fix: Set role and confirm password while adding user mandatory

flask_appbuilder/security/views.py

@@ -310,7 +310,8 @@ class UserDBModelView(UserModelView):
             lazy_gettext("Confirm Password"),
             description=lazy_gettext("Please rewrite the user's password to confirm"),
             validators=[
-                EqualTo("password", message=lazy_gettext("Passwords must match"))
+                validators.DataRequired(),
+                EqualTo("password", message=lazy_gettext("Passwords must match")),
             ],
             widget=BS3PasswordFieldWidget(),
         ),
@@ -327,6 +328,8 @@ class UserDBModelView(UserModelView):
         "conf_password",
     ]
 
+    validators_columns = {"roles": [validators.DataRequired()]}
+
     @expose("/show/<pk>", methods=["GET"])
     @has_access
     def show(self, pk: Any) -> WerkzeugResponse:

flask_appbuilder/tests/security/test_mvc_security.py

@@ -217,3 +217,52 @@ def test_sec_reset_password_custom_complexity(self):
             follow_redirects=True,
         )
         self.browser_logout(client)
+
+    def test_register_user(self):
+        """
+        Test register user
+        """
+        client = self.app.test_client()
+        _ = self.browser_login(client, USERNAME_ADMIN, PASSWORD_ADMIN)
+
+        # use all required params
+        rv = client.get("/users/add", follow_redirects=True)
+        data = rv.data.decode("utf-8")
+        self.assertIn("Add User", data)
+        rv = client.post(
+            "/users/add",
+            data=dict(
+                first_name="first",
+                last_name="last",
+                username="from test 1-1",
+                email="test1@fromtest1.com",
+                roles=[1],
+                password="password",
+                conf_password="password",
+            ),
+            follow_redirects=True,
+        )
+        data = rv.data.decode("utf-8")
+        self.assertIn("Added Row", data)
+
+        # don't set roles
+        rv = client.get("/users/add", follow_redirects=True)
+        data = rv.data.decode("utf-8")
+        self.assertIn("Add User", data)
+        rv = client.post(
+            "/users/add",
+            data=dict(
+                first_name="first",
+                last_name="last",
+                username="from test 2-1",
+                email="test2@fromtest2.com",
+                roles=[],
+                password="password",
+                conf_password="password",
+            ),
+            follow_redirects=True,
+        )
+        data = rv.data.decode("utf-8")
+        self.assertNotIn("Added Row", data)
+        self.assertIn("This field is required", data)
+        self.browser_logout(client)