Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
raise HTTPError(404)
if not self.application.config['REGISTRATION_ENABLED']:
raise HTTPError(403)
try:
login = self.get_body_argument('login')
password1 = self.get_body_argument('password1')
password2 = self.get_body_argument('password2')
login = validate.user_login(login)
validate.user_password(password1)
email = self.get_body_argument('email', '')
if email:
validate.user_email(email)
if password1 != password2:
raise validate.InvalidFormat(_f("Passwords do not match"))
if self.db.query(database.User).get(login) is not None:
raise validate.InvalidFormat(_f("User name is taken"))
if (email and
self.db.query(database.User)
.filter(database.User.email == email).count() > 0):
raise validate.InvalidFormat(_f("Email address is already "
"used"))
user = database.User(login=login)
user.set_password(password1)
if email:
user.email = email
self.db.add(user)
self.db.commit()
logger.info("User registered: %r", login)
self.set_secure_cookie('user', login)
return self.redirect(self.reverse_url('index'))
except validate.InvalidFormat as e:
logger.info("Error validating Register: %r", e)
if not self.application.config['MULTIUSER']:
raise HTTPError(404)
reset_token = self.get_body_argument('reset_token')
try:
user = self.decode_reset_token(reset_token)
except HTTPError as e:
self.set_status(403)
return self.finish(
self.gettext(e.log_message),
)
try:
password1 = self.get_body_argument('password1')
password2 = self.get_body_argument('password2')
validate.user_password(password1)
if password1 != password2:
raise validate.InvalidFormat(_f("Passwords do not match"))
logger.info("Password reset: changing password for %r", user.login)
user.set_password(password1)
self.db.commit()
return self.redirect(self.reverse_url('index'))
except validate.InvalidFormat as e:
logger.info("Error validating SetNewPassword: %r", e)
return self.render('new_password.html', reset_token=reset_token,
error=self.gettext(e.message))
# Should update via the cascade:
# op.execute('UPDATE project_members SET user_login = lower(user_login);')
# op.execute('UPDATE commands SET user_login = lower(user_login);')
# Check that logins pass new validation requirements
bind = op.get_bind()
session = Session(bind=bind)
logins = session.execute('''\
SELECT login FROM users;
''')
error = False
for row in logins:
login, = row
try:
changed = validate.user_login(login)
except validate.InvalidFormat:
error = True
print("User login %r does not abide to new restrictions" % login,
file=sys.stderr)
else:
if changed != login:
raise ValueError("Login %r is still not canonical after "
"migration, please report this bug!" % login)
if error:
raise ValueError("Some user logins do not pass validation")
session.close()
def post(self):
if not self.application.config['MULTIUSER']:
raise HTTPError(404)
login = self.get_json()['login']
try:
login = validate.user_login(login)
except validate.InvalidFormat:
pass
else:
user = self.db.query(database.User).get(login)
if user is not None:
return self.send_json({'exists': True})
return self.send_json({'exists': False})
def user_login(login):
if not login:
raise InvalidFormat(_f("User login cannot be empty"))
if len(login) > 20:
raise InvalidFormat(_f("User login is too long"))
login = login.lower()
if any(c not in ALLOWED_LOGIN_CHARACTERS
for c in login):
raise InvalidFormat(_f("User login contains forbidden characters"))
return login
def project_name(name):
if not name:
raise InvalidFormat(_f("Project name cannot be empty"))
if len(name) > 50:
raise InvalidFormat(_f("Project name is too long"))
def tag_path(path):
if not path:
raise InvalidFormat(_f("Tag path cannot be empty"))
if len(path) > 200:
raise InvalidFormat(_f("Tag path is too long"))
def document_name(name):
if not name:
raise InvalidFormat(_f("Document name cannot be empty"))
if len(name) > 50:
raise InvalidFormat(_f("Document name is too long"))
def tag_description(description):
if len(description) > 102400:
raise InvalidFormat(_f("Tag description is too long"))
def user_email(email):
if not email:
raise InvalidFormat(_f("Email cannot be empty")) # but it can be NULL
if '@' not in email:
raise InvalidFormat(_f("Invalid email address"))