Changing password in Django Admin

Question

I recently created the admin.py based in the Django Project Document:

https://docs.djangoproject.com/en/dev/topics/auth/customizing/#django.contrib.auth.models

Answer 1

('Permissions', {'fields': ('is_active', 'is_superuser',)}),

Answer 2

Put this in your UserChangeForm:

password = ReadOnlyPasswordHashField(label=("Password"),
        help_text=("Raw passwords are not stored, so there is no way to see "
                    "this user's password, but you can change the password "
                    "using <a href=\"../password/\">this form</a>."))

Answer 3

You could also consider extending the UserAdmin this way:

from django.contrib import admin
from myapp.models import CustomUser
from django.contrib.auth.admin import UserAdmin

class CustomUserAdmin(UserAdmin):
    list_display = []
admin.site.register(CustomUser, CustomUserAdmin)

Answer 4

For a django version independent solution you can reverse the url in the UserChangeForm.__init__ with something like:

from django.core.urlresolvers import reverse

class UserChangeForm(forms.ModelForm):
    password = ReadOnlyPasswordHashField()
    def __init__(self, *args, **kwargs):
        super().__init__(*args, **kwargs)
        self.fields['password'].help_text = (
            "Raw passwords are not stored, so there is no way to see "
            "this user's password, but you can <a href=\"%s\"> "
            "<strong>Change the Password</strong> using this form</a>."
        ) % reverse_lazy('admin:auth_user_password_change', args=[self.instance.id])

Answer 5

I added this method to my UserAdmin class:

def save_model(self, request, obj, form, change):
    # Override this to set the password to the value in the field if it's
    # changed.
    if obj.pk:
        orig_obj = models.User.objects.get(pk=obj.pk)
        if obj.password != orig_obj.password:
            obj.set_password(obj.password)
    else:
        obj.set_password(obj.password)
    obj.save()

You can the show the password field normally, but admins will only see the hashed password. If they alter it, the new value is then hashed and save.

This adds a single query to each time you save a user via the admin. It should generally not be an issue, since most systems don't have admins intensively editing users.

Answer 6

password = ReadOnlyPasswordHashField(label= ("Password"),
        help_text= ("Raw passwords are not stored, so there is no way to see "
                    "this user's password, but you can change the password "
                    "using <a href=\"../password/\">this form</a>."))

There is change in the href, for previous versions of django you can use

<a href=\"/password/\">this form</a>.

For django 1.9+ <a href=\"../password/\">this form</a>