Only allow non-active users to set password on activation path

opentech/apply/users/views.py

@@ -3,6 +3,7 @@ from django.contrib.auth import get_user_model, login, update_session_auth_hash
 from django.contrib.auth.decorators import login_required
 from django.contrib.auth.forms import AdminPasswordChangeForm
 from django.contrib.auth.tokens import PasswordResetTokenGenerator
+from django.core.exceptions import PermissionDenied
 from django.shortcuts import redirect, render
 from django.template.response import TemplateResponse
 from django.urls import reverse_lazy
@@ -89,6 +90,12 @@ class ActivationView(TemplateView):
 
 
 def create_password(request):
+    """
+    A custom view for the admin password change form used for account activation.
+    """
+    if request.user.is_active:
+        raise PermissionDenied
+
     if request.method == 'POST':
         form = AdminPasswordChangeForm(request.user, request.POST)
         if form.is_valid():