From f1d65e2bd6af595013163079af3695d6d5ce39a5 Mon Sep 17 00:00:00 2001
From: Tom Irgang <thomas@irgang.eu>
Date: Tue, 25 Apr 2023 21:04:13 +0200
Subject: [PATCH] fix one time login

---
 rc_hip/repapp/tests.py |  5 ++++-
 rc_hip/repapp/views.py | 14 +++++++-------
 2 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/rc_hip/repapp/tests.py b/rc_hip/repapp/tests.py
index e8d8dd7..167e173 100644
--- a/rc_hip/repapp/tests.py
+++ b/rc_hip/repapp/tests.py
@@ -1,7 +1,9 @@
 """
 Tests for RepApp.
 """
+from hashlib import sha256
 from datetime import datetime, timedelta
+
 import django.utils.timezone
 
 from django.test import TestCase
@@ -24,8 +26,9 @@ class OneTimeLoginTest(TestCase):
         user.save()
         self.user = user
 
+        secret_hash = sha256("LetMeIn".encode('utf-8')).hexdigest()
         otl = OneTimeLogin(
-            secret="LetMeIn",
+            secret=secret_hash,
             user=user,
             url="/test/url",
         )
diff --git a/rc_hip/repapp/views.py b/rc_hip/repapp/views.py
index 4bc85f4..0aab730 100644
--- a/rc_hip/repapp/views.py
+++ b/rc_hip/repapp/views.py
@@ -152,9 +152,9 @@ def create_one_time_login(user, url) -> str:
         f'{user.email}{url}{datetime.datetime.now()}{random.randint(0,9999999)}'.encode(
             'utf-8')
     ).hexdigest()
-    hash = sha256(secret.encode('utf-8')).hexdigest()
+    secret_hash = sha256(secret.encode('utf-8')).hexdigest()
     otl = OneTimeLogin(
-        secret=hash,
+        secret=secret_hash,
         user=user,
         url=url,
     )
@@ -412,21 +412,21 @@ def one_time_login(request, secret: str):
     # waste a little time as brute force protection
     time.sleep(1)
 
-    hash = sha256(secret.encode('utf-8')).hexdigest()
-    otl = get_object_or_404(OneTimeLogin, secret=hash)
+    secret_hash = sha256(secret.encode('utf-8')).hexdigest()
+    otl = get_object_or_404(OneTimeLogin, secret=secret_hash)
 
     if otl.login_used:
         messages.add_message(request, messages.ERROR,
                              'Der Einmal-Login wurde schon verwendet und ist nichtmehr gültig.')
-        secret = create_one_time_login(otl.user, otl.url)
-        send_one_time_login_mail(secret, otl.user.email, request)
+        new_secret = create_one_time_login(otl.user, otl.url)
+        send_one_time_login_mail(new_secret, otl.user.email, request)
         return HttpResponseRedirect(reverse_lazy('index'))
     else:
         otl.login_used = True
         otl.login_date = now()
         otl.save()
 
-    user = authenticate(request, username=secret, password=None)
+    user = authenticate(request, username=secret_hash, password=None)
 
     if user is not None:
         login(request, user)