{"action":"created","issue":{"url":"https://api.github.com/repos/bennylope/django-organizations/issues/92","labels_url":"https://api.github.com/repos/bennylope/django-organizations/issues/92/labels{/name}","comments_url":"https://api.github.com/repos/bennylope/django-organizations/issues/92/comments","events_url":"https://api.github.com/repos/bennylope/django-organizations/issues/92/events","html_url":"https://github.com/bennylope/django-organizations/issues/92","id":129132696,"number":92,"title":"No password checking in 'UserRegistrationForm'","user":{"login":"pawelad","id":7062874,"avatar_url":"https://avatars.githubusercontent.com/u/7062874?v=3","gravatar_id":"","url":"https://api.github.com/users/pawelad","html_url":"https://github.com/pawelad","followers_url":"https://api.github.com/users/pawelad/followers","following_url":"https://api.github.com/users/pawelad/following{/other_user}","gists_url":"https://api.github.com/users/pawelad/gists{/gist_id}","starred_url":"https://api.github.com/users/pawelad/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pawelad/subscriptions","organizations_url":"https://api.github.com/users/pawelad/orgs","repos_url":"https://api.github.com/users/pawelad/repos","events_url":"https://api.github.com/users/pawelad/events{/privacy}","received_events_url":"https://api.github.com/users/pawelad/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-01-27T12:45:16Z","updated_at":"2016-01-27T14:52:28Z","closed_at":null,"body":"There's currently no password validation in `UserRegistrationForm` in `organizations.backends.forms` and you can go through the form with different strings in `password` and `password_confirm` fields.\r\n\r\nAnd why not just extend Django's own `UserCreationForm` from `django.contrib.auth.forms` in the first place, which does exactly that?"},"comment":{"url":"https://api.github.com/repos/bennylope/django-organizations/issues/comments/175665699","html_url":"https://github.com/bennylope/django-organizations/issues/92#issuecomment-175665699","issue_url":"https://api.github.com/repos/bennylope/django-organizations/issues/92","id":175665699,"user":{"login":"pawelad","id":7062874,"avatar_url":"https://avatars.githubusercontent.com/u/7062874?v=3","gravatar_id":"","url":"https://api.github.com/users/pawelad","html_url":"https://github.com/pawelad","followers_url":"https://api.github.com/users/pawelad/followers","following_url":"https://api.github.com/users/pawelad/following{/other_user}","gists_url":"https://api.github.com/users/pawelad/gists{/gist_id}","starred_url":"https://api.github.com/users/pawelad/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pawelad/subscriptions","organizations_url":"https://api.github.com/users/pawelad/orgs","repos_url":"https://api.github.com/users/pawelad/repos","events_url":"https://api.github.com/users/pawelad/events{/privacy}","received_events_url":"https://api.github.com/users/pawelad/received_events","type":"User","site_admin":false},"created_at":"2016-01-27T14:52:28Z","updated_at":"2016-01-27T14:52:28Z","body":"But your `UserRegistrationForm` is also `ModelForm`, same as Django's `UserCreationForm`. More then that, it even  has `auth.User` specific fields excluded - `exclude = ('is_staff', 'is_superuser', 'is_active', 'last_login', 'date_joined', 'groups', 'user_permissions')`, so I wouldn't call it `User` model agnostic.\r\nAnd I think that if someone has their own `User` model, they probably will have to create their own form anyway.\r\n\r\nWhy can't it just be:\r\n```python\r\nfrom django.contrib.auth import get_user_model\r\nfrom django.contrib.auth.forms import UserCreationForm\r\n\r\n\r\nclass UserRegistrationForm(UserCreationForm):\r\n    def __init__(self, *args, **kwargs):\r\n        super().__init__(*args, **kwargs)\r\n        self.initial['username'] = ''\r\n\r\n    class Meta:\r\n        model = get_user_model()\r\n        fields = ('username',)\r\n\r\n```"}}