Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
login = self.get_body_argument('login')
password1 = self.get_body_argument('password1')
password2 = self.get_body_argument('password2')
login = validate.user_login(login)
validate.user_password(password1)
email = self.get_body_argument('email', '')
if email:
validate.user_email(email)
if password1 != password2:
raise validate.InvalidFormat(_f("Passwords do not match"))
if self.db.query(database.User).get(login) is not None:
raise validate.InvalidFormat(_f("User name is taken"))
if (email and
self.db.query(database.User)
.filter(database.User.email == email).count() > 0):
raise validate.InvalidFormat(_f("Email address is already "
"used"))
user = database.User(login=login)
user.set_password(password1)
if email:
user.email = email
self.db.add(user)
self.db.commit()
logger.info("User registered: %r", login)
self.set_secure_cookie('user', login)
return self.redirect(self.reverse_url('index'))
except validate.InvalidFormat as e:
logger.info("Error validating Register: %r", e)
return self.render('login.html', register=True,
register_error=self.gettext(e.message))
def decode_reset_token(self, reset_token):
reset_token_clear = self.get_secure_cookie(
'reset_token',
reset_token,
min_version=2,
max_age_days=1,
)
if reset_token_clear is None:
raise HTTPError(403, _f("Invalid token"))
ts, login, email = reset_token_clear.decode('utf-8').split('|', 2)
user = self.db.query(database.User).get(login)
if not user or user.email != email:
raise HTTPError(403, _f("No user associated with that token"))
if user.password_set_date >= datetime.utcfromtimestamp(int(ts)):
# Password has been changed after the reset token was created
raise HTTPError(403, _f("Password has already been changed"))
return user
def decode_reset_token(self, reset_token):
reset_token_clear = self.get_secure_cookie(
'reset_token',
reset_token,
min_version=2,
max_age_days=1,
)
if reset_token_clear is None:
raise HTTPError(403, _f("Invalid token"))
ts, login, email = reset_token_clear.decode('utf-8').split('|', 2)
user = self.db.query(database.User).get(login)
if not user or user.email != email:
raise HTTPError(403, _f("No user associated with that token"))
if user.password_set_date >= datetime.utcfromtimestamp(int(ts)):
# Password has been changed after the reset token was created
raise HTTPError(403, _f("Password has already been changed"))
return user
def tag_path(path):
if not path:
raise InvalidFormat(_f("Tag path cannot be empty"))
if len(path) > 200:
raise InvalidFormat(_f("Tag path is too long"))
def project_description(description):
if len(description) > 102400:
raise InvalidFormat(_f("Project description is too long"))
def document_description(description):
if len(description) > 102400:
raise InvalidFormat(_f("Document description is too long"))
def user_login(login):
if not login:
raise InvalidFormat(_f("User login cannot be empty"))
if len(login) > 20:
raise InvalidFormat(_f("User login is too long"))
login = login.lower()
if any(c not in ALLOWED_LOGIN_CHARACTERS
for c in login):
raise InvalidFormat(_f("User login contains forbidden characters"))
return login