#33178: `creratesuperuser` does not validate `REQUIRED_FIELDS` fields value in
interactive mode when passed by command-line
--------------------------------------------+------------------------
Reporter: Christophe Henry | Owner: nobody
Type: Uncategorized | Status: new
Component: contrib.auth | Version: 3.1
Severity: Normal | Keywords:
Triage Stage: Unreviewed | Has patch: 0
Needs documentation: 0 | Needs tests: 0
Patch needs improvement: 0 | Easy pickings: 0
UI/UX: 0 |
--------------------------------------------+------------------------
`createsuperuser` command will alway perform a field validation using
`field.clean` when creating a new user. In non-interactive mode, it is
done
[https://github.com/django/django/blob/main/django/contrib/auth/management/commands/createsuperuser.py#L187
here]. In interactive mode, it is performed in
[https://github.com/django/django/blob/main/django/contrib/auth/management/commands/createsuperuser.py#L217
`get_input_data`] when the value is requested from input. But if the
valued was passed using `--` command, the field is never validated.
The consequence is it ends up passing a non-validated string to
[https://github.com/django/django/blob/28f66b2783e52d5be51887c31cd2be907b820e11/django/contrib/auth/models.py#L154
`UserManager.create_superuser`] instead of a integer corresponding to an
actual PK in DB.
--
Ticket URL: <https://code.djangoproject.com/ticket/33178>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/058.b3d346d4970e85c3fb8aa57b090d5030%40djangoproject.com.
