justinmayer / django-elevate

Protect your sensitive Django views by requiring re-authentication

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Provide request to authenticate()

dwasyl opened this issue · comments

Hi there,

I've been trying to make sure of elevate in a project, but on this particular we're using a custom AuthenticationBackend that makes use of the request variable that is generally provided to authenticate (When called by the ElevateForm?

I'm going to work through supporting authenticate() without request, but the system does some work with a few variables in the request so if it could just be passed along it would be simplify matters.

Thoughts?

This seems reasonable. Feel free to send a PR 😸

Alright, let me take a look at adding it. I worked my way around it in my code, but it would be cleaner to pass along the request.

The other (unrelated) thing I noticed is that when authenticating with Elevate a user_logged_in signal doesn't get sent, but when the authenication fails, a user_login_failed signal does get sent.

user_logged_in does things like update the last login value on the User model. I'm not sure that's something we'd want to happen when a user puts in the correct password as they're already logged in.

@moggers87 Makes sense, I was just looking for a way to flag that a user entered 'elevated' mode (or failed elevated mode).

I was hoping that I'd worked around the original issue, but some other tools like django-axes requires the request variable be provided to authenticate() as well so I'm going to see about adding it to the form.

Awesome, thanks @moggers87. Any chance of a new release sometime soon? :)

That should have happened automatically, not sure what went wrong there.

It's fixed now. Thanks for the patch 😸