Bug in Django 1.6.6 password_reset when user never logged in

[gcivil]

I found what I think is a bug in Django 1.6.6
Test Case
1) Create new user
2) Do not login and try to reset password using password_reset

You will see the following error
AttributeError at /password_reset/

'NoneType' object has no attribute 'replace'

Request Method:     POST
Request URL:     http://localhost:8000/password_reset/
Django Version:     1.6.6
Exception Type:     AttributeError
Exception Value:    

'NoneType' object has no attribute 'replace'

Ultimately it comes to this in ..django/contrib/auth/tokens.py


        # Ensure results are consistent across DB backends
        login_timestamp = user.last_login.replace(microsecond=0, tzinfo=None)

This quite obviously fails if user.last_login is None.

Suggestions?

[Collin Anderson]

I followed your steps and can't reproduce your issue.

In django 1.6, last_login is null=False, so it should never be None. django 1.8 (master) changes the database to allow a null last_login, so if you've created the user using django1.8 and reset their password using django1.6 I could see that being an issue.