openwisp-users 1.3.1__tar.gz → 1.3.3__tar.gz

{openwisp_users-1.3.1 → openwisp_users-1.3.3}/CHANGES.rst

@@ -1,6 +1,84 @@
 Changelog
 =========
 
+Version 1.3.3 [2026-11-13]
+--------------------------
+
+Bugfixes
+~~~~~~~~
+
+- Prevented unauthorized changes to owner memberships
+
+  Prevent non-superusers from editing owner memberships in
+  OrganizationUserAdmin.
+
+  Superusers can still update owner memberships, and administrators can
+  still edit other memberships.
+
+  **Security Advisory**: `GHSA-7h4r-39v5-q7cq
+  <https://github.com/openwisp/openwisp-users/security/advisories/GHSA-7h4r-39v5-q7cq>`_.
+
+- Enforced password validators in user password API
+
+  Apply configured password validators when creating users and changing
+  their passwords through the API.
+
+  **Security Advisory**: `GHSA-qx7x-g6rx-5g3g
+  <https://github.com/openwisp/openwisp-users/security/advisories/GHSA-qx7x-g6rx-5g3g>`_.
+
+- Aligned organization owner permissions across admin and API
+
+  Use consistent organization owner permission checks for account,
+  password, and email management in the admin and REST API.
+
+  Include owners of inactive organizations in ownership checks. Existing
+  access for superusers and owners managing their own accounts remains
+  unchanged.
+
+  **Security Advisory**: `GHSA-97jh-j6hw-4389
+  <https://github.com/openwisp/openwisp-users/security/advisories/GHSA-97jh-j6hw-4389>`_.
+
+- Prevented stale memberships after organization status changes
+
+  Clear cached memberships after the organization status change commits,
+  preventing stale memberships from being cached during the transaction.
+
+  **Security Advisory**: `GHSA-x794-gqv9-rffh
+  <https://github.com/openwisp/openwisp-users/security/advisories/GHSA-x794-gqv9-rffh>`_.
+
+- Prevented unauthorized changes to organization memberships
+
+  When adding or editing an organization membership in
+  OrganizationUserAdmin, organization admins can only select users who
+  already belong to an organization they manage and cannot select
+  superusers.
+
+  **Security Advisory**: `GHSA-p9mp-fxhh-hmfw
+  <https://github.com/openwisp/openwisp-users/security/advisories/GHSA-p9mp-fxhh-hmfw>`_.
+
+- Improved permission checks for bulk user actions
+
+  Organization administrators can only activate or deactivate users they
+  have permission to edit. If the selection includes a user they cannot
+  edit, the action is stopped and a message is displayed.
+
+  **Security advisory**: `GHSA-q66j-wp8j-5hf5
+  <https://github.com/openwisp/openwisp-users/security/advisories/GHSA-q66j-wp8j-5hf5>`_.
+
+Version 1.3.2 [2026-10-23]
+--------------------------
+
+Bugfixes
+~~~~~~~~
+
+- Restored logo padding on mobile screens
+
+  Rules in `openwisp.css` removed the logo padding on non-admin screens,
+  making it appear cramped.
+
+- Corrected password expiration dates and duplicate notifications `#375
+  <https://github.com/openwisp/openwisp-users/issues/375>`_
+
 Version 1.3.1 [2026-09-09]
 --------------------------
 

{openwisp_users-1.3.1/openwisp_users.egg-info → openwisp_users-1.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openwisp-users
-Version: 1.3.1
+Version: 1.3.3
 Summary: Provides basic multi-tenancy features for OpenWISP (using the Django web-framework)
 Home-page: http://openwisp.org
 Download-URL: https://github.com/openwisp/openwisp-users/releases

{openwisp_users-1.3.1 → openwisp_users-1.3.3}/openwisp_users/__init__.py

@@ -1,4 +1,4 @@
-VERSION = (1, 3, 1, "final")
+VERSION = (1, 3, 3, "final")
 __version__ = VERSION  # alias
 
 

{openwisp_users-1.3.1 → openwisp_users-1.3.3}/openwisp_users/accounts/static/openwisp-users/accounts/css/non-admin.css

@@ -5,3 +5,8 @@ button,
 form label {
   margin-right: 5px;
 }
+@media (max-width: 768px) {
+  h1#site-name {
+    padding: 0.5rem 0;
+  }
+}

