user.password store hash value instead of plaintext

account/models.py

@@ -1,39 +1,32 @@
-from datetime import datetime, time
+from datetime import datetime
 from django.core.mail import send_mail
 from django.db import models
 from django.utils.translation import gettext_lazy as _
 from django.utils.http import base36_to_int, int_to_base36
 from django.conf import settings
-from django.utils.crypto import constant_time_compare, salted_hmac
+from django.utils.crypto import salted_hmac
+
+from .utils import encode_password
 from .validators import ASCIIUsernameValidator
 
 
 class User(models.Model):
     username = models.CharField(
-        _('username'),
         max_length=25,
         unique=True,
-        help_text=_('Required. 25 characters or fewer. Letters, digits and _ only.'),
-        validators=[ASCIIUsernameValidator()],
-        error_messages={
-            'unique': _("A _user with that username already exists."),
-        },
+        validators=[ASCIIUsernameValidator()]
     )
     password = models.CharField(_('password'), max_length=128)
     last_login = models.DateTimeField(_('last login'), blank=True, null=True)
     email = models.EmailField(_('email address'), unique=True)
 
-    class Meta:
-        db_table = '_user'
-        verbose_name = verbose_name_plural = '用户信息表'
+    def save(self, *args, **kwargs):
+        self.password = encode_password(self.password)
+        super(User, self).save(*args, **kwargs)
 
     def get_root_folder(self):
         return self.folders.get(father_folder=None, group=None)
 
-    def set_password(self, password):
-        # TODO: 密码强度检验，密码hash存储
-        self.password = password
-
     def send_email(self, subject, message, from_email=None, **kwargs):
         send_mail(subject, message, from_email, [self.email], **kwargs)