diff --git a/docs/configuration.rst b/docs/configuration.rst index ed0d785..dbe965b 100644 --- a/docs/configuration.rst +++ b/docs/configuration.rst @@ -34,3 +34,6 @@ Configuration - **OLD_PASSWORD_FIELD_ENABLED** - set it to True if you want to have old password verification on password change enpoint (default: False) + + +- **NEW_PASSWORD_2_FIELD_ENABLED** - set it to False if you don't need new password confirmation (default: True) diff --git a/rest_auth/serializers.py b/rest_auth/serializers.py index 2b671da..edbe58d 100644 --- a/rest_auth/serializers.py +++ b/rest_auth/serializers.py @@ -182,11 +182,18 @@ class PasswordChangeSerializer(serializers.Serializer): self.old_password_field_enabled = getattr( settings, 'OLD_PASSWORD_FIELD_ENABLED', False ) + + self.new_password_2_field_enabled = getattr( + settings, 'NEW_PASSWORD_2_FIELD_ENABLED', True + ) super(PasswordChangeSerializer, self).__init__(*args, **kwargs) if not self.old_password_field_enabled: self.fields.pop('old_password') + if not self.new_password_2_field_enabled: + self.fields.pop('new_password2') + self.request = self.context.get('request') self.user = getattr(self.request, 'user', None) @@ -202,6 +209,10 @@ class PasswordChangeSerializer(serializers.Serializer): return value def validate(self, attrs): + + if not self.new_password_2_field_enabled: + attrs['new_password2'] = attrs['new_password1'] + self.set_password_form = self.set_password_form_class( user=self.user, data=attrs ) diff --git a/rest_auth/tests.py b/rest_auth/tests.py index b137313..c084b91 100644 --- a/rest_auth/tests.py +++ b/rest_auth/tests.py @@ -282,6 +282,44 @@ class APITestCase1(TestCase, BaseAPITestCase): login_payload['password'] = new_password_payload['new_password1'] self.post(self.login_url, data=login_payload, status_code=200) + @override_settings(OLD_PASSWORD_FIELD_ENABLED=True, NEW_PASSWORD_2_FIELD_ENABLED=False) + def test_password_change_without_confirmation(self): + login_payload = { + "username": self.USERNAME, + "password": self.PASS + } + get_user_model().objects.create_user(self.USERNAME, '', self.PASS) + self.post(self.login_url, data=login_payload, status_code=200) + self.token = self.response.json['key'] + + new_password_payload = { + "old_password": "%s!" % self.PASS, # wrong password + "new_password1": "new_person", + } + self.post( + self.password_change_url, + data=new_password_payload, + status_code=400 + ) + + new_password_payload = { + "old_password": self.PASS, + "new_password1": "new_person", + } + + self.post( + self.password_change_url, + data=new_password_payload, + status_code=200 + ) + + # user should not be able to login using old password + self.post(self.login_url, data=login_payload, status_code=400) + + # new password should work + login_payload['password'] = new_password_payload['new_password1'] + self.post(self.login_url, data=login_payload, status_code=200) + def test_password_reset(self): user = get_user_model().objects.create_user(self.USERNAME, self.EMAIL, self.PASS)