{openwisp_users-1.3.1 → openwisp_users-1.3.3}/openwisp_users/admin.py

@@ -8,19 +8,19 @@ from django.apps import apps
 from django.conf import settings
 from django.contrib import admin, messages
 from django.contrib.admin.actions import delete_selected
-from django.contrib.admin.utils import model_ngettext
+from django.contrib.admin.utils import model_ngettext, quote
 from django.contrib.auth import get_user_model
 from django.contrib.auth.admin import GroupAdmin as BaseGroupAdmin
 from django.contrib.auth.admin import UserAdmin as BaseUserAdmin
 from django.contrib.auth.forms import UserChangeForm as BaseUserChangeForm
 from django.contrib.auth.forms import UserCreationForm as BaseUserCreationForm
-from django.core.exceptions import ValidationError
-from django.db.models import Q
+from django.core.exceptions import PermissionDenied, ValidationError
+from django.db.models import OuterRef, Q, Subquery
 from django.forms.models import BaseInlineFormSet
 from django.http import HttpResponseRedirect
 from django.template.response import TemplateResponse
 from django.urls import reverse
-from django.utils.html import format_html
+from django.utils.html import format_html, format_html_join
 from django.utils.timezone import localdate
 from django.utils.translation import gettext_lazy as _
 from django.utils.translation import ngettext
@@ -37,7 +37,7 @@ from openwisp_utils.admin import CopyableFieldsAdmin
 
 from . import settings as app_settings
 from .multitenancy import MultitenantAdminMixin, MultitenantOrgFilter
-from .utils import BaseAdmin
+from .utils import BaseAdmin, user_not_allowed_to_change_owner
 
 Group = load_model("openwisp_users", "Group")
 Organization = load_model("openwisp_users", "Organization")
@@ -47,15 +47,6 @@ User = get_user_model()
 logger = logging.getLogger(__name__)
 
 
-def user_not_allowed_to_change_owner(user, obj):
-    return (
-        obj
-        and not user.is_superuser
-        and user.pk != obj.pk
-        and obj.is_owner_of_any_organization
-    )
-
-
 class EmailAddressInline(admin.StackedInline):
     model = EmailAddress
     extra = 0
@@ -237,6 +228,41 @@ class UserAdmin(MultitenantAdminMixin, BaseUserAdmin, BaseAdmin):
     class Media:
         css = {"all": ("openwisp-users/css/admin.css",)}
 
+    def _format_permission_denied(self, users, has_more):
+        display_names = []
+        url_name = f"{self.opts.app_label}_{self.opts.model_name}_change"
+        for user in users:
+            url = reverse(
+                f"{self.admin_site.name}:{url_name}",
+                args=[quote(user.pk)],
+            )
+            display_names.append(format_html('<a href="{}">{}</a>', url, user.username))
+        count = len(users)
+        if has_more:
+            formatted_names = format_html_join(
+                ", ", "{}", ((name,) for name in display_names)
+            )
+        elif count > 1:
+            preceding = format_html_join(
+                ", ", "{}", ((name,) for name in display_names[:-1])
+            )
+            formatted_names = format_html(
+                "{} {} {}", preceding, _("and"), display_names[-1]
+            )
+        else:
+            formatted_names = display_names[0]
+        return format_html(
+            ngettext(
+                "No users were updated because you do not have permission "
+                "to modify this user: {usernames}{ending}",
+                "No users were updated because you do not have permission "
+                "to modify these users: {usernames}{ending}",
+                count,
+            ),
+            usernames=formatted_names,
+            ending=" …" if has_more else ".",
+        )
+
     def require_confirmation(func):
         """
         Decorator to lead to a confirmation page.
@@ -247,6 +273,40 @@ class UserAdmin(MultitenantAdminMixin, BaseUserAdmin, BaseAdmin):
         """
 
