Fix #883: Prevent usage of too weak passwords

api/funkwhale_api/users/serializers.py

@@ -5,7 +5,7 @@ from django.utils.deconstruct import deconstructible
 from django.utils.translation import gettext_lazy as _
 
 from rest_auth.serializers import PasswordResetSerializer as PRS
-from rest_auth.registration.serializers import RegisterSerializer as RS
+from rest_auth.registration.serializers import RegisterSerializer as RS, get_adapter
 from rest_framework import serializers
 from versatileimagefield.serializers import VersatileImageFieldSerializer
 
@@ -42,6 +42,15 @@ class RegisterSerializer(RS):
         except models.Invitation.DoesNotExist:
             raise serializers.ValidationError("Invalid invitation code")
 
+    def validate(self, validated_data):
+        data = super().validate(validated_data)
+        # we create a fake user obj with validated data so we can validate
+        # password properly (we have a password validator that requires
+        # a user object)
+        user = models.User(username=data["username"], email=data["email"])
+        get_adapter().clean_password(data["password1"], user)
+        return data
+
     def save(self, request):
         user = super().save(request)
         if self.validated_data.get("invitation"):