From b86506eb0e99b3dbc93bb585d6cb434251511702 Mon Sep 17 00:00:00 