0004-views-warn-user-before-generating-new-token-41792.patch

Valentin Deniaud, 29 avril 2020 14:14

Voir les différences: en ligne côte à côte

Subject: [PATCH 4/4] views: warn user before generating new token (#41792)

 src/authentic2/app_settings.py   |  3 +++
 src/authentic2/utils/__init__.py |  4 ++--
 src/authentic2/views.py          | 39 +++++++++++++++++++++++++++++---
 tests/settings.py                |  2 ++
 tests/test_attribute_kinds.py    |  3 ++-
 tests/test_views.py              | 21 +++++++++++++++++
 6 files changed, 66 insertions(+), 6 deletions(-)

         A2_EMAILS_ADDRESS_RATELIMIT=Setting(
             default='3/d',
             definition='Maximum rate of emails sent to the same email address.'),
         A2_TOKEN_EXISTS_WARNING=Setting(
             default=True,
             definition='If an active token exists, warn user before generating a new one.')
+    )
     app_settings = AppSettings(default_settings)

             user.save()
         lifetime = settings.PASSWORD_RESET_TIMEOUT_DAYS * 3600 * 24
         # invalidate any token associated with this user
         Token.objects.filter(kind='pw-reset', content__user=user.pk).delete()
         token = Token.create('pw-reset', {'user': user.pk}, duration=lifetime)
         Token.objects.filter(kind='pw-reset', content__user=user.pk, content__email=user.email).delete()
         token = Token.create('pw-reset', {'user': user.pk, 'email': user.email}, duration=lifetime)
         reset_url = make_url(
             'password_reset_confirm',
             kwargs={'token': token.uuid_b64url},

     from django.core import signing
     from django.core.exceptions import ValidationError
     from django.contrib import messages
     from django.utils import six
     from django.utils import six, timezone
     from django.utils.translation import ugettext as _
     from django.urls import reverse
     from django.contrib.auth import logout as auth_logout
-...
             return ctx
         def form_valid(self, form):
             email = form.cleaned_data['email']
             # if an email has already been sent, warn once before allowing resend
             token = models.Token.objects.filter(
                 kind='pw-reset', content__email=email, expires__gt=timezone.now()
             ).exists()
             resend_key = 'pw-reset-allow-resend'
             if app_settings.A2_TOKEN_EXISTS_WARNING and token and not self.request.session.get(resend_key):
                 self.request.session[resend_key] = True
                 form.add_error(
                     'email',
                     _('An email has already been sent to %s. Click "Validate" again if '
                       'you really want it to be sent again.') % email
+                )
                 return self.form_invalid(form)
             self.request.session[resend_key] = False
             if is_ratelimited(self.request, key='post:email', group='pw-reset-email',
                               rate=app_settings.A2_EMAILS_ADDRESS_RATELIMIT, increment=True):
                 form.add_error(
-...
                 return self.form_invalid(form)
             form.save()
             self.request.session['reset_email'] = form.cleaned_data['email']
             self.request.session['reset_email'] = email
             return super(PasswordResetView, self).form_valid(form)
     password_reset = PasswordResetView.as_view()
-...
             return super(BaseRegistrationView, self).dispatch(request, *args, **kwargs)
         def form_valid(self, form):
             email = form.cleaned_data.pop('email')
             # if an email has already been sent, warn once before allowing resend
             token = models.Token.objects.filter(
                 kind='registration', content__email=email, expires__gt=timezone.now()
             ).exists()
             resend_key = 'registration-allow-resend'
             if app_settings.A2_TOKEN_EXISTS_WARNING and token and not self.request.session.get(resend_key):
                 self.request.session[resend_key] = True
                 form.add_error(
                     'email',
                     _('An email has already been sent to %s. Click "Validate" again if '
                       'you really want it to be sent again.') % email
+                )
                 return self.form_invalid(form)
             self.request.session[resend_key] = False
             if is_ratelimited(self.request, key='post:email', group='registration-email',
                               rate=app_settings.A2_EMAILS_ADDRESS_RATELIMIT, increment=True):
                 form.add_error(
-...
+                )
                 return self.form_invalid(form)
             email = form.cleaned_data.pop('email')
             for field in form.cleaned_data:
                 self.token[field] = form.cleaned_data[field]

tests/settings.py
48	48	TEMPLATES[0]['DIRS'].append('tests/templates')
49	49
50	50	SITE_BASE_URL = 'http://localhost'
	51
	52	A2_TOKEN_EXISTS_WARNING = False

         qs.delete()
     def test_phone_number(db, app, admin, mailoutbox):
     def test_phone_number(db, app, admin, mailoutbox, settings):
         settings.A2_EMAILS_ADDRESS_RATELIMIT = None
         def register_john():
             response = app.get('/accounts/register/')

         response.form.set('email', simple_user.email)
         response = response.form.submit()
         assert len(mailoutbox) == 12
     @pytest.mark.parametrize('view_name', ['registration_register', 'password_reset'])
     def test_views_email_token_resend(app, simple_user, settings, mailoutbox, view_name):
         settings.A2_TOKEN_EXISTS_WARNING = True
         response = app.get(reverse(view_name))
         response.form.set('email', simple_user.email)
         response = response.form.submit()
         assert len(mailoutbox) == 1
         # warn user token has already been sent
         response = app.get(reverse(view_name))
         response.form.set('email', simple_user.email)
         response = response.form.submit()
         assert 'email has already been sent' in response.text
         assert len(mailoutbox) == 1
         # validating again anyway works
         response = response.form.submit()
         assert len(mailoutbox) == 2
+    -

Projet

Général

Profil

Produits Entr'ouvert » Authentic 2

0004-views-warn-user-before-generating-new-token-41792.patch