Does not support users with non-trivial IPv6 address. about django-axes HOT 8 CLOSED

It is already using the GenericIPAddressField:
https://github.com/django-pci/django-axes/blob/master/axes/models.py#L9

from django-axes.

Looks like it got fixed in 81bebc4 which was done after the issue was opened.

First release with that fix was 1.3.7 released in early October. So I'm pretty sure we're good here.

@mythmon Want to verify that when you get a chance?

from django-axes.

This is still broken because is_valid_ip() will fail for ipv6 since it's just using socket.inet_aton. BTW using socket.inet_aton directly will also fail to detect bad IP addresses like "127.0"

I would suggest using the built-in django validators (assuming they exist in the versions of django you want to target). I have done this in my fork, so you could easily lift it from there:
aclysma@ae52351

As an aside, that commit also removes the IP sanitization. In my opinion it's much better to let people do that for themselves in middleware for reasons mentioned here: http://django-ratelimit.readthedocs.org/en/latest/security.html#security-chapter

from django-axes.

@aclysma Can you do a PR with those changes?

from django-axes.

Per your request, I sent a pull request, but it includes all my changes, several of which are very opinionated.. you probably don't want to take some of them. It may be easier/safer to just lift the ip address validation code manually.

from django-axes.

FYI the failed test test_log_data_truncated is failing because I removed storing GET/POST params (this is one of those opinionated changes that you likely don't want to take.)

from django-axes.

@aclysma Looks great. Can you please send the PR only with the ip validation changes?

from django-axes.

This should be fixed by now

from django-axes.