Django 密码重置电子邮件链接重定向到登录页面

Question

我正在使用自定义表单来覆盖 Django 模板，但是当用户单击重置密码并收到带有密码重置链接的电子邮件等时（EDITED QUESTION TO CHANGE ORDER FROM reset-password to password-reset ）

/reset/OA/50l-94673624f6b9fa5a060a/

当链接被点击时，它会重定向到

/account/login/

应该引导他们去

/password-reset/confirm/

然后到

/password-reset/complete/

单击重置链接时，命令行如下所示

GET /reset/OA/50l-94673624f6b9fa5a060a/ HTTP/1.1" 302 0
GET /account/login/ HTTP/1.1" 200 2237

LOGIN_EXEMPT_URLS

LOGIN_EXEMPT_URLS = {
    r'^account/logout/$',
    r'^account/register/$',
    r'^account/password-reset/$',
    r'^account/password-reset/done/$',
    r'^account/password-reset/confirm/(?P<uidb64>[0-9A-Za-z]+)-(?P<token>,+)/$',
    r'^account/password-reset/complete/$',

}

网址.py

app_name='accounts'

from django.conf.urls import url
from . import views
from django.contrib.auth.views import LoginView, LogoutView, PasswordResetView, PasswordResetDoneView, PasswordResetConfirmView, PasswordResetCompleteView
from django.conf import settings
from django.conf.urls.static import static
from django.urls import reverse_lazy

urlpatterns = [
    url(r'^$', views.home, name='home'),
    url(r'^login/$', LoginView.as_view(template_name='accounts/login.html'), name='login'),
    url(r'^logout/$', LogoutView.as_view(template_name='accounts/logout.html'), name='logout'),
    url(r'^register/$', views.register, name='register'),
    url(r'^profile/$', views.view_profile, name='view_profile'),
    url(r'^profile/edit$', views.edit_profile, name='edit_profile'),
    url(r'^change-password/$', views.change_password, name='change_password'),

    url(r'^password-reset/$',
    PasswordResetView.as_view(template_name='accounts/password_reset.html',
    success_url=reverse_lazy('accounts:password_reset_done')),
    {'email_template_name': 'accounts/password_reset_email.html'},
    name='password_reset'),

    url(r'^password-reset/done/$',
    PasswordResetDoneView.as_view(template_name='accounts/password_reset_done.html'),
    name='password_reset_done'),

    url(r'^password-reset/confirm/(?P<uidb64>[0-9A-Za-z]+)-(?P<token>,+)/$',
    PasswordResetConfirmView.as_view(template_name='accounts/password_reset_confirm.html'),
    name='password_reset_confirm'),

    url(r'^password-reset/complete/$',
    PasswordResetCompleteView.as_view(template_name='accounts/password_reset_complete.html'),
    name='password_reset_complete'),

]

设置.py

INSTALLED_APPS = [
    'accounts',
    'django.contrib.admin',
    'django.contrib.auth',
    'django.contrib.contenttypes',
    'django.contrib.sessions',
    'django.contrib.messages',
    'django.contrib.staticfiles',
]

中间件.py

import re

from django.conf import settings
from django.urls import reverse
from django.shortcuts import redirect
from django.contrib.auth import logout

EXEMPT_URLS = [re.compile(settings.LOGIN_URL.lstrip('/'))]
if hasattr(settings, 'LOGIN_EXEMPT_URLS'):
    EXEMPT_URLS += [re.compile(url) for url in settings.LOGIN_EXEMPT_URLS]

class LoginRequiredMiddleware:

    def __init__(self, get_response):
        self.get_response = get_response

    def __call__(self, request):
        response = self.get_response(request)
        return response

    def process_view(self, request, view_func, view_args, view_kwargs):
        assert hasattr(request, 'user')
        path = request.path_info.lstrip('/')
        url_is_exempt = any(url.match(path) for url in EXEMPT_URLS)

        if path == reverse('accounts:logout').lstrip('/'):
            logout(request)

        if request.user.is_authenticated and url_is_exempt:
            return redirect(settings.LOGIN_REDIRECT_URL)
        elif request.user.is_authenticated or url_is_exempt:
            return None

        else:
            return redirect(settings.LOGIN_URL)

password_reset_email.html

{% load i18n %}{% autoescape off %}
{% blocktrans %} You're recieving this email because you requested a password reset
for your user account at {{ site_name }}.{% endblocktrans %}

{% trans "Please go to the following page and choose a new password:" %}
{% block reset_link %}
{{ protocol }}://{{ domain }}{% url 'password_reset_confirm' uidb64=uid token=token %}
{% endblock %}
{% trans "Your username, in case you've forgotten:" %} {{ user.get_username }}

{% trans "Thank you for using x!" %}

{% blocktrans %}The {{ site_name }} team{% endblocktrans %}

{% endautoescape %}

Answer 1

在设置 seption 中将确认部分更改为仅帐户/密码-rest/confirm/ 没有美元符号，因此该 url 之后的所有内容也将被免除。

LOGIN_EXEMPT_URLS = {
  r'^account/logout/$',
  r'^account/register/$',
  r'^account/password-reset/$',
  r'^account/password-reset/done/$',
  r'^account/password-reset/confirm/',
  r'^account/password-reset/complete/$',
}

Answer 2

您应该从PasswordResetConfirmView更改为PasswordResetCompleteView 。

PasswordResetCompleteView呈现一个视图，该视图通知用户密码已成功更改。 您无需两次编写PasswordResetConfirmView 。

改成

url(r'^reset-password/complete/$',
PasswordResetCompleteView.as_view(template_name='accounts/reset_password_complete.html'),
name='reset_password_complete'),

有关更多详细信息，请查看Django文档。 （ https://docs.djangoproject.com/zh-CN/2.1/topics/auth/default/#django.contrib.auth.views.PasswordResetCompleteView ）

Answer 3

您已将密码重置URL包含在app_name = 'accounts'的urls.py中，因此，在反转URL时，需要包括accounts名称空间。

{% url 'accounts:password_reset_confirm' uidb64=uid token=token %}

顺便说一句，我已经在Stack Overflow上看到了几个问题，其中名称间隔密码重置URL会引起问题。 我认为，将密码重置URL包含在不使用命名空间的urls.py中更为简单。

日志行GET /reset/OA/50l-94673624f6b9fa5a060a/建议您将密码重置URL放在第二位。 我会尝试查找此多余的包含并将其删除。