异常值：'QuerySet' 对象没有属性 'password'

Question

I'm getting an error Query set object has no attribute 'password'.Can any one please help me how to compare user entered password with return <QuerySet [<Customer: Customer object (42)>]> query set. Please find the below views.py for login.

def login(request):
    if request.method == 'GET':
        return render (request, 'login.html')

    else:
        email = request.POST.get('email')
        password = request.POST.get('password')
        print(email,password)
        #Now we will try to match user entered email ID and search it in db(here we Can't use pass because it is in ecrypted mode we can see from admin panel
        # to filter result we can use Customer.objects.filter which will return match in list form but we want a single object so better is to use get
        # Customer.objects.get(email=email))
        #drawback of get is that if result is matched then good else it will give error.

        login_customer = Customer.objects.filter(email=email)
        print(login_customer)
        print('-------')
        error = None
        if login_customer:
            print(email)
            flag = check_password(password, login_customer.password)
            #if user email ID is exit then we'll Check his password.:)
            if flag:
                return redirect('home')
        else:
            print(email, password)
            error = 'Entered Email ID OR Password is incorrect'

        return render(request, 'login.html',{'error':error})

customer.py(models):

from django.db import models
##Customer Model Creation.

# Create your models here.

class Customer(models.Model):
    first_name = models.CharField(max_length=50)
    last_name = models.CharField(max_length=50)
    phone = models.CharField(max_length=15)
    email = models.EmailField()
    password = models.CharField(max_length=250)

case b: When I am using get instead of filter.

def login(request):
    if request.method == 'GET':
        return render (request, 'login.html')

    else:
        email = request.POST.get('email')
        password = request.POST.get('password')
        print(email,password)
        #Now we will try to match user entered email ID and search it in db(here we Can't use pass because it is in ecrypted mode we can see from admin panel
        # to filter result we can use Customer.objects.filter which will return match in list form but we want a single object so better is to use
        # Customer.objects.get(email=email))
        #drawback of get is that if result is matched then good else it will give error.so better is to use
        login_customer = Customer.objects.get(email=email)
        print(login_customer)
        print('-------')
        error = None
        if login_customer:
            print(email)
            print('+++++')
            flag = check_password(password, login_customer.password)
            #if user email ID is exit then we'll Check his password.:)
            if flag:
                return redirect('home')
        else:
            print(email, password)
            error = 'Entered Email ID OR Password is incorrect'

        return render(request, 'login.html',{'error':error})

Problem : It is not redirecting to home page i think there is some problem in this line (*flag = check_password(password, login_customer.password)* ).

Output in Terminal:

Django version 3.0.2, using settings 'ShaileshShop.settings'
Starting development server at http://127.0.0.1:8000/
Quit the server with CONTROL-C.
sheru@apple.com None
Customer object (42)
-------
sheru@apple.com
+++++
[17/Oct/2020 03:14:26] "POST /login HTTP/1.1" 200 5167

#How encrypting password

from django.contrib.auth.hashers import make_password,check_password
    def signup(request):
        if request.method == 'GET':
                print(request.method)
                return render(request,'signup.html')
        else:
            postdata=request.POST
            first_name = postdata.get('firstname')
            last_name = postdata.get('lastname')
            phone = postdata.get('PhoneNumber')
            email = postdata.get('email')
            password = postdata.get('Password')
    
            #Now to store filled data if any error is coming so that User not required to fill it again.####
            value={
                'first_name' : first_name,
                'last_name' : last_name,
                'phone' : phone,
                'email' : email,
                #password not passing :) user need to fill it hahhahaa
            }
            
    
            ####Validating above field at server level####
            error = None
            customer = Customer(first_name=first_name,
                                last_name=last_name,
                                phone=phone,
                                email=email,
                                password=password)
            if not first_name:
                error = 'First name is required!!'
            elif len(first_name) < 4:
                error = 'First Name must be 4 char length'
    
            elif not last_name:
                error ='Last Name is required!.'
            elif len(last_name) < 4:
                error = 'Last Name Must be 4 Character long.'
    
            elif len(phone) < 10:
                error ='Mobile number should be of 10 digit.'
            
            elif Customer.objects.filter(phone=phone):
                error = "Mobile no is already registered."
    
            elif len(password) < 5:
                error ="Password must be 5 Char length."
            
            elif len(email) <6:
                error = "Email Id must be more than 6 Character !"
    
            elif Customer.objects.filter(email=email):
                error = "Sorry You already have account with this Email ID."
    
    
            if not error:
                print(first_name,last_name,email,password,phone)
                customer.password = make_password(customer.password)
    
                customer.save()
                #best way is to go into urls.py and define name=hompage because tommorow if we'll upload on production this domain will change.
                return redirect('home')
                # return redirect('http://127.0.0.1:8000')this is not recommonded
                # return render(request,'index.html')#paasing data otherwise product will not shown to us after redirecting to index.
                # in this we will not get all product image so we need to check how we can use above data already written code
    
            else:
                data = {
                    'error': error,
                    'values': value,
                }
                return render(request,'signup.html', data)

Answer 1

Your login_customer variable is a queryset, not an instance of your Customer model. querysets are conceptually similar to a list , and in your case, it would be a list of customers .

You already have the fix for this in your second view; use Customer.objects.get instead.

The second issue is with your password management. if you take a look at the docs for check_password , you'll see that the second argument expects a password hash , and not 2 identical strings like in your case.

I'll spare you the lecture on why plain text passwords are bad . If you are interested, check out Information Security .

Anyways, you have 2 options:

( don't do this! ) Use the unsafe plain text passwords, and throw out the check_password function, in place of a simple if/else :

if password == login_customer.password:
    return redirect('home')
else:
    ...

Use django's builtin LoginView . This will require some refactoring of your code, but this is a much better solution long term.

models.py:

from django.contrib.auth.models import AbstractUser

# all other fields are already included in `AbstractUser`
class Customer(AbstractUser):
    USERNAME_FIELD = "email"

    email = models.EmailField(unique=True, db_index=True)

views.py:

from django.contrib.auth import views

class LoginView(views.LoginView):
    template_name = 'login.html'

You will also need to change your template to use the login form object. Here is the example from the docs :

<form method="post" action="{% url 'login' %}">
{% csrf_token %}
<table>
<tr>
    <td>{{ form.username.label_tag }}</td>
    <td>{{ form.username }}</td>
</tr>
<tr>
    <td>{{ form.password.label_tag }}</td>
    <td>{{ form.password }}</td>
</tr>
</table>

<input type="submit" value="login">
<input type="hidden" name="next" value="{{ next }}">
</form>