Merge lp:~roadmr/canonical-identity-provider/better-evil-token-instructions into lp:canonical-identity-provider/release

[Daniel Manrique]

Show friendly help if we can't find the openid session token from a validation link

The most common reason for that is initiating a login on a third-party site,
creating the account in sso as part of the flow, then clicking on the
activation link on another device or browser.

SO instead of sending people to a terse 404 page which causes them to fume and
come file bugs which end up as dupes of https://pad.lv/1693375, the new (still
a 404-code) page explains what to do and provides a link where they can
validate their e-mail address out of the third-party login flow (which is the
workaround we recommend anyway, after painful back and forth checking the
format of the link they clicked on and referring to the cited bug)

I'm fed up with all the dupes of https://bugs.launchpad.net/canonical-identity-provider/+bug/1693375.

The rendered page looks like https://people.canonical.com/~roadmr/404-no-token.png.

[Maximiliano Bertacchini (maxiberta)]

LGTM, with a couple of nitpicks. Thanks!

review: Approve

[Maximiliano Bertacchini (maxiberta)]

review: Approve

=== added file 'src/webui/templates/404-no-token.html'
--- src/webui/templates/404-no-token.html	1970-01-01 00:00:00 +0000
+++ src/webui/templates/404-no-token.html	2019-05-10 19:55:53 +0000
@@ -0,0 +1,27 @@
+{% extends "base.html" %}
+{% load i18n %}
+
+{% comment %}
+Copyright 2019 Canonical Ltd.  This software is licensed under the
+GNU Affero General Public License version 3 (see the file  LICENSE).
+{% endcomment %}
+
+{% block title %}
+    {% trans "Not found" %}
+{% endblock %}
+
+{% block text_title %}
+    <h1 class="main">Invalid address validation link</h1>
+{% endblock %}
+
+{% block content %}
+        <div>
+          <p>{% blocktrans %}You clicked on an e-mail address validation link from Ubuntu One SSO; however, the information from the link seems to be invalid or stale.{% endblocktrans %}</p>
+          <p>{% blocktrans %}This could be for one of the following reasons:{% endblocktrans %}</p>
+          <ol class="u1-list">
+              <li>{% blocktrans %}The link has already been used. You don't need to validate your address again. {% endblocktrans %}</li>
+              <li>{% blocktrans %}You created your Ubuntu One SSO account while starting a session on another site. You must click the validation link on the same browser where you started your session on the other site.{% endblocktrans %}</li>
+          </ol>
+          <p>{% blocktrans %}You can also go to <a href="{{email_url}}">Your account's e-mail page</a> and click on "Verify" next to the e-mail address you want to verify. This is the best solution if you are unable to click the link on the same browser where you started your session on the other site.{% endblocktrans %}</p>
+        </div>
+{% endblock %}

=== modified file 'src/webui/tests/test_views_ui.py'
--- src/webui/tests/test_views_ui.py	2018-10-16 21:41:53 +0000
+++ src/webui/tests/test_views_ui.py	2019-05-10 19:55:53 +0000
@@ -1190,7 +1190,9 @@
 
         response = self.client.post(the_url,
                                     None, follow=False)
-        self.assertEqual(response.status_code, 404)
+        self.assertContains(
+            response, reverse('account-emails'), status_code=404)
+        self.assertTemplateUsed(response, '404-no-token.html')
         # Ensure the address was NOT validated since we bailed
         # on suspicious/incomplete info.
         email.refresh_from_db()

=== modified file 'src/webui/views/ui.py'
--- src/webui/views/ui.py	2018-10-16 19:32:57 +0000
+++ src/webui/views/ui.py	2019-05-10 19:55:53 +0000
@@ -526,7 +526,17 @@
         except BadSignedValue:
             logger.exception(
                 "OpenID Request token %s given but no orequest found", token)
-            return HttpResponseNotFound()
+            # Show a 404 page with some instructions on what to do.  This most
+            # commonly happens due to LP #1693375, and the instructions can
+            # help legitimate users while not leaking anything to evil users
+            # who may have stolen a validation link.
+            return HttpResponseNotFound(
+                render(
+                    request,
+                    '404-no-token.html',
+                    {'email_url': reverse('account-emails')}
+                )
+            )
 
     if request.method == 'POST':
         captcha_solution = request.POST.get('g-recaptcha-response')