         def wrapper(modeladmin, request, queryset):
+            # Bulk updates bypass the object checks used by the change form.
+            unauthorized_users = []
+            has_more_unauthorized_users = False
+            checked_pks = []
+            for obj in queryset.iterator(chunk_size=1000):
+                if not modeladmin.has_change_permission(request, obj):
+                    if len(unauthorized_users) < 10:
+                        unauthorized_users.append(obj)
+                    else:
+                        has_more_unauthorized_users = True
+                        # An eleventh denial confirms truncation. The action cannot
+                        # proceed, so checking further users would not change it.
+                        break
+                else:
+                    checked_pks.append(obj.pk)
+            if unauthorized_users:
+                modeladmin.message_user(
+                    request,
+                    modeladmin._format_permission_denied(
+                        unauthorized_users, has_more_unauthorized_users
+                    ),
+                    messages.ERROR,
+                )
+                return HttpResponseRedirect(request.get_full_path())
+            queryset = queryset.filter(pk__in=checked_pks)
+            if not request.user.is_superuser:
+                protected_owner_ids = (
+                    OrganizationOwner.objects.filter(
+                        organization_user__user_id=OuterRef("pk")
+                    )
+                    .exclude(organization_user__user_id=request.user.pk)
+                    .values("organization_user__user_id")
+                )
+                queryset = queryset.exclude(pk__in=Subquery(protected_owner_ids))
             opts = modeladmin.model._meta
             if request.POST.get("confirmation") is None:
                 request.current_app = modeladmin.admin_site.name
@@ -596,6 +656,40 @@ class OrganizationUserAdmin(
     fields = ("user", "organization", "is_admin")
     search_fields = ["user__username", "organization__name"]
 
+    def formfield_for_foreignkey(self, db_field, request, **kwargs):
+        if db_field.name == "user" and not request.user.is_superuser:
+            # Filter only non-superusers belonging to organizations
+            # managed by the requester.
+            queryset = User.objects.filter(
+                id__in=OrganizationUser.objects.filter(
+                    organization_id__in=request.user.organizations_managed
+                ).values_list("user_id"),
+                is_superuser=False,
+            )
+            self._check_user(request, queryset)
+            kwargs["queryset"] = queryset
+        return super().formfield_for_foreignkey(db_field, request, **kwargs)
+
+    def _check_user(self, request, queryset):
+        user_id = request.POST.get("user")
+        if request.method != "POST" or not user_id:
+            return
+        try:
+            # Detect a submitted user ID outside the requester's scope.
+            allowed = queryset.filter(pk=user_id).exists()
+        except (ValidationError, ValueError, TypeError, OverflowError):
+            return
+        if not allowed:
+            # Django logs this potentially malicious request as a warning.
+            raise PermissionDenied(
+                f"Rejected unavailable membership user: actor={request.user.pk}"
+            )
+
+    def has_change_permission(self, request, obj=None):
+        if obj and not request.user.is_superuser and hasattr(obj, "organizationowner"):
+            return False
+        return super().has_change_permission(request, obj)
+
     def get_readonly_fields(self, request, obj=None):
         # retrieve readonly fields
         fields = super().get_readonly_fields(request, obj)

{openwisp_users-1.3.1 → openwisp_users-1.3.3}/openwisp_users/api/permissions.py

@@ -1,10 +1,12 @@
 from django.utils.translation import gettext_lazy as _
-from rest_framework.permissions import BasePermission
+from rest_framework.permissions import SAFE_METHODS, BasePermission
 from rest_framework.permissions import (
     DjangoModelPermissions as BaseDjangoModelPermissions,
 )
 from swapper import load_model
 
+from ..utils import user_not_allowed_to_change_owner
+
 Organization = load_model("openwisp_users", "Organization")
 
 
@@ -95,6 +97,30 @@ class IsOrganizationOwner(BaseOrganizationPermission):
         return org and (user.is_superuser or user.is_owner(org))
 
 
+class CanChangeUser(BasePermission):
+    message = _(
+        "You do not have permission to edit or delete this user "
+        "because they are owner of an organization."
+    )
+
+    def has_object_permission(self, request, view, obj):
+        return request.method in SAFE_METHODS or not user_not_allowed_to_change_owner(
+            request.user, obj
+        )
+
+
+class CanChangeUserEmail(CanChangeUser):
+    def has_permission(self, request, view):
+        if request.method in SAFE_METHODS or request.user.is_superuser:
+            return True
+        return super().has_object_permission(
+            request, view, view.get_parent_queryset().first()
+        )
+
+    def has_object_permission(self, request, view, obj):
+        return super().has_object_permission(request, view, obj.user)
+
+
 class DjangoModelPermissions(ObjectOrganizationMixin, BaseDjangoModelPermissions):
     perms_map = {
         "GET": ["%(app_label)s.view_%(model_name)s"],

{openwisp_users-1.3.1 → openwisp_users-1.3.3}/openwisp_users/api/serializers.py

@@ -9,9 +9,11 @@ from dj_rest_auth.serializers import (
     PasswordResetSerializer as BasePasswordResetSerializer,
 )
 from django.conf import settings
-from django.contrib.auth import get_user_model
+from django.contrib.auth import get_user_model, password_validation
+from django.contrib.auth.hashers import check_password
 from django.contrib.auth.models import Permission
 from django.contrib.sites.shortcuts import get_current_site
+from django.core.exceptions import ValidationError as DjangoValidationError
 from django.db import transaction
 from django.db.models import Q
 from django.utils.module_loading import import_string
@@ -275,6 +277,17 @@ class SuperUserListSerializer(BaseSuperUserSerializer):
             raise serializers.ValidationError(_("This field cannot be blank."))
         return value
 
