" %}

为了实现这一点，我在本文中帮助了django-蜜罐

希望这会对其他人有所帮助。