mirror of
https://github.com/boostorg/website-v2.git
synced 2026-01-19 04:42:17 +00:00
8db6603814
- Add field can_update_image to User model and user admin - Prevent user from updating photo if they field is false - Add docs
2.3 KiB
2.3 KiB
User Management
Handling "Unclaimed" User Accounts
This section covers how to handle the User records that are created as part of the upload process from the first-time data import and through syncing with GitHub.
The code for this page lives in the users/ app.
About Registration and Login
- We use Django Allauth to handle user accounts
- We do some overriding of their logic for the profile page
- We override the password reset logic as part of allowing users to claim their unclaimed accounts
About Unclaimed User Accounts
- When libraries are created and updated from GitHub, we receive information on Library Maintainers and Authors.
- Those authors and maintainers are added as Users and then linked to the Library or LibraryVersion record they belong to.
- When they are created, the User accounts have their
claimedfield marked as False. This field defaults toTrue, and will only beFalsefor users who were created by an automated process. - We use the email address and name in the
libraries.jsonfile for that library to create the User record
When An Unclaimed User Tries to Register
- If a user tries to register with the same email address as an existing user (a user with
claimedset toFalse), we interrupt the Django Allauth registration error that happens in this case to check whether the user has been claimed - If the user has
claimedset toFalse, we send the user a custom message and send them a password reset email - On the backend, we interrupt the Django Allauth password reset process to mark users as claimed once their password has been successfully reset
Preventing a user from being able to update their profile photo
To guard against bad actors uploading offensive photos as profile photos, we have the ability to restrict a user's ability to update their profile photo.
- Log into the Django admin at
/admin/ - Navigate to the Users menu
- Find the user whose profile photo you want to restrict. You can search by name or email address.
- Scroll to the bottom of that user's record and uncheck the box that says, "Can update image."
- Click "Save."
The user can no longer update their own profile photo. Instead, they will see a message that they must contact an administrator to update their profile photo.