theCatsPaw/BitVid — pull request #1 by ztstewart (2013-12-07 05:10:50+00:00)
Title: Authentication Fixes

Hello,

As a Django developer, I've come across your video hosting project, and I've written a series of commits that address the following issues, that will greatly aid in the future growth of your project:

1. Your project uses a custom User model, but does not plug this into Django's authentication system. This means that all of the session tracking and log in / log out code was hand rolled and incorporated in all views. Not only is this certainly a security issue (no reissue of cookies was made, for example), it made all of your views over complicated. I have fixed this issue: your custom User model now is Django's user model, and that means no insecure buggy authentication code.

2. With this fixed, it is possible to greatly clean up your views. I have done so to a small extent; what simplifications I have done do not even begin to touch on what is now possible. It makes it much easier to add update / view / list / delete functionality to channels, videos, etc. going forward.

3. I have switched the custom User model's email field to an EmailField, not a char field. This requires a migration.

4. I have created a context processor to temporarily allow pages using the "logged_in_user" context to keep using that, with the understanding that should switch to using Django's built in user template context immediately.

Should you accept this pull request, I will continue to refactor this view code and enable new functionality such as editing a channel.