Merge lp:~matiasb/canonical-identity-provider/working-on-1192555 into lp:canonical-identity-provider/release

[Matias Bordese]

Fixed reset password view to handle email in a case insensitive way.

Fixed reset password view to handle email in a case insensitive way.

Reset password tokens generated through the API v1.0 allow the creation of tokens with email with different cases (this does not affect API v2 because since ALLOW_UNVERIFIED is enabled for everyone, the preferred email is selected over the email in the token).

This also arises the question: should we normalize email addresses before saving to db (and before searching on db)? Right now emails are stored as passed by the user.

[Ricardo Kirkner (ricardokirkner)]

LGTM

review: Approve

[Ricardo Kirkner (ricardokirkner)]

> This also arises the question: should we normalize email addresses before saving to db (and before searching > on db)? Right now emails are stored as passed by the user.

I think we should store the emails as provided by the users (because according to the RFC the username part of the email can be case sensitive), but search for them in a case insensitive way.because people actually treat them as case insensitive.

=== modified file 'src/webui/tests/test_views_ui.py'
--- src/webui/tests/test_views_ui.py	2013-07-08 18:35:43 +0000
+++ src/webui/tests/test_views_ui.py	2013-07-23 20:54:23 +0000
@@ -630,7 +630,7 @@
             self.account.displayname)
 
 
-class ForgotPasswordTestCase(UIViewsBaseTestCase):
+class ForgotPasswordTestCase(LogHandlerTestCase, UIViewsBaseTestCase):
 
     def test_forgot_password_includes_rp_analytics(self):
         rpconfig = OpenIDRPConfig.objects.create(
@@ -706,6 +706,52 @@
         r = self.client.post(self._token_url(), data)
         self.assertRedirects(r, reverse('account-index'))
 
+    def test_reset_password_email_is_case_insensitive(self):
+        r = self.client.post(reverse('forgot_password'), {'email': self.email})
+
+        # update requester email in token
+        auth_token = AuthToken.objects.get(
+            email=self.email, token_type=TokenType.PASSWORDRECOVERY)
+        auth_token.requester_email = self.email.upper()
+        assert self.email.upper() != self.email
+        auth_token.save()
+
+        # make sure the account is active
+        self.account.status = AccountStatus.ACTIVE
+        self.account.save()
+
+        # confirm account
+        data = {'password': 'Password1', 'passwordconfirm': 'Password1'}
+        r = self.client.post(self._token_url(), data)
+        self.assertRedirects(r, reverse('account-index'))
+
+    def test_reset_password_email_not_found(self):
+        r = self.client.post(reverse('forgot_password'), {'email': self.email})
+
+        # update requester email in token
+        auth_token = AuthToken.objects.get(
+            email=self.email, token_type=TokenType.PASSWORDRECOVERY)
+        auth_token.requester_email = '[e-mail]'
+        auth_token.save()
+
+        # make sure the account is active
+        self.account.status = AccountStatus.ACTIVE
+        self.account.save()
+
+        # confirm account
+        data = {'password': 'Password1', 'passwordconfirm': 'Password1'}
+
+        mock_is_enabled = Mock(return_value=True)
+        with patch.object(self.root_logger, 'isEnabledFor', mock_is_enabled):
+            with patch('webui.views.ui.logger', self.root_logger):
+                r = self.client.post(self._token_url(), data)
+
+        self.assertRedirects(r, reverse('bad_token'))
+        self.assertLogLevelContains(
+            'WARNING', "Could not reset password, invalid email address "
+            "provided in the token: %s (account %s)" % (
+                auth_token.requester_email, self.account.id))
+
     def test_reset_password_with_lowered_password_requirements(self):
         r = self.client.post(reverse('forgot_password'), {'email': self.email})
 

=== modified file 'src/webui/views/ui.py'
--- src/webui/views/ui.py	2013-07-08 18:35:43 +0000
+++ src/webui/views/ui.py	2013-07-23 20:54:23 +0000
@@ -829,10 +829,17 @@
         form = ResetPasswordForm(request.POST)
         if form.is_valid():
             password = form.cleaned_data['password']
+            try:
+                email_obj = EmailAddress.objects.get(
+                    account=account, email__iexact=atrequest.requester_email)
+            except EmailAddress.DoesNotExist:
+                logger.warning(
+                    'Could not reset password, invalid email address provided '
+                    'in the token: %s (account %s)',
+                    atrequest.requester_email, account.id)
+                return HttpResponseRedirect('/+bad-token')
             # since the user must have received this token url via this email,
             # we know it's valid.
-            email_obj = EmailAddress.objects.get(
-                account=account, email=atrequest.requester_email)
             email_obj.validate()
             if not account.is_active and account.can_reactivate:
                 account.preferredemail = email_obj