Undeclared dependency on requests

[rrlapointe]

• django-pwned-passwords version: 4.1.0
• Django version: 3.1.2
• Python version: 3.7.3
• Operating System: Debian GNU/Linux 10 (buster)

Description

My app uses django-pwned-passwords. After freshly deploying my app, I tried to create a superuser with python manage.py createsuperuser. I received the error message ModuleNotFoundError: No module named 'requests'.

What I Did

(env) root@thesis-server:/srv/thesis# python manage.py createsuperuser
Username (leave blank to use 'user'): root
Email address: 
Password: 
Password (again): 
Traceback (most recent call last):
  File "/srv/thesis/env/lib/python3.7/site-packages/django/contrib/auth/password_validation.py", line 26, in get_password_validators
    klass = import_string(validator['NAME'])
  File "/srv/thesis/env/lib/python3.7/site-packages/django/utils/module_loading.py", line 17, in import_string
    module = import_module(module_path)
  File "/usr/lib/python3.7/importlib/__init__.py", line 127, in import_module
    return _bootstrap._gcd_import(name[level:], package, level)
  File "<frozen importlib._bootstrap>", line 1006, in _gcd_import
  File "<frozen importlib._bootstrap>", line 983, in _find_and_load
  File "<frozen importlib._bootstrap>", line 967, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 677, in _load_unlocked
  File "<frozen importlib._bootstrap_external>", line 728, in exec_module
  File "<frozen importlib._bootstrap>", line 219, in _call_with_frames_removed
  File "/srv/thesis/env/lib/python3.7/site-packages/django_pwned_passwords/password_validation.py", line 6, in <module>
    import requests
ModuleNotFoundError: No module named 'requests'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "manage.py", line 15, in <module>
    execute_from_command_line(sys.argv)
  File "/srv/thesis/env/lib/python3.7/site-packages/django/core/management/__init__.py", line 401, in execute_from_command_line
    utility.execute()
  File "/srv/thesis/env/lib/python3.7/site-packages/django/core/management/__init__.py", line 395, in execute
    self.fetch_command(subcommand).run_from_argv(self.argv)
  File "/srv/thesis/env/lib/python3.7/site-packages/django/core/management/base.py", line 330, in run_from_argv
    self.execute(*args, **cmd_options)
  File "/srv/thesis/env/lib/python3.7/site-packages/django/contrib/auth/management/commands/createsuperuser.py", line 79, in execute
    return super().execute(*args, **options)
  File "/srv/thesis/env/lib/python3.7/site-packages/django/core/management/base.py", line 371, in execute
    output = self.handle(*args, **options)
  File "/srv/thesis/env/lib/python3.7/site-packages/django/contrib/auth/management/commands/createsuperuser.py", line 157, in handle
    validate_password(password2, self.UserModel(**fake_user_data))
  File "/srv/thesis/env/lib/python3.7/site-packages/django/contrib/auth/password_validation.py", line 44, in validate_password
    password_validators = get_default_password_validators()
  File "/srv/thesis/env/lib/python3.7/site-packages/django/contrib/auth/password_validation.py", line 19, in get_default_password_validators
    return get_password_validators(settings.AUTH_PASSWORD_VALIDATORS)
  File "/srv/thesis/env/lib/python3.7/site-packages/django/contrib/auth/password_validation.py", line 29, in get_password_validators
    raise ImproperlyConfigured(msg % validator['NAME'])
django.core.exceptions.ImproperlyConfigured: The module in NAME could not be imported: django_pwned_passwords.password_validation.PWNEDPasswordValidator. Check your AUTH_PASSWORD_VALIDATORS setting.

Cause

The cause of the problem is that django-pwned-passwords has an undeclared dependency on requests. Because django-pwned-passwords does not declare the dependency in setup.py, the needed requests package was not installed when I installed my app on the server.

I confirmed that the problem is fixed when I install requests.

(env) root@thesis-server:/srv/thesis# pip install requests
Collecting requests
  Downloading https://files.pythonhosted.org/packages/45/1e/0c169c6a5381e241ba7404532c16a21d86ab872c9bed8bdcd4c423954103/requests-2.24.0-py2.py3-none-any.whl (61kB)
    100% || 71kB 1.7MB/s 
Collecting certifi>=2017.4.17 (from requests)
  Downloading https://files.pythonhosted.org/packages/5e/c4/6c4fe722df5343c33226f0b4e0bb042e4dc13483228b4718baf286f86d87/certifi-2020.6.20-py2.py3-none-any.whl (156kB)
    100% || 163kB 2.7MB/s 
Collecting idna<3,>=2.5 (from requests)
  Downloading https://files.pythonhosted.org/packages/a2/38/928ddce2273eaa564f6f50de919327bf3a00f091b5baba8dfa9460f3a8a8/idna-2.10-py2.py3-none-any.whl (58kB)
    100% || 61kB 3.0MB/s 
Collecting chardet<4,>=3.0.2 (from requests)
  Downloading https://files.pythonhosted.org/packages/bc/a9/01ffebfb562e4274b6487b4bb1ddec7ca55ec7510b22e4c51f14098443b8/chardet-3.0.4-py2.py3-none-any.whl (133kB)
    100% || 143kB 3.9MB/s 
Collecting urllib3!=1.25.0,!=1.25.1,<1.26,>=1.21.1 (from requests)
  Downloading https://files.pythonhosted.org/packages/56/aa/4ef5aa67a9a62505db124a5cb5262332d1d4153462eb8fd89c9fa41e5d92/urllib3-1.25.11-py2.py3-none-any.whl (127kB)
    100% || 133kB 5.8MB/s 
Installing collected packages: certifi, idna, chardet, urllib3, requests
Successfully installed certifi-2020.6.20 chardet-3.0.4 idna-2.10 requests-2.24.0 urllib3-1.25.11
(env) root@thesis-server:/srv/thesis# python manage.py createsuperuser
Username (leave blank to use 'user'): root
Email address: 
Password: 
Password (again): 
Superuser created successfully.
(env) root@thesis-server:/srv/thesis#

More info

Here is an excerpt from my app's setup.py:

install_requires=[
	'Django',
	'django-environ',
	'djangorestframework',
	'django-crispy-forms',
	'django-sass-processor',
	'timeago',
	'django-pwned-passwords',
],

I should not need to add the dependencies of dependencies to my setup.py. Your package's dependencies should be in your setup.py.