- Added contributed French string translations.
- Dropped support for Django < 2.2.
- #49: Hide the navigation sidebar on the login page.
- Stricter authorization checks for qrcodes in the admin interface.
- #38: Update admin fields for :class:`~django_otp.plugins.otp_email.models.EmailDevice`.
:class:`~django_otp.models.SideChannelDevice` is a new abstract device class to simplify writing devices that deliver tokens to the user by other channels (email, SMS, etc.).
- #33, #34 (arjan-s): Implement :class:`~django_otp.models.SideChannelDevice`, reimplement :class:`~django_otp.plugins.otp_email.models.EmailDevice` on top of it, and add a few settings for customization.
- Add rate limiting to :class:`~django_otp.plugins.otp_email.models.EmailDevice` and :class:`~django_otp.plugins.otp_static.models.StaticDevice`.
- #26: Display OTP Token field on the login page even when user has not yet authenticated.
- #17: Drop Python 2 support.
- #18: Back to a single login template for now.
- #23: Allow :setting:`OTP_HOTP_ISSUER` and :setting:`OTP_TOTP_ISSUER` to be callable.
- #15: Add admin template for Django 3.0.
- #10: Remove old admin login templates that are confusing some unrelated tools.
- Built-in forms have autocomplete disabled for token widgets.
- Fixed miscellaneous typos.
- #2: Fix LoginView for already-authenticated users, with multiple auth backends configured.
Removed dependencies on Python 2 compatibility shims in Django < 3.0.
Removed obsolete compatibility shims. The testing and support matrix is unchanged from 0.6.0, so there should be no impact.
Built-in :ref:`HOTP <hotp-devices>` and :ref:`TOTP <totp-devices>` devices are now rate-limited, enforcing exponentially increasing delays between successive failures. See the device documentation for information on presenting more useful error messages when this happens, as well as for tuning (or disabling) this behavior.
Thanks to Luke Plant for the idea and implementation.
- Fix encoding of otpauth:// URL parameters.
- Error messages in :class:`~django_otp.forms.OTPAuthenticationForm` and :class:`~django_otp.forms.OTPTokenForm` can be customized.
- Remove dependencies on old non-class login views.
- Drop support for Django < 1.11.
- Fix return type of :meth:`~django_otp.plugins.otp_static.models.StaticToken.random_token`.
- Fix addstatictoken string handling under Python 3.
- Improved handling of device persistent identifiers.
- Make sure default keys are unicode values.
- Fix addstatictoken on Django 1.10+.
- Drop support for versions of Django that are past EOL.
- Update addstatictoken command for current Django versions.
- Allow verified users to be pickled.
- Minor fixes for Django 1.11 and 2.0.
- Generate HOTP and TOTP otpauth URLs and corresponding QR Codes. To enable this
feature, install
django-otp[qrcode]or just install the qrcode package. - Support for Python 2.6 and Django 1.4 were dropped in this version (long overdue).
- Treat :attr:`~django.contrib.auth.models.User.is_authenticated` and :attr:`~django.contrib.auth.models.User.is_anonymous` as properties in Django 1.10 and later.
- Add explict on_delete behavior for all foreign keys.
- Added a convenience API for verifying TOTP tokens: :meth:`django_otp.oath.TOTP.verify`.
- Don't break the laziness of
request.user. - Improved error message for invalid tokens.
- Support the new middleware API in Django 1.10.
- The default (random) key for a new TOTP device is now forced to a unicode string.
- All modules include all four Python 3 __future__ imports for consistency.
- Migrations no longer have byte strings in them.
- Fix the addstatictoken management command under Django 1.9.
- Stop importing models into the root of the package.
- Use ModelAdmin.raw_id_fields for foreign keys to users.
- General cleanup and compatibility with Django 1.9a1.
- Add support for the new app registry, when available.
- Add Django 1.8 to the test matrix and fix a few test bugs.
- All plugins now have both Django and South migrations. Please see the upgrade notes for details on upgrading from previous versions.
- Updated the otp_totp South migrations to support custom user models. Thanks to https://bitbucket.org/robirichter.
- Removed South-generated unicode string literals.
- Per the RFC, :class:`~django_otp.plugins.otp_totp.models.TOTPDevice` will no longer verify the same token twice.
- Cosmetic fixes to the admin login form on Django 1.6.
Warning
This includes a model change in TOTPDevice. If you are upgrading and your
project uses South, you should first convert it to South with manage
migrate otp_totp 0001 --fake. If you're not using South, you will need to
generate and run the appropriate SQL manually.
- OTPMiddleware no longer interferes with pickling request.user.
- Update Django requirement to 1.4.2, the first version with django.utils.six.
- Fix unicode representation of devices in some exotic scenarios.
- Now supports Django 1.4 to 1.6 on Python 2.6, 2.7, 3.2, and 3.3. This is the first release for Python 3.
- Add :func:`django_otp.user_has_device` to detect whether a user has any devices configured. This change supports a fix in django-otp-agents 0.1.4.
- Add if_configured argument to :func:`~django_otp.decorators.otp_required`.
- Major unit test cleanup. Tests should pass or be skipped under all supported versions of Django, with or without custom users and timzeone support.
- OTPAdminSite now selects an apporpriate login template automatically, based on the current Django version. Django versions 1.3 to 1.5 are currently supported.
- Unit test cleanup.
- Add support for custom user models in Django 1.5.
- Stop using
Device.objects: Django doesn't allow access to an abstract model's manager any more.
- Fix an exception when an empty login form is submitted.
Initial release.