Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
async def redir() -> Response:
return redirect("/")
return _tf_illegal_state(form, _security.login_url)
pm = session["tf_primary_method"]
totp_secret = session["tf_totp_secret"]
form.user = current_user
form.primary_method = pm
form.tf_totp_secret = totp_secret
if form.validate_on_submit():
# Success - log in user and clear all session variables
completion_message = complete_two_factor_process(
form.user, pm, totp_secret, changing, session.pop("tf_remember_login", None)
)
after_this_request(_commit)
if not _security._want_json(request):
do_flash(*get_message(completion_message))
return redirect(get_post_login_redirect())
# GET or not successful POST
if _security._want_json(request):
return base_render_json(form)
# if we were trying to validate a new method
if changing:
setup_form = _security.two_factor_setup_form()
return _security.render_template(
config_value("TWO_FACTOR_SETUP_TEMPLATE"),
two_factor_setup_form=setup_form,
two_factor_verify_code_form=form,
choices=config_value("TWO_FACTOR_ENABLED_METHODS"),
**_ctx("tf_setup")
)
form = form_class(formdata=None, meta=suppress_form_csrf())
else:
form = form_class(meta=suppress_form_csrf())
form.submit.data = True
code_methods = _compute_code_methods()
if form.validate_on_submit():
# verified - so set freshness time.
session["fs_paa"] = time.time()
if _security._want_json(request):
return base_render_json(form, include_auth_token=True)
do_flash(*get_message("REAUTHENTICATION_SUCCESSFUL"))
return redirect(get_post_verify_redirect())
# Here on GET or failed POST validate
if _security._want_json(request):
payload = {
"available_methods": config_value("US_ENABLED_METHODS"),
"code_methods": code_methods,
}
return base_render_json(form, additional=payload)
# On error - wipe code
form.passcode.data = None
return _security.render_template(
config_value("US_VERIFY_TEMPLATE"),
us_verify_form=form,
code_methods=code_methods,
skip_login_menu=True,
after_this_request(_commit)
if user != current_user:
logout_user()
if config_value("AUTO_LOGIN_AFTER_CONFIRM"):
# N.B. this is a (small) security risk if email went to wrong place.
# and you have the LOGIN_WITH_CONFIRMATION flag since in that case
# you can be logged in and doing stuff - but another person could
# get the email.
if config_value("TWO_FACTOR") and config_value("TWO_FACTOR_REQUIRED"):
return tf_login(user, primary_authn_via="confirm")
login_user(user, authn_via=["confirm"])
m, c = get_message("EMAIL_CONFIRMED")
if _security.redirect_behavior == "spa":
return redirect(
get_url(
_security.post_confirm_view, qparams=user.get_redirect_qparams({c: m})
)
)
do_flash(m, c)
return redirect(
get_url(_security.post_confirm_view)
or get_url(
_security.post_login_view
if config_value("AUTO_LOGIN_AFTER_CONFIRM")
else _security.login_url
)
def reload():
return redirect(url_for('index'))
async def reset():
global steward, pool_handle
steward, pool_handle = await common_reset([steward], pool_handle)
return redirect(url_for('index'))
_datastore.us_set(current_user, method, state["totp_secret"], phone)
us_profile_changed.send(
app._get_current_object(), user=current_user, method=method
)
if _security._want_json(request):
return base_render_json(
form,
include_user=False,
additional=dict(
chosen_method=method, phone=current_user.us_phone_number
),
)
else:
do_flash(*get_message("US_SETUP_SUCCESSFUL"))
return redirect(
get_url(_security.us_post_setup_view)
or get_url(_security.post_login_view)
)
# Code not correct/outdated.
if _security._want_json(request):
return base_render_json(form, include_user=False)
m, c = get_message("INVALID_PASSWORD_CODE")
do_flash(m, c)
return redirect(url_for_security("us_setup"))
async def guild_page(guild_id):
oauth_token = session.get('oauth2_token')
if oauth_token is None:
return redirect(url_for("login"))
discord_session = oauth.make_session(token=oauth_token)
guilds = discord_session.get(webapp.API_BASE_URL + '/users/@me/guilds').json()
guild = list(filter(lambda a: a != -1, [x if guild_id == x['id'] else -1 for x in guilds]))
return jsonify(guild)
email=user.email,
within=_security.reset_password_within,
)
if _security.redirect_behavior == "spa":
return redirect(
get_url(
_security.reset_error_view,
qparams=user.get_redirect_qparams({c: m}),
)
)
do_flash(m, c)
return redirect(url_for_security("forgot_password"))
# All good - for SPA - redirect to the ``reset_view``
if _security.redirect_behavior == "spa":
return redirect(
get_url(
_security.reset_view,
qparams=user.get_redirect_qparams({"token": token}),
)
)
# for forms - render the reset password form
return _security.render_template(
config_value("RESET_PASSWORD_TEMPLATE"),
reset_password_form=form,
reset_password_token=token,
**_ctx("reset_password")
)
# This is the POST case.
m = None
if not user or invalid: