Merge lp:~james-w/canonical-identity-provider/email-timeout into lp:canonical-identity-provider/release

[James Westby]

Don't allow adding an email that is already registered with a different case.

When registering you can't use a different-case version of someone else's
email. However, you could add one after you registered if the other person
hadn't validated yet.

Hi,

I was looking at:
https://oops.canonical.com/oops/?oopsid=OOPS-c756fbc2750a2f29751f2a2626caeeef

There's a slow query because it's doing a case-sensitive search when looking
for addresses to invalidate. I fixed it to do case-insensitive search to use
the index.

I was worried that this would mean you could invlidate someone else's email
address, but the check for > 1 email should avoid that, because it would
find both case versions if you were able to add one. However, I still did
some tests to try and add an email that is a different-case version of
someone else's. You can't do it at registration, but you could do it
by adding a new email to an existing account if the other person hadn't
validated the email yet. I fixed that at the same time for extra security.

Thanks,

James

[Matias Bordese (matiasb)]

Looks good.

review: Approve

=== modified file 'src/identityprovider/forms.py'
--- src/identityprovider/forms.py	2013-08-22 16:21:57 +0000
+++ src/identityprovider/forms.py	2013-08-26 15:13:38 +0000
@@ -289,6 +289,10 @@
                 raise forms.ValidationError(_(
                     "Please verify your email."
                 ))
+            else:
+                raise forms.ValidationError(_(
+                    "Email already registered."
+                ))
         except EmailAddress.DoesNotExist:
             return data
         return data

=== modified file 'src/identityprovider/tests/test_forms.py'
--- src/identityprovider/tests/test_forms.py	2013-07-31 13:50:43 +0000
+++ src/identityprovider/tests/test_forms.py	2013-08-26 15:13:38 +0000
@@ -533,6 +533,16 @@
     def get_form(self, **kwargs):
         return NewEmailForm(**kwargs)
 
+    def test_existing_email_different_case(self):
+        account = self.factory.make_account()
+        email = '[e-mail]'
+        self.factory.make_email_for_account(account, email,
+                                            status=EmailStatus.NEW)
+        form = NewEmailForm(dict(newemail=email.upper()))
+        self.assertFalse(form.is_valid())
+        self.assertEqual(['Email already registered.'],
+                         form.errors['newemail'])
+
 
 class UserAttribsRequestFormTest(SSOBaseTestCase):
 

=== modified file 'src/webui/tests/test_views_account.py'
--- src/webui/tests/test_views_account.py	2013-08-22 16:21:57 +0000
+++ src/webui/tests/test_views_account.py	2013-08-26 15:13:38 +0000
@@ -864,6 +864,17 @@
         expected_logging = [mock.call.info(log_msg, self.email)]
         self.assert_happy_path(response, expected_logging)
 
+    def test_nonexisting_email_different_case(self):
+        EmailAddress.objects.all().delete()
+        assert EmailAddress.objects.count() == 0
+        self.factory.make_email_for_account(self.account,
+                                            email=self.email.upper())
+
+        response = self.client.post(self.url)
+        log_msg = 'Setting email %r status to invalidated.'
+        expected_logging = [mock.call.info(log_msg, self.email)]
+        self.assert_happy_path(response, expected_logging)
+
     def test_shows_confirmation(self):
         response = self.client.get(self.url)
         # response is a confirmation page

=== modified file 'src/webui/views/account.py'
--- src/webui/views/account.py	2013-08-22 16:21:57 +0000
+++ src/webui/views/account.py	2013-08-26 15:13:38 +0000
@@ -315,7 +315,7 @@
 
     # email may not exist since the user may have tried an operation with
     # an email unknown to our system
-    emails = EmailAddress.objects.filter(email=email_address)
+    emails = EmailAddress.objects.filter(email__iexact=email_address)
     if emails.count() == 0:
         # This case matches, for example, registration web where the Account
         # is not created until the user validates the email address.