python - 密码未使用 Django 以及一些缺失的列进行哈希处理

Question

我不确定为什么在使用 Django Rest Framework 创建新的自定义用户(电子邮件作为用户名)时我的密码没有经过哈希处理

这是我在 postgres 中看到的。不知道为什么即使在迁移后我的 admin/staff/active 列也没有显示

模型.py

from django.db import models
from django.contrib.auth.models import AbstractBaseUser, BaseUserManager

class UserManager(BaseUserManager):
    def create_user(self, email, password=None, first_name=None, last_name=None, is_active=True, is_staff=False, is_admin=False):
        if not email or not first_name or not last_name:
            raise ValueError('Email is required')
        if not password:
            raise ValueError('Password is required')
        if not first_name:
            raise ValueError('First name is required')
        if not last_name:
            raise ValueError('Last name is required')

        user_object = self.model(
            email=self.normalize_email(email),
            first_name=first_name,
            last_name=last_name,
            active=is_active,
            staff=is_staff,
            admin=is_admin,
        )
        user_object.set_password(password) # change password
        user_object.save(self._db)
        return user_object

    def create_staff_user(self, email, first_name, last_name, password=None):
        staff_user_object = self.create_user(email, first_name, last_name, password, is_staff=True)
        return staff_user_object

    def create_superuser(self, email, first_name, last_name, password=None):
        super_user_object = self.create_user(email, first_name, last_name, password, is_staff=True, is_admin=True)
        return super_user_object


class User(AbstractBaseUser):
    email = models.EmailField(unique=True, max_length=255)
    first_name = models.CharField(max_length=255)
    last_name = models.CharField(max_length=255)
    date_joined = models.DateTimeField(auto_now_add=True)    # joined timestamp
    is_active = models.BooleanField(default=True)    # Can login?
    is_staff = models.BooleanField(default=False)    # staff user, non super user
    is_admin = models.BooleanField(default=False)    # super user?

    objects = UserManager()
    USERNAME_FIELD = 'email'
    EMAIL_FIELD = 'email'
    REQUIRED_FIELDS = []    # email and passwords are required by default

设置.py

PASSWORD_HASHERS = [
    'django.contrib.auth.hashers.BCryptSHA256PasswordHasher',   # Using Bcrypt to store passwords

View .py

class UserList(generics.ListCreateAPIView):
    """ List all Users, or create a new User. """
    queryset = User.objects.all()
    serializer_class = UserSerializer


class UserDetail(generics.RetrieveUpdateDestroyAPIView):
    """ Retrieve, update or delete a User instance. """
    queryset = User.objects.all()
    serializer_class = UserSerializer
]

网址.py

urlpatterns = [
    path('accounts/', views.UserList.as_view()),
    path('accounts/<int:pk>/', views.UserDetail.as_view()),
]

序列化器.py

from rest_framework import serializers
from .models import User
from properties.models import Property

class UserSerializer(serializers.ModelSerializer):
    properties = serializers.PrimaryKeyRelatedField(many=True, queryset=Property.objects.all())

    class Meta:
        model = User
        fields = '__all__'

Answer 1

DRF 序列化程序调用模型的默认 create() 方法，它不会调用 .set_password() 方法。因此，您必须在 UserSerializer

的 create() 方法中显式调用该方法

class UserSerializer(serializers.ModelSerializer):
    # other code
    <b>def create(self, validated_data):
        password = validated_data.pop('password', None)
        user_instance = super().create(validated_data)
        if password:
            user_instance.set_password(password)
            user_instance.save()
        return user_instance</b>