According to Django docs:

It is strongly recommended that you explicitly set all fields that should be edited in the form using the fields attribute.

I have a custom user model, so I overrode UserCreationForm and UserChangeForm, but I'm not sure about the fields attribute of the Meta class. The admin site will be editing all fields of a user; so in UserChangeForm, do I have to include all fields in this attribute? like this:

class Meta:
    model = User
    fields = (
        "email",
        "password",
        "is_active",
        "is_staff",
        "is_superuser",
        "date_joined",
        "last_login",
        "groups",
        "user_permissions",
        # maybe there are others that I'm missing?
    )

Or in this case, it's safe to use the '__all__' shortcut?

The admin site uses UserChangeForm for editing user attributes (including permissions and so); so these need to be included in the fields attribute. But does this mean using the UserChangeForm anywhere other than the admin site, causes those security issues mentioned in the docs?