After discussing with Malcolm, added set_unusable_password() and has_usable_password() methods to the User object, plus tests and updated documentation

Simon Willison · Simon Willison · commit fd2b99b5f122 · 2007-07-28T18:30:40.000Z
git-svn-id: http://code.djangoproject.com/svn/django/trunk@5771 bcc190cf-cafb-0310-a4f2-bffc1f526a37
diff --git a/django/contrib/auth/models.py b/django/contrib/auth/models.py
@@ -7,6 +7,8 @@
 import datetime
 import urllib
 
+UNUSABLE_PASSWORD = '!' # This will never be a valid hash
+
 try:
     set
 except NameError:
@@ -83,11 +85,14 @@ def __unicode__(self):
         return self.name
 
 class UserManager(models.Manager):
-    def create_user(self, username, email, password):
+    def create_user(self, username, email, password=None):
         "Creates and saves a User with the given username, e-mail and password."
         now = datetime.datetime.now()
         user = self.model(None, username, '', '', email.strip().lower(), 'placeholder', False, True, False, now, now)
-        user.set_password(password)
+        if password:
+            user.set_password(password)
+        else:
+            user.set_unusable_password()
         user.save()
         return user
 
@@ -179,6 +184,13 @@ def check_password(self, raw_password):
             return is_correct
         return check_password(raw_password, self.password)
 
+    def set_unusable_password(self):
+        # Sets a value that will never be a valid hash
+        self.password = UNUSABLE_PASSWORD
+
+    def has_usable_password(self):
+        return self.password != UNUSABLE_PASSWORD
+
     def get_group_permissions(self):
         "Returns a list of permission strings that this user has through his/her groups."
         if not hasattr(self, '_group_perm_cache'):
@@ -268,7 +280,8 @@ def get_profile(self):
         return self._profile_cache
 
 class Message(models.Model):
-    """The message system is a lightweight way to queue messages for given users. A message is associated with a User instance (so it is only applicable for registered users). There's no concept of expiration or timestamps. Messages are created by the Django admin after successful actions. For example, "The poll Foo was created successfully." is a message.
+    """
+    The message system is a lightweight way to queue messages for given users. A message is associated with a User instance (so it is only applicable for registered users). There's no concept of expiration or timestamps. Messages are created by the Django admin after successful actions. For example, "The poll Foo was created successfully." is a message.
     """
     user = models.ForeignKey(User)
     message = models.TextField(_('message'))
diff --git a/django/contrib/auth/tests.py b/django/contrib/auth/tests.py
@@ -0,0 +1,19 @@
+"""
+>>> from models import User
+>>> u = User.objects.create_user('testuser', 'test@example.com', 'testpw')
+>>> u.has_usable_password()
+True
+>>> u.check_password('bad')
+False
+>>> u.check_password('testpw')
+True
+>>> u.set_unusable_password()
+>>> u.save()
+>>> u.check_password('testpw')
+False
+>>> u.has_usable_password()
+False
+>>> u2 = User.objects.create_user('testuser2', 'test2@example.com')
+>>> u2.has_usable_password()
+False
+"""
diff --git a/docs/authentication.txt b/docs/authentication.txt
@@ -114,6 +114,17 @@ custom methods:
       string is the correct password for the user. (This takes care of the
       password hashing in making the comparison.)
 
+    * ``set_unusable_password()`` -- Marks the user as having no password set. 
+      This isn't the same as having a blank string for a password.
+      ``check_password()`` for this user will never return ``True``. Doesn't 
+      save the ``User`` object.
+      
+      You may need this if authentication for your application takes place  
+      against an existing external source such as an LDAP directory.
+
+    * ``has_usable_password()`` -- Returns ``False`` if 
+      ``set_unusable_password()`` has been called for this user.
+
     * ``get_group_permissions()`` -- Returns a list of permission strings that
       the user has, through his/her groups.
 
@@ -152,9 +163,11 @@ Manager functions
 
 The ``User`` model has a custom manager that has the following helper functions:
 
-    * ``create_user(username, email, password)`` -- Creates, saves and returns
-      a ``User``. The ``username``, ``email`` and ``password`` are set as
-      given, and the ``User`` gets ``is_active=True``.
+    * ``create_user(username, email, password=None)`` -- Creates, saves and 
+      returns a ``User``. The ``username``, ``email`` and ``password`` are set
+      as given, and the ``User`` gets ``is_active=True``.
+      
+      If no password is provided, ``set_unusable_password()`` will be called.
 
       See _`Creating users` for example usage.
 
