darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-08-16 20:49:00 -04:00
Code Issues Packages Projects Releases Wiki Activity

Stop automatically resending email verification links

Browse Source 
This commit stops a new email verification link from being sent to a
user if they click on an email link which has expired or which has
already been used. Instead, they will be see an error message with a
link to the sign in page. This stops the situation where someone could
log in indefinitely (without the needing to enter their password) by
trying to use a used / expired email verification link and receiving a
valid link automatically.
This commit is contained in:
Katie Smith
2019-01-15 16:32:26 +00:00
parent 55a41f9239
commit 9095893e03
4 changed files with 30 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
tests/app/main/views/test_two_factor.py
View File

@@ -235,11 +235,8 @@ def test_two_factor_email_link_has_expired(
assert response.status_code == 200
page = BeautifulSoup(response.data.decode('utf-8'), 'html.parser')
assert normalize_spaces(
page.select_one('.banner-dangerous').text
) == "The link in the email we sent you has expired. We’ve sent you a new one."
assert page.h1.text.strip() == 'Email resent'
mock_send_verify_code.assert_called_once_with(fake_uuid, 'email', None)
assert page.h1.text.strip() == 'The link has expired'
mock_send_verify_code.assert_not_called
def test_two_factor_email_link_is_invalid(
@@ -272,11 +269,11 @@ def test_two_factor_email_link_is_already_used(
)
page = BeautifulSoup(response.data.decode('utf-8'), 'html.parser')
assert normalize_spaces(
page.select_one('.banner-dangerous').text
) == "This link has already been used"
assert response.status_code == 200
assert page.h1.text.strip() == 'The link has expired'
mock_send_verify_code.assert_not_called
def test_two_factor_email_link_when_user_is_locked_out(
client,
@@ -292,11 +289,11 @@ def test_two_factor_email_link_when_user_is_locked_out(
)
page = BeautifulSoup(response.data.decode('utf-8'), 'html.parser')
assert normalize_spaces(
page.select_one('.banner-dangerous').text
) == "This link has already been used"
assert response.status_code == 200
assert page.h1.text.strip() == 'The link has expired'
mock_send_verify_code.assert_not_called
def test_two_factor_email_link_used_when_user_already_logged_in(
logged_in_client,