ftddlmZddlmZddlmZddlmZddlmZddl m Z m Z ea Gdd eZ y ) )local)get_user_model) ModelBackend) app_settings)AuthenticationMethod)filter_users_by_emailfilter_users_by_usernamecDeZdZdZdZdZdZedZedZ y)AuthenticationBackendc *d}tjtjk(r|jdi|}|Stjtj k(r(|jdi|}|s|j di|}|S|j di|}|S)N)rAUTHENTICATION_METHODrEMAIL_authenticate_by_emailUSERNAME_EMAIL_authenticate_by_username)selfrequest credentialsrets X/var/www/cs2snipe.com/venv/lib/python3.12/site-packages/allauth/account/auth_backends.py authenticatez"AuthenticationBackend.authenticates  - -1E1K1K K-$--< ttdd}|t_|S)aNow, be aware, the following is quite ugly, let me explain: Even if the user credentials match, the authentication can fail because Django's default ModelBackend calls user_can_authenticate(), which checks `is_active`. Now, earlier versions of allauth did not do this and simply returned the user as authenticated, even in case of `is_active=False`. For allauth scope, this does not pose a problem, as these users are properly redirected to an account inactive page. This does pose a problem when the allauth backend is used in a different context where allauth is not responsible for the login. Then, by not checking on `user_can_authenticate()` users will allow to become authenticated whereas according to Django logic this should not be allowed. In order to preserve the allauth behavior while respecting Django's logic, we stash a user for which the password check succeeded but `user_can_authenticate()` failed. In the allauth authentication logic, we can then unstash this user and proceed pointing the user to the account inactive page. r%N)getattr_stashr%)clsr%rs rr-z!AuthenticationBackend._stash_userEs0ffd+  rc$|jdSr*)r-)r1s runstash_authenticated_userz0AuthenticationBackend.unstash_authenticated_userast$$rN) __name__ __module__ __qualname__rrrr classmethodr-r3rrrr r s> * 6%%rr N) threadingrdjango.contrib.authrdjango.contrib.auth.backendsrrrutilsr r r0r rrrr=s..5.B U%LU%r