django-otp

Bump version: 1.7.0 → 1.7.1

Bump version: 1.6.3 → 1.7.0

Bump version: 1.6.2 → 1.6.3

Bump version: 1.6.1 → 1.6.2

Bump version: 1.6.0 → 1.6.1

Bump version: 1.5.4 → 1.6.0

Bump version: 1.5.3 → 1.5.4

Bump version: 1.5.2 → 1.5.3

Bump version: 1.5.1 → 1.5.2

Bump version: 1.5.0 → 1.5.1

• #141: Support alternative QR code library segno.

  Previously, only the `qrcode`_ library was supported.

  Use segno by installing django-otp[segno] or just install the segno package.

• #140: Support customization of email delivery.

  See the ~django_otp.plugins.otp_email.models.EmailDevice documentation for API details.

• Support translation of the "sent by email" message.

• #137: Add TimestampMixin

  Add a new TimestampMixin with created_at and last_used_at fields for device models.

  All builtin plugins now have these timestamp fields and require migrating.

• Some documentation cleanup.

• #122: Added throttling to token generation.

  Devices that generate random tokens can take advantage of the new ~django_otp.models.CooldownMixin to enforce limits on how frequently new tokens can be generated (and presumably delivered). ~django_otp.plugins.otp_email.models.EmailDevice uses this and has a default cooldown configured.

  Thanks to Demetris Stavrou for this feature.

• Note: ~django_otp.models.VerifyNotAllowed is now an ~enum.Enum. This will break any code that inadvisably hard-coded the string value of the N_FAILED_ATTEMPTS property.

• #133: Add pt-PT translation.

• #131: Fix German translation

• #125: Support email body_html templates

• #124: Add pt-BR translations.

• This project is now managed with hatch, which replaces setuptools, pipenv, and tox. Users of the package should not be impacted. Developers can refer to the readme for details. If you're packaging this project from source, I suggest relying on pip's isolated builds rather than using hatch directly.

• #123: Add support for passing an image parameter in the otpauth URL. See OTP_TOTP_IMAGE.

• #116: Add German translation

• #115: Force OTP_EMAIL_SUBJECT to be a string

• #106: Add Spanish translation

• #89: Use the standard username context variable for compatibility.

• #93: Default to AutoField to avoid spurious migrations.

• #87: Fix locked_until key in throttling reason map.

Where possible, all APIs now verify tokens atomically. This prevents race conditions that could result in a token being verified twice as well as closing gaps in throttling enforcement. Low-level integrators may still need to manage their own transactions.

• #82: Add ability to pass extra context when rendering ~django_otp.plugins.otp_email.models.EmailDevice templates.

• #77: Force username to a string in config_url. Note that this might not produce a very human-friendly result, but it shouldn't throw an exception.

• #76: Django 3.2 supports the prefers-color-scheme media query, so we need to force a white background for QR codes.

• #71: Provide time at which throttling lock expires.

• Added a setting to load the email body template from a template file.

• Added contributed French string translations.

• Dropped support for Django < 2.2.

• #49: Hide the navigation sidebar on the login page.

• Stricter authorization checks for qrcodes in the admin interface.

• #38: Update admin fields for ~django_otp.plugins.otp_email.models.EmailDevice.

~django_otp.models.SideChannelDevice is a new abstract device class to simplify writing devices that deliver tokens to the user by other channels (email, SMS, etc.).

• #33, #34 (arjan-s): Implement ~django_otp.models.SideChannelDevice, reimplement ~django_otp.plugins.otp_email.models.EmailDevice on top of it, and add a few settings for customization.

• Add rate limiting to ~django_otp.plugins.otp_email.models.EmailDevice and ~django_otp.plugins.otp_static.models.StaticDevice.

• #26: Display OTP Token field on the login page even when user has not yet authenticated.

• #17: Drop Python 2 support.

• #18: Back to a single login template for now.

• #23: Allow OTP_HOTP_ISSUER and OTP_TOTP_ISSUER to be callable.

• #15: Add admin template for Django 3.0.

• #10: Remove old admin login templates that are confusing some unrelated tools.

• Built-in forms have autocomplete disabled for token widgets.

• Fixed miscellaneous typos.

• #2: Fix LoginView for already-authenticated users, with multiple auth backends configured.

Removed dependencies on Python 2 compatibility shims in Django < 3.0.

Removed obsolete compatibility shims. The testing and support matrix is unchanged from 0.6.0, so there should be no impact.

• Built-in HOTP and TOTP devices are now rate-limited, enforcing exponentially increasing delays between successive failures. See the device documentation for information on presenting more useful error messages when this happens, as well as for tuning (or disabling) this behavior.

  Thanks to Luke Plant for the idea and implementation.

• Fix encoding of otpauth:// URL parameters.

• Error messages in ~django_otp.forms.OTPAuthenticationForm and ~django_otp.forms.OTPTokenForm can be customized.

• Remove dependencies on old non-class login views.

• Drop support for Django < 1.11.

• Fix return type of ~django_otp.plugins.otp_static.models.StaticToken.random_token.

• Fix addstatictoken string handling under Python 3.

• Improved handling of device persistent identifiers.

• Make sure default keys are unicode values.

• Update addstatictoken command for current Django versions.

• Allow verified users to be pickled.

• Minor fixes for Django 1.11 and 2.0.