gRddlmZddlmZddlmZddlmZddlm Z ddl m Z ddl m Z mZeaGd d eZy ) )local)get_user_model) ModelBackend) get_adapter) LoginMethod) app_settings)filter_users_by_emailfilter_users_by_usernamecteZdZdZdZdedefdZdedefdZdedefd Zd Z d Z e d Z e d Z y)AuthenticationBackendc |jd}|syd|_|j|fi|}|js|j||S)NpasswordF)get_did_check_password _authenticate_mitigate_timing_attack)selfrequest credentialsrusers [/var/www/skyplay_api_hub/venv/lib/python3.12/site-packages/allauth/account/auth_backends.py authenticatez"AuthenticationBackend.authenticatesQ??:.#( !t!!'9[9''  ( ( 2 c |jd}|jd}|rLtjtjvr|j ||}|r|S|j ||}|r|S|jd}|r|j ||}|r|S|jd}|r|j||}|r|Sy)Nrusernameemailphone)rrEMAILr LOGIN_METHODS_authenticate_by_email_authenticate_by_username_authenticate_by_phone)rrrrrrrrs rrz#AuthenticationBackend._authenticates??:.??:.   L$>$>> 228XFK11(HED ( ..uh?D ( ..uh?D rrrc|r tjtjvryt }|j |}|j ||SN)rPHONEr r rget_user_by_phone_check_password)rrradapterrs rr#z,AuthenticationBackend._authenticate_by_phone9sE ))1K1KK-((/##D(33rrctjtjvstjr|syt |j }|j||Sr%)rUSERNAMEr r USER_MODEL_USERNAME_FIELDr firstr()rrrrs rr"z/AuthenticationBackend._authenticate_by_username@sK  ! !)C)C C ::'1779##D(33rrc|r tjtjvryt |d}|D]}|j ||s|cSy)NT)prefer_verified)rrr r r r()rrrusersrs rr!z,AuthenticationBackend._authenticate_by_emailJsR  ))1K1KK%eTB D##D(3  rc@tj|yr%)r set_password)rrs rrz-AuthenticationBackend._mitigate_timing_attackWs''1rc|syd|_|j|}|r$|j|}|s|j||r|SdS)NT)rcheck_passworduser_can_authenticate _stash_user)rrroks rr(z%AuthenticationBackend._check_passwordZsQ#'   * ++D1B  &t#t#rc>ttdd}|t_|S)aNow, be aware, the following is quite ugly, let me explain: Even if the user credentials match, the authentication can fail because Django's default ModelBackend calls user_can_authenticate(), which checks `is_active`. Now, earlier versions of allauth did not do this and simply returned the user as authenticated, even in case of `is_active=False`. For allauth scope, this does not pose a problem, as these users are properly redirected to an account inactive page. This does pose a problem when the allauth backend is used in a different context where allauth is not responsible for the login. Then, by not checking on `user_can_authenticate()` users will allow to become authenticated whereas according to Django logic this should not be allowed. In order to preserve the allauth behavior while respecting Django's logic, we stash a user for which the password check succeeded but `user_can_authenticate()` failed. In the allauth authentication logic, we can then unstash this user and proceed pointing the user to the account inactive page. rN)getattr_stashr)clsrrets rr6z!AuthenticationBackend._stash_useres0ffd+  rc$|jdSr%)r6)r;s runstash_authenticated_userz0AuthenticationBackend.unstash_authenticated_userst$$rN)__name__ __module__ __qualname__rrstrr#r"r!rr( classmethodr6r>rrr r s{<4C4344#44   2 $6%%rr N) threadingrdjango.contrib.authrdjango.contrib.auth.backendsrallauth.account.adapterrallauth.account.app_settingsrr utilsr r r:r rDrrrLs1.5/4B s%Ls%r