Always register password mgmt views, update views to conditionally 404

wagtail/wagtailadmin/urls/password_reset.py

@@ -1,12 +1,12 @@
 from django.conf.urls import url
-from django.contrib.auth import views as django_auth_views
 
 from wagtail.wagtailadmin.forms import PasswordResetForm
+from wagtail.wagtailadmin.views import account
 
 
 urlpatterns = [
     url(
-        r'^$', django_auth_views.password_reset, {
+        r'^$', account.password_reset, {
             'template_name': 'wagtailadmin/account/password_reset/form.html',
             'email_template_name': 'wagtailadmin/account/password_reset/email.txt',
             'subject_template_name': 'wagtailadmin/account/password_reset/email_subject.txt',
@@ -15,19 +15,19 @@ urlpatterns = [
         }, name='wagtailadmin_password_reset'
     ),
     url(
-        r'^done/$', django_auth_views.password_reset_done, {
+        r'^done/$', account.password_reset_done, {
             'template_name': 'wagtailadmin/account/password_reset/done.html'
         }, name='wagtailadmin_password_reset_done'
     ),
     url(
         r'^confirm/(?P<uidb64>[0-9A-Za-z_\-]+)/(?P<token>[0-9A-Za-z]{1,13}-[0-9A-Za-z]{1,20})/$',
-        django_auth_views.password_reset_confirm, {
+        account.password_reset_confirm, {
             'template_name': 'wagtailadmin/account/password_reset/confirm.html',
             'post_reset_redirect': 'wagtailadmin_password_reset_complete',
         }, name='wagtailadmin_password_reset_confirm',
     ),
     url(
-        r'^complete/$', django_auth_views.password_reset_complete, {
+        r'^complete/$', account.password_reset_complete, {
             'template_name': 'wagtailadmin/account/password_reset/complete.html'
         }, name='wagtailadmin_password_reset_complete'
     ),

wagtail/wagtailadmin/views/account.py

@@ -1,9 +1,11 @@
+from functools import wraps
+
 from django.conf import settings
 from django.shortcuts import render, redirect
 from django.contrib import messages
 from django.contrib.auth.forms import SetPasswordForm
-from django.contrib.auth.views import logout as auth_logout, login as auth_login
-from django.contrib.auth import update_session_auth_hash
+from django.contrib.auth import update_session_auth_hash, views as auth_views
+from django.http import Http404
 from django.utils.translation import ugettext as _
 from django.views.decorators.debug import sensitive_post_parameters
 from django.views.decorators.cache import never_cache
@@ -25,6 +27,9 @@ def account(request):
 
 
 def change_password(request):
+    if not getattr(settings, 'WAGTAIL_PASSWORD_MANAGEMENT_ENABLED', True):
+        raise Http404
+
     can_change_password = request.user.has_usable_password()
 
     if can_change_password:
@@ -48,8 +53,21 @@ def change_password(request):
     })
 
 
-def notification_preferences(request):
+def _wrap_password_reset_view(view_func):
+    @wraps(view_func)
+    def wrapper(*args, **kwargs):
+        if not getattr(settings, 'WAGTAIL_PASSWORD_RESET_ENABLED', True):
+            raise Http404
+        return view_func(*args, **kwargs)
+    return wrapper
 
+password_reset = _wrap_password_reset_view(auth_views.password_reset)
+password_reset_done = _wrap_password_reset_view(auth_views.password_reset_done)
+password_reset_confirm = _wrap_password_reset_view(auth_views.password_reset_confirm)
+password_reset_complete = _wrap_password_reset_view(auth_views.password_reset_complete)
+
+
+def notification_preferences(request):
     if request.POST:
         form = NotificationPreferencesForm(request.POST, instance=UserProfile.get_for_user(request.user))
 
@@ -77,7 +95,7 @@ def login(request):
         return redirect('wagtailadmin_home')
     else:
         from django.contrib.auth import get_user_model
-        return auth_login(request,
+        return auth_views.login(request,
             template_name='wagtailadmin/login.html',
             authentication_form=forms.LoginForm,
             extra_context={
@@ -88,7 +106,7 @@ def login(request):
 
 
 def logout(request):
-    response = auth_logout(request, next_page='wagtailadmin_login')
+    response = auth_views.logout(request, next_page='wagtailadmin_login')
 
     # By default, logging out will generate a fresh sessionid cookie. We want to use the
     # absence of sessionid as an indication that front-end pages are being viewed by a