opensource/galaxy
3
0
Fork 0
mirror of https://github.com/galaxyproject/galaxy.git synced 2026-10-24 02:04:04 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix login to accounts using different email capitalization

Browse Source 
https://github.com/galaxyproject/galaxy/pull/8631 added case-insensitive
matches to user emails. If two accounts with different email
capitalizations exist one of them will be picked at random for login.
To fix this we first check for exact match and only if there is no
direct match we lowercase the comparison.
This commit is contained in:
mvdbeek
2020-02-25 12:02:59 +01:00
parent 41876b03c1
commit c86c75cc2b
2 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/galaxy/managers/users.py
+3 -1
View File
@@ -489,7 +489,9 @@ class UserManager(base.ModelManager, deletable.PurgableManagerMixin):
return "Failed to produce password reset token. User not found."
def get_reset_token(self, trans, email):
reset_user = trans.sa_session.query(self.app.model.User).filter(func.lower(self.app.model.User.table.c.email) == email.lower()).first()
reset_user = trans.sa_session.query(self.app.model.User).filter(self.app.model.User.table.c.email == email.lower()).first()
if not reset_user and email != email.lower():
reset_user = trans.sa_session.query(self.app.model.User).filter(func.lower(self.app.model.User.table.c.email) == email.lower()).first()
if reset_user:
prt = self.app.model.PasswordResetToken(reset_user)
trans.sa_session.add(prt)
lib/galaxy/webapps/galaxy/controllers/user.py
+6 -1
View File
@@ -135,9 +135,14 @@ class User(BaseUIController, UsesFormDefinitionsMixin, CreatesApiKeysMixin):
if not login or not password:
return self.message_exception(trans, "Please specify a username and password.")
user = trans.sa_session.query(trans.app.model.User).filter(or_(
func.lower(trans.app.model.User.table.c.email) == login.lower(),
trans.app.model.User.table.c.email == login,
trans.app.model.User.table.c.username == login
)).first()
if not user and login.lower() != login:
user = trans.sa_session.query(trans.app.model.User).filter(or_(
func.lower(trans.app.model.User.table.c.email) == login.lower(),
trans.app.model.User.table.c.username == login
)).first()
log.debug("trans.app.config.auth_config_file: %s" % trans.app.config.auth_config_file)
if user is None:
message, user = self.__autoregistration(trans, login, password)