darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-08-23 15:57:23 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3926 from alphagov/sign-in-bug

Browse Source 
ensure user details are always in the session after entering password
This commit is contained in:
Leo Hemsted
2021-07-06 11:56:24 +01:00
committed by GitHub
parent 960d2b8bf1 74b5d8f3cd
commit 416b5c3e26
3 changed files with 73 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
app/main/views/sign_in.py
View File

@@ -33,24 +33,31 @@ def sign_in():
form.email_address.data, form.password.data
)
if user and user.state == 'pending':
return redirect(url_for('main.resend_email_verification', next=redirect_url))
if user:
# add user to session to mark us as in the process of signing the user in
session['user_details'] = {"email": user.email_address, "id": user.id}
if user and session.get('invited_user_id'):
invited_user = InvitedUser.from_session()
if user.email_address.lower() != invited_user.email_address.lower():
flash("You cannot accept an invite for another person.")
session.pop('invited_user_id', None)
abort(403)
else:
invited_user.accept_invite()
if user and user.sign_in():
if user.sms_auth:
return redirect(url_for('.two_factor_sms', next=redirect_url))
if user.email_auth:
return redirect(url_for('.two_factor_email_sent', next=redirect_url))
if user.webauthn_auth:
return redirect(url_for('.two_factor_webauthn', next=redirect_url))
if user.state == 'pending':
return redirect(url_for('main.resend_email_verification', next=redirect_url))
if user.is_active:
if session.get('invited_user_id'):
invited_user = InvitedUser.from_session()
if user.email_address.lower() != invited_user.email_address.lower():
flash("You cannot accept an invite for another person.")
session.pop('invited_user_id', None)
abort(403)
else:
invited_user.accept_invite()
user.send_login_code()
if user.sms_auth:
return redirect(url_for('.two_factor_sms', next=redirect_url))
if user.email_auth:
return redirect(url_for('.two_factor_email_sent', next=redirect_url))
if user.webauthn_auth:
return redirect(url_for('.two_factor_webauthn', next=redirect_url))
# Vague error message for login in case of user not known, locked, inactive or password not verified
flash(Markup(

10
app/models/user.py
View File

@@ -142,20 +142,12 @@ class User(JSONModel, UserMixin):
login_user(self)
session['user_id'] = self.id
def sign_in(self):
session['user_details'] = {"email": self.email_address, "id": self.id}
if not self.is_active:
return False
def send_login_code(self):
if self.email_auth:
user_api_client.send_verify_code(self.id, 'email', None, request.args.get('next'))
if self.sms_auth:
user_api_client.send_verify_code(self.id, 'sms', self.mobile_number)
return True
def sign_out(self):
session.clear()
# Update the db so the server also knows the user is logged out.