[Management Commands] Add authenticated shell session
- Dominant language
- No language data
- Stars
- 188
- Forks
- 7
- PR merge metrics
- No merged PRs in 30d
Description
### Code of Conduct
- [x] I agree to follow Django's Code of Conduct
### Feature Description
1. Add a `manage.py login` command to set and reuse `_user` for the current session
2. Add a setting `SHELL_REQUIRES_AUTH` - Require a currently logged-in user to access the shell
3. Add a `requireAuth` check for management commands if you want to protect only a few commands
### Problem
Django Management commands are extremely useful tools; sometimes it's useful to run some one-off commands even in production. However, it is still arbitrary code executed during runtime.
Anyone with server access can run the commands. Having an authenticated shell and being able to limit the commands a user can run can allow for simpler federated perms within teams, and also in case a malicious actor gains access to the server (assuming they do not have write access)
### Request or proposal
request
### Additional Details
_No response_
### Implementation Suggestions
_No response_
Contributor guide
No contributing guide indexed for this repository
Research direction
No files, tests, or entry points are named in the proposal. Start by locating Django's management-command and shell entry points, then trace how the current user session is represented; done should cover the proposed login command, SHELL_REQUIRES_AUTH setting, and optional command-level authentication checks.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- django
- Domain
- authentication, cli, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100