tiborhari/django-admin-reset

Password reset for the Django admin interface

Password reset for the Django admin interface

This package provides views, to use the built-in Django password reset functionality from inside the admin interface.

Features:

• Add a link to the top of the user change form, that leads to a new page, containing the link for the password reset.
• Remove the features to manually change the users' passwords from the admin interface (but see note below).
  • Remove the change password link from the user forms.
  • Remove the password inputs from the user add form.

Note

It's still possible, to manually change the users' passwords by going to the /admin/auth/user/<uid>/password/ page. Only the links, pointing to this page are removed.

Installation

The django-admin-reset package can be installed with pip:

pip install django-admin-reset

Usage

To use this package, add it to INSTALLED_APPS, in the settings.py file:

INSTALLED_APPS = [
    ...
    'django_admin_reset',
    ...
]

Validation time

The password reset links/tokens, generated by this package, are using the built-in Django password reset functionality, and so respect the PASSWORD_RESET_TIMEOUT setting.

Compatibility

This package changes the default user admin class, so it may be incompatible with other packages, that are also changing it.

Compatible Django and Python versions:

Django version	Python versions
3.2 LTS	3.8, 3.9, 3.10
4.1	3.8, 3.9, 3.10, 3.11
4.2	3.8, 3.9, 3.10, 3.11, 3.12
5.0	3.10, 3.11, 3.12

django-admin-reset's Issues

Homepage link broken in PyPi

Small typo :)
Currently the link is https://github/tiborhari/django-admin-reset/
Should be https://github.com/tiborhari/django-admin-reset/

Need to support custom User model.

Currently if e-mail is used as the username field, package will not work.

PASSWORD_RESET_TIMEOUT_DAYS is deprecated

Hi!

PASSWORD_RESET_TIMEOUT_DAYS has been deprecated a while ago and has been removed in Django 4.
However, it is still listed in the instructions of this app.

The appropriate setting is now PASSWORD_RESET_TIMEOUT which is in seconds

Also, since I have set PASSWORD_RESET_TIMEOUT to 604800 in my app (which is 7 days), the password reset page that shows the reset link for a user in the admin says: This link can be sent [...] and it expires in 604800 days.

Can we make that either '604800 seconds' or better yet '7 days' ?

By the way, if I still try to use PASSWORD_RESET_TIMEOUT_DAYS, that settings seems to be ignored because then it says " and it expires in 259200 days." (which is the default 3 days instead of 604800 which would be 7 days)

Error: link invalid, while trying to save the new password

I'm getting this error sometimes upon trying to save a new password, when I visit the password reset link. Sometimes several times in a row. So I won't get any error when clicking the password reset link, I'll just see the password change form like expected, and then after filling out the new password and hitting the save button, I'll get this error saying the link is invalid, probably because it has been used before (when I've just obtained the link and haven't shared it with anyone).

What's going on there? Any idea?

It says (in dutch):

Wachtwoordherinitialisatie mislukt
De link voor het herstellen van het wachtwoord is ongeldig, waarschijnlijk omdat de link al eens is gebruikt. Vraag opnieuw een wachtwoord aan.

Django 3.1 support

Django 3.1 has been released.
Install requirements should be changed

password_reset_complete login link goes to /accounts/login not /admin

First, thanks for this library. It's the only solution that worked for me with Django 2.0 and a custom admin_site. The instructions at https://docs.djangoproject.com/en/2.0/ref/contrib/admin/#adding-a-password-reset-feature did not work for me due to namespacing issues.

But, when using django-admin-reset and finishing the reset flow at /admin/auth/user/password_reset_complete/done/ the Login link goes to /accounts/login/. With my single page app, I'm only having Django render the /admin/ urls, so this caused some confusion. I was able to add a redirect to catch it, but it seems like the final login link should be namespaced back to the admin site, not the generic account login page.