+    def validate(self, data):
+        data = super().validate(data)
+        values = dict(data)
+        for field in self._skip_validation_fields + ["password"]:
+            values.pop(field, None)
+        try:
+            password_validation.validate_password(data["password"], user=User(**values))
+        except DjangoValidationError as error:
+            raise serializers.ValidationError({"password": error.messages})
+        return data
+
     def create(self, validated_data):
         group_data = validated_data.pop("groups", None)
         org_user_data = validated_data.pop("organization_users", None)
@@ -457,7 +470,7 @@ class ChangePasswordSerializer(serializers.Serializer):
         else:
             if self.initial_data.get("new_password"):
                 to_change_user = self.context["user"]
-                if not to_change_user.check_password(value):
+                if not check_password(value, to_change_user.password):
                     raise serializers.ValidationError(
                         _(
                             "Your old password was entered incorrectly."
@@ -473,6 +486,7 @@ class ChangePasswordSerializer(serializers.Serializer):
             raise serializers.ValidationError(
                 _("New password cannot be the same as your old password.")
             )
+        password_validation.validate_password(value, user=self.context["user"])
         return value
 
     def save(self, **kwargs):

{openwisp_users-1.3.1 → openwisp_users-1.3.3}/openwisp_users/api/views.py

@@ -20,7 +20,11 @@ from rest_framework.response import Response
 from rest_framework.settings import api_settings
 from swapper import load_model
 
-from openwisp_users.api.permissions import DjangoModelPermissions
+from openwisp_users.api.permissions import (
+    CanChangeUser,
+    CanChangeUserEmail,
+    DjangoModelPermissions,
+)
 from openwisp_users.auth import create_auth_token
 from openwisp_users.backends import UsersAuthenticationBackend
 from openwisp_utils.api.pagination import OpenWispPagination
@@ -150,6 +154,8 @@ class OrganizationDetailView(BaseOrganizationView, RetrieveUpdateDestroyAPIView)
 
 
 class BaseUserView(ProtectedAPIMixin):
+    permission_classes = ProtectedAPIMixin.permission_classes + (CanChangeUser,)
+
     def get_queryset(self):
         user = self.request.user
         if user.is_superuser:
@@ -221,7 +227,11 @@ class ChangePasswordView(BaseUserView, UpdateAPIView):
         if self.request.user.id == self.kwargs["pk"]:
             self.permission_classes = [IsAuthenticated]
         else:
-            self.permission_classes = [IsAuthenticated, DjangoModelPermissions]
+            self.permission_classes = [
+                IsAuthenticated,
+                DjangoModelPermissions,
+                CanChangeUser,
+            ]
         return super().get_permissions()
 
     def get_object(self):
@@ -241,15 +251,13 @@ class ChangePasswordView(BaseUserView, UpdateAPIView):
             "id": self.kwargs["pk"],
         }
         obj = get_object_or_404(qs, **filter_kwargs)
+        self.check_object_permissions(self.request, obj)
         return obj
 
-    def get_serializer_context(self):
-        context = super().get_serializer_context()
-        context["user"] = self.get_object()
-        return context
-
     def update(self, request, *args, **kwargs):
-        serializer = self.get_serializer(data=request.data)
+        context = self.get_serializer_context()
+        context["user"] = self.get_object()
+        serializer = self.get_serializer(data=request.data, context=context)
         serializer.is_valid(raise_exception=True)
         serializer.save()
         return Response(
@@ -271,6 +279,7 @@ class PasswordChangeView(ProtectedAPIMixin, BasePasswordChangeView):
 
 
 class BaseEmailView(ProtectedAPIMixin, FilterByParent, GenericAPIView):
+    permission_classes = ProtectedAPIMixin.permission_classes + (CanChangeUserEmail,)
     model = EmailAddress
     serializer_class = EmailAddressSerializer
 

{openwisp_users-1.3.1 → openwisp_users-1.3.3}/openwisp_users/apps.py

@@ -113,6 +113,11 @@ class OpenwispUsersConfig(AppConfig):
             sender=Organization,
             dispatch_uid="handle_org_is_active_change",
         )
+        post_save.connect(
+            self.invalidate_org_membership_cache,
+            sender=Organization,
+            dispatch_uid="invalidate_org_membership_cache",
+        )
 
         for model in [OrganizationUser, OrganizationOwner]:
             for signal, name in signal_tuples:
@@ -174,19 +179,30 @@ class OpenwispUsersConfig(AppConfig):
             record_password_based_login(request, False)
 
     @classmethod
-    def handle_org_is_active_change(cls, instance, **kwargs):
+    def handle_org_is_active_change(cls, instance, using, **kwargs):
         if instance._state.adding:
             # If it's a new organization, we don't need to update any cache
             return
         Organization = instance._meta.model
         try:
-            old_instance = Organization.objects.only("is_active").get(pk=instance.pk)
+            old_instance = (
+                Organization.objects.using(using).only("is_active").get(pk=instance.pk)
+            )
         except Organization.DoesNotExist:
             return
+        instance._is_active_changed = instance.is_active != old_instance.is_active
+
+    @classmethod
+    def invalidate_org_membership_cache(cls, instance, using, **kwargs):
+        if not getattr(instance, "_is_active_changed", False):
+            return
+        instance._is_active_changed = False
         from .tasks import invalidate_org_membership_cache
 
-        if instance.is_active != old_instance.is_active:
-            invalidate_org_membership_cache.delay(instance.pk)
+        pk = instance.pk
+        transaction.on_commit(
+            lambda: invalidate_org_membership_cache.delay(pk), using=using
+        )
 
     @classmethod
     def pre_save_update_organizations_dict(cls, instance, **kwargs):

{openwisp_users-1.3.1 → openwisp_users-1.3.3}/openwisp_users/base/models.py

@@ -129,7 +129,7 @@ class AbstractUser(BaseUser):
         return str(pk)
 
     def set_password(self, *args, **kwargs):
-        self.password_updated = timezone.now().date()
+        self.password_updated = localdate()
         return super().set_password(*args, **kwargs)
 
     def has_password_expired(self):
@@ -145,7 +145,7 @@ class AbstractUser(BaseUser):
             )
         else:
             return False
-        return expiry_date < timezone.now().date()
+        return expiry_date < localdate()
 
     def is_member(self, organization):
         return self._get_pk(organization) in self.organizations_dict
@@ -160,10 +160,10 @@ class AbstractUser(BaseUser):
 
     @cached_property
     def is_owner_of_any_organization(self):
-        for value in self.organizations_dict.values():
-            if value["is_owner"]:
-                return True
-        return False
+        OrganizationOwner = load_model("openwisp_users", "OrganizationOwner")
+        # Query ownership directly because organizations_dict excludes inactive
+        # organizations, which can still have owners.
+        return OrganizationOwner.objects.filter(organization_user__user=self).exists()
 
     @property
     def organizations_dict(self):

{openwisp_users-1.3.1 → openwisp_users-1.3.3}/openwisp_users/password_validation.py

@@ -1,3 +1,4 @@
+from django.contrib.auth.hashers import check_password
 from django.core.exceptions import ValidationError
 from django.utils.translation import gettext_lazy as _
 
@@ -11,7 +12,7 @@ class PasswordReuseValidator:
     def validate(self, password, user=None):
         if user is None:
             return
-        if user.check_password(password):
+        if check_password(password, user.password):
             # The new password is same as the current password
             raise ValidationError(
                 _("You cannot re-use your current password. Enter a new password.")

{openwisp_users-1.3.1 → openwisp_users-1.3.3}/openwisp_users/tasks.py

@@ -6,7 +6,7 @@ from django.db.models import Q
 from django.template.loader import render_to_string
 from django.urls import reverse
 from django.utils import translation
-from django.utils.timezone import now, timedelta
+from django.utils.timezone import localdate, timedelta
 from django.utils.translation import gettext_lazy as _
 from swapper import load_model
 
@@ -30,7 +30,7 @@ def password_expiration_email():
     ):
         # The password expiration feature is not enabled
         return
-    expiry_date = now().date() + timedelta(days=7)
+    expiry_date = localdate() + timedelta(days=7)
     query = Q()
     if app_settings.USER_PASSWORD_EXPIRATION:
         query |= Q(
@@ -54,6 +54,9 @@ def password_expiration_email():
             emailaddress__verified=True,
         )
         .filter(query)
+        # a user can own more than one verified email address:
+        # without distinct() the join would send one email per address
+        .distinct()
     )
     email_count = 0
     for user in qs.iterator():