RepairCafeHilpoltstein/RepApp
Archived
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #23 from makes-hacks-hip/refactor_doc_test

Browse source 
fix one time login
This commit is contained in:
Thomas Irgang 2023-04-25 21:04:47 +02:00 committed by GitHub
commit 4dbeecadea
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 11 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
rc_hip/repapp/tests.py
View file

@ -1,7 +1,9 @@
""" """
Tests for RepApp. Tests for RepApp.
""" """
from hashlib import sha256
from datetime import datetime, timedelta from datetime import datetime, timedelta
import django.utils.timezone import django.utils.timezone
from django.test import TestCase from django.test import TestCase
@ -24,8 +26,9 @@ class OneTimeLoginTest(TestCase):
user.save() user.save()
self.user = user self.user = user
secret_hash = sha256("LetMeIn".encode('utf-8')).hexdigest()
otl = OneTimeLogin( otl = OneTimeLogin(
secret="LetMeIn", secret=secret_hash,
user=user, user=user,
url="/test/url", url="/test/url",
) )

14
rc_hip/repapp/views.py
View file

@ -152,9 +152,9 @@ def create_one_time_login(user, url) -> str:
f'{user.email}{url}{datetime.datetime.now()}{random.randint(0,9999999)}'.encode( f'{user.email}{url}{datetime.datetime.now()}{random.randint(0,9999999)}'.encode(
'utf-8') 'utf-8')
).hexdigest() ).hexdigest()
hash = sha256(secret.encode('utf-8')).hexdigest() secret_hash = sha256(secret.encode('utf-8')).hexdigest()
otl = OneTimeLogin( otl = OneTimeLogin(
secret=hash, secret=secret_hash,
user=user, user=user,
url=url, url=url,
) )
@ -412,21 +412,21 @@ def one_time_login(request, secret: str):
# waste a little time as brute force protection # waste a little time as brute force protection
time.sleep(1) time.sleep(1)
hash = sha256(secret.encode('utf-8')).hexdigest() secret_hash = sha256(secret.encode('utf-8')).hexdigest()
otl = get_object_or_404(OneTimeLogin, secret=hash) otl = get_object_or_404(OneTimeLogin, secret=secret_hash)
if otl.login_used: if otl.login_used:
messages.add_message(request, messages.ERROR, messages.add_message(request, messages.ERROR,
'Der Einmal-Login wurde schon verwendet und ist nichtmehr gültig.') 'Der Einmal-Login wurde schon verwendet und ist nichtmehr gültig.')
secret = create_one_time_login(otl.user, otl.url) new_secret = create_one_time_login(otl.user, otl.url)
send_one_time_login_mail(secret, otl.user.email, request) send_one_time_login_mail(new_secret, otl.user.email, request)
return HttpResponseRedirect(reverse_lazy('index')) return HttpResponseRedirect(reverse_lazy('index'))
else: else:
otl.login_used = True otl.login_used = True
otl.login_date = now() otl.login_date = now()
otl.save() otl.save()
user = authenticate(request, username=secret, password=None) user = authenticate(request, username=secret_hash, password=None)
if user is not None: if user is not None:
login(request, user) login(request, user)