Repository: translate/pootle

Issue:
Warn admin if the default login is still valid
Since we ship with an admin account enabled by default, we should warn the administrator(s) on the admin panel if this account is still active and usable/exploitable.

This doesn't fit that well into our current model of software related error messages, but is a more general configuration issue (like the current messages about email addresses). As part of this bug we should probably rethink the wording and grouping of these messages.



Discussion:
we can check the password and complain if it is still the insecure default


Resolving patch:
diff --git a/pootle/apps/pootle_app/management/commands/initdb.py b/pootle/apps/pootle_app/management/commands/initdb.py
--- a/pootle/apps/pootle_app/management/commands/initdb.py
+++ b/pootle/apps/pootle_app/management/commands/initdb.py
@@ -22,6 +22,8 @@ class Command(NoArgsCommand):
     help = 'Populates the database with initial values: users, projects, ...'
 
     def handle_noargs(self, **options):
-        logging.info('Populating the database.')
+        self.stdout.write('Populating the database.')
         initdb()
-        logging.info('Successfully populated the database.')
+        self.stdout.write('Successfully populated the database.')
+        self.stdout.write("To create an admin user, use the `pootle "
+                          "createsuperuser` command.")
diff --git a/pootle/checks.py b/pootle/checks.py
--- a/pootle/checks.py
+++ b/pootle/checks.py
@@ -235,3 +235,28 @@ def check_settings(app_configs=None, **kwargs):
                 ))
 
     return errors
+
+
+@checks.register()
+def check_users(app_configs=None, **kwargs):
+    from django.contrib.auth import get_user_model
+    from django.db import ProgrammingError
+    from django.db.utils import OperationalError
+
+    errors = []
+
+    User = get_user_model()
+    try:
+        admin_user = User.objects.get(username='admin')
+    except (User.DoesNotExist, OperationalError, ProgrammingError):
+        pass
+    else:
+        if admin_user.check_password('admin'):
+            errors.append(checks.Warning(
+                _("The default 'admin' user still has a password set to "
+                  "'admin'."),
+                hint=_("Remove the 'admin' user or change its password."),
+                id="pootle.W016",
+            ))
+
+    return errors
diff --git a/pootle/core/initdb.py b/pootle/core/initdb.py
--- a/pootle/core/initdb.py
+++ b/pootle/core/initdb.py
@@ -34,7 +34,6 @@ def initdb():
     create_pootle_permission_sets()
     create_default_projects()
     create_default_languages()
-    create_default_admin()
 
 
 def create_revision():
@@ -293,23 +292,3 @@ def create_default_languages():
             lang, created = Language.objects.get_or_create(**criteria)
         except:
             pass
-
-
-def create_default_admin():
-    """Create the default admin user for Pootle.
-
-    You definitely want to change the admin account so that your default
-    install is not accessible with the default credentials. The users 'noboby'
-    and 'default' should be left as is.
-    """
-    User = get_user_model()
-
-    criteria = {
-        'username': u"admin",
-        'full_name': u"Administrator",
-        'is_active': True,
-        'is_superuser': True,
-    }
-    admin = User(**criteria)
-    admin.set_password("admin")
-    admin.save()


Test patch: