forks/microblog.pub
1
0
Fork 1
mirror of https://git.sr.ht/~tsileo/microblog.pub synced 2024-11-15 03:04:28 +00:00
Code Issues Projects Releases Packages Wiki Activity

Fix login

Browse source
This commit is contained in:
Thomas Sileo 2019-04-08 18:01:02 +02:00
parent 049607e701
commit 0e2ecab78f
1 changed files with 11 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
app.py
View file

@ -597,8 +597,18 @@ def admin_login():
u2f_enabled = True if devices else False u2f_enabled = True if devices else False
if request.method == "POST": if request.method == "POST":
csrf.protect() csrf.protect()
# 1. Check regular password login flow
pwd = request.form.get("pass") pwd = request.form.get("pass")
if devices: if pwd:
if verify_pass(pwd):
session["logged_in"] = True
return redirect(
request.args.get("redirect") or url_for("admin_notifications")
)
else:
abort(403)
# 2. Check for U2F payload, if any
elif devices:
resp = json.loads(request.form.get("resp")) resp = json.loads(request.form.get("resp"))
try: try:
u2f.complete_authentication(session["challenge"], resp) u2f.complete_authentication(session["challenge"], resp)
@ -613,13 +623,6 @@ def admin_login():
return redirect( return redirect(
request.args.get("redirect") or url_for("admin_notifications") request.args.get("redirect") or url_for("admin_notifications")
) )
elif pwd and verify_pass(pwd):
session["logged_in"] = True
return redirect(
request.args.get("redirect") or url_for("admin_notifications")
)
elif pwd:
abort(403)
else: else:
abort(401) abort(401)