Проблемы безопасности при входе в систему и регистрации Django HTML-шаблон и Views.py - PullRequest
Новая
       43

Проблемы безопасности при входе в систему и регистрации Django HTML-шаблон и Views.py

0 голосов
/ 29 сентября 2019

Есть ли у вас проблемы безопасности с тем, что я сделал, внедряя в производственное веб-приложение? Либо в HTML-шаблоне Django, либо в моей логике представлений?

Я бы предпочел иметь форму в реальном HTML, а не использовать {{form}}. Можно ли разрешить пользователю вводить очень простые пароли?

views.py: 

from django.shortcuts import render, redirect
from django.contrib.auth import get_user_model
User = get_user_model()
from django.contrib.auth import authenticate, login as auth_login
from django.contrib import auth
from memberships.models import UserMembership
from django.contrib.auth.decorators import login_required
from companies.models import Profile


# Create your views here.
def register(request):
    if request.method == "POST":
        # User has info and wants an account now!

        if request.POST['password1'] == request.POST['password2']:
            try:
                user = User.objects.get(email=request.POST['email'])
                return render(request, 'accounts/register.html', {'error': 'Email has already been taken'})
            except User.DoesNotExist:
                user = User.objects.create_user(request.POST['email'], password=request.POST['password1'])
                auth.login(request, user)
                company = Profile()
                company.businessperson = request.user
                company.first_name = request.POST['firstname']
                company.last_name = request.POST['lastname']
                company.company_name = request.POST['companyname']
                company.phone_number = request.POST['phonenum']
                company.save()
                return redirect('memberships:payment')
        else:
            return render(request, 'accounts/register.html', {'error': 'Passwords must match'})
    # User wants to enter info
    return render(request, 'accounts/register.html')

def login(request):
    if request.method == "POST":
        user = authenticate(email=request.POST["email"], password=request.POST["password"])
        if user is not None:
            # Our backend authenticated the credentials
            auth_login(request, user)
            return redirect('dashboard')
        else:
            # Backend did not authenticate the credentials
            return render(request, 'accounts/login.html', {"error": "Incorrect email and or password"})

    else:
        return render(request, 'accounts/login.html')

def logout(request):
    if request.method == "POST":
        auth.logout(request)
        return redirect('login')

формы в login.html и register.html: 

<!-- login.html -->
<form action="{% url 'login' %}" method="POST">
    {% csrf_token %}
    <div class="form-group">
      <input type="email" name="email" id="exampleInputEmail">
    </div>
    <div class="form-group">
      <input type="password" name="password" id="exampleInputPassword" >
    </div>
    <input type="submit" value="Login">
  </form>

  <!-- register.html -->
  <form action="{% url 'register' %}" method="POST" >
    {% csrf_token %}
    <input type="text" name="firstname" id="exampleFirstName" >

    <input type="text" name="lastname" id="exampleLastName" >

    <input type="text" name="companyname" id="exampleInputCompany" >

    <input type="tel" name="phonenum" id="exampleInputPhone" placeholder="Phone Number">

    <input type="email" name="email" id="exampleInputEmail" placeholder="Email" required>

    <input type="password" name="password1" id="exampleInputPassword" placeholder="Password" required>

    <input type="password" name="password2" id="exampleRepeatPassword" placeholder="Repeat Password" required>

    <input type="submit" value="Register Account">
  </form>
...