From 6c406ae5cd841ab4d984c63e71847ec950bc75c8 Mon Sep 17 00:00:00 2001 From: Pea Tyczynska Date: Fri, 22 Feb 2019 16:13:46 +0000 Subject: [PATCH] Redirect from confirmation page if session empty --- app/main/views/manage_users.py | 9 ++++++++- tests/app/main/views/test_manage_users.py | 16 ++++++++++++++++ 2 files changed, 24 insertions(+), 1 deletion(-) diff --git a/app/main/views/manage_users.py b/app/main/views/manage_users.py index 35b6431a2..6033ec7c3 100644 --- a/app/main/views/manage_users.py +++ b/app/main/views/manage_users.py @@ -164,7 +164,14 @@ def edit_user_email(service_id, user_id): @user_has_permissions('manage_service') def confirm_edit_user_email(service_id, user_id): user = user_api_client.get_user(user_id) - new_email = session['team_member_email_change'] + if 'team_member_email_change' in session: + new_email = session['team_member_email_change'] + else: + return redirect(url_for( + '.edit_user_email', + service_id=service_id, + user_id=user_id + )) if request.method == 'POST': try: user_api_client.update_user_attribute(user_id, email_address=new_email) diff --git a/tests/app/main/views/test_manage_users.py b/tests/app/main/views/test_manage_users.py index 7bc21baaf..162f81b1f 100644 --- a/tests/app/main/views/test_manage_users.py +++ b/tests/app/main/views/test_manage_users.py @@ -840,6 +840,22 @@ def test_confirm_edit_user_email_page( assert response.status_code == 200 +def test_confirm_edit_user_email_page_redirects_if_session_empty( + logged_in_client, + active_user_with_permissions, + service_one, + mocker, + mock_get_user, +): + response = logged_in_client.get(url_for( + 'main.confirm_edit_user_email', + service_id=service_one['id'], + user_id=active_user_with_permissions.id + )) + assert response.status_code == 302 + assert 'Confirm change of email address' not in response.get_data(as_text=True) + + def test_confirm_edit_user_email_changes_user_email( logged_in_client, active_user_with_permissions,