How to update User password in django-CodePudding

I'm having trouble when i try to update user password in django.

def password(request):
 if request.method=="POST":
    password =request.user.password
    username=request.user.username
    c_password=request.POST["current_password"]
    new_password=request.POST["new_password"]
    r_new_password=request.POST["retype_new_password"]
    if password==c_password:
        if new_password==r_new_password:
            user =User.objects.get(username=username)
            user.set_password(new_password)
            user.save()
            messages.info(request,"Successfully saved")
        else:
            messages.info(request,"PASSWORD DOES NOT MATCH")
    else:
        messages.info(request,"PASSWORD INCORRECT")
    
 return render(request,"security.html")

When i fill the current password, it is giving me error password incorrect. But, when i fill pbkdf2_sha256$320000$Cb4s4nwqKwirdgo50ZdjLH$aeuSP3X dSZXsv0XJB0XxkpwfsmU PedMX9Jl50Zark= , my password becomes correct and user password is updateable. My problem is I would like to fill in current password field as normal current password without getting the error.

CodePudding user response：

Refer the Documentation Django does not store raw (plain text) passwords on the user model
use authenticate function instead of using if password==c_password:.

from django.contrib.auth import authenticate
def password(request):
 if request.method=="POST":
    password =request.user.password
    username=request.user.username
    c_password=request.POST["current_password"]
    new_password=request.POST["new_password"]
    r_new_password=request.POST["retype_new_password"]
    user = authenticate(username=username, password=c_password)
    if user is not None:
        if new_password==r_new_password:
            user =User.objects.get(username=username)
            user.set_password(new_password)
            user.save()
            messages.info(request,"Successfully saved")
        else:
            messages.info(request,"PASSWORD DOES NOT MATCH")
    else:
        messages.info(request,"PASSWORD INCORRECT")
    
 return render(request,"security.html")

CodePudding user response：

You use authenticate(…) ^[Django-doc] to validate the password: this will retrieve the hashing algorithm and the salt, and check if the hashes match, so you can work with:

def password(request):
    if request.method == 'POST':
        c_password = request.POST['current_password']
        new_password = request.POST['new_password']
        r_new_password = request.POST['retype_new_password']
        user = authenticate(username=request.user.username, password=c_password)
        if user is not None:
            if new_password == r_new_password:
                user.set_password(new_password)
                user.save()
                messages.info(request, 'Successfully saved')
            else:
                messages.info(request, 'PASSWORDS DOE NOT MATCH')
        else:
            messages.info(request, 'PASSWORD INCORRECT')
    return render(request, 'security.html')

There is however a PasswordChangeView ^[Django-doc] to change the password: this already implements the logic and uses a form. You can inject a different template, for example with:

path(
    'password/change/',
    PasswordChangeView.as_view(template_name='security.html'),
    name='password_change'
)

Note: In case of a successful POST request, you should make a redirect ^[Django-doc] to implement the Post/Redirect/Get pattern ^[wiki]. This avoids that you make the same POST request when the user refreshes the browser.

Note: You can limit views to a view to authenticated users with the @login_required decorator ^[Django-doc].

Note: It is better to use a Form ^[Django-doc] than to perform manual validation and cleaning of the data. A Form will not only simplify rendering a form in HTML, but it also makes it more convenient to validate the input, and clean the data to a more convenient type.

CodePudding user response：

Can't comment, but Willem is right, so there is a link