Package: django-safety
Generic Django application for safer user accounts.FeaturesSessionsUser can see all active sessionsUser can disable a given active sessionUser can disable all active sessionsForce password changeAdministrators can require a password change for any userWorkflowsSessionsUser logs inWe connect the logic to theuser_logged_insignalWe create a newsafety.models.SessioninstanceUser can see the list of her sessions (with IP, last activity and device information)User can delete a given session in the listWe delete both the relatedsafety.models.Sessioninstance and related session in storeUser can delete all active sessions excepted the current oneWe proceed the same way: deleting instances and related sessions from storeUser logs outWe connect the logic to theuser_logged_outsignalWe delete the relatedsafety.models.SessioninstanceForce password changeAdministrator creates aPasswordChangeinstance and setsrequiredtoTrueWhen user logs in, it will be redirected to password change formUntil the user does not change its password, it is not authorized to go elsewhereUser changes its passwordIt is now authorized to go elsewhereInstallationInstalling prerequisitesGeoIP library must be installed on your server.On OS X with Homebrew:brewinstallgeoipYou also need the GeoIP databases.For Django >= 1.9, download City and Country databases as binary (not CSV):http://dev.maxmind.com/geoip/geoip2/geolite2/For Django 1.8, download City and Country legacy databases as binary (not CSV):http://dev.maxmind.com/geoip/legacy/geolite/Create a directory wherever you want and uncompress these archives this
directory. Once done, setGEOIP_PATHsetting pointing to this directory:GEOIP_PATH='/absolute/path/to/maxmind/db/directory'Installing django-safetyInstall$pipinstalldjango-safetyIn yoursettings.py, addsafetytoINSTALLED_APPS:INSTALLED_APPS=(# Your other apps here.'safety',)In yoururls.py, includesafety.urlsundersafetynamespace.urlpatterns=[# Your other URLs here.url(r'^security/',include('safety.urls',namespace='safety')),]Synchronize the database:$pythonmanage.pymigratesafetyGreat. The session feature is ready.If you want to enable the “force password change” feature, read the next.Enabling “force password change” featureTo enable this feature, you have two choices:You want to protect only specific views? Usepassword_change_required()decoratorYou want to protect your whole application? UsePasswordChangeMiddlewaremiddlewareThe decorator works as any Django view decorator.## In your urls.py#fromsafety.decoratorsimportpassword_change_requiredfrom.viewsimportprotect_meurlpatterns=[# Other URLs here.url(r'^protect-me/$',password_change_required(protect_me)),]## Or in your views.py (it's up to you)#fromdjango.shortcutsimportrenderfromsafety.decoratorsimportpassword_change_required@password_change_requireddefprotect_me(request):returnrender(request,'protect_me.html')The middleware works as any Django middleware.Addsafety.middleware.PasswordChangeMiddlewaremiddleware in yoursettings.py:MIDDLEWARE_CLASSES=['django.middleware.security.SecurityMiddleware','django.contrib.sessions.middleware.SessionMiddleware','django.middleware.common.CommonMiddleware','django.middleware.csrf.CsrfViewMiddleware','django.contrib.auth.middleware.AuthenticationMiddleware','django.contrib.auth.middleware.SessionAuthenticationMiddleware','django.contrib.messages.middleware.MessageMiddleware','django.middleware.clickjacking.XFrameOptionsMiddleware','safety.middleware.PasswordChangeMiddleware',]Done.SettingsSettingDescriptionSAFETY_LOGIN_REQUIRED_MIXIN_CLASSThe Python path to your own “login required” mixin class.
Defaults tosafety.mixins.LoginRequiredMixin.SAFETY_IP_RESOLVERThe Python path to your own IP resolver callable.
Defaults tosafety.resolvers.remote_addr_ip.SAFETY_DEVICE_RESOLVERThe Python path to your own device resolver callable.
Defaults tosafety.resolvers.device.SAFETY_LOCATION_RESOLVERThe Python path to your own location resolver callable.
Defaults tosafety.resolvers.location.Development# Install pip and virtualenv$sudoeasy_installpip$sudopipinstallvirtualenv# Clone repository$gitclonehttps://github.com/ulule/django-safety.git# Setup your development environment$cddjango-safety$makedevenv$source.venv/bin/activate# Download GeoIP databases$makegeoip# Launch test suite$maketest# Launch test suite with tox to check compatibility$tox# Run the example project (default user username is "johndoe")$makeexample-migrate$makeexample-user$makeexample-serveContributeCreate an issue (beforesubmitting pull requests)Submit your bug or feature requestYou want to fix or code it yourself? Great! Fork the projectCreate a branch, always add tests and make sure they all pass withtoxSubmit a pull requestCompatibilitypython 2.7: Django 1.8, 1.9Python 3.4: Django 1.8, 1.9Python 3.5: Django 1.8, 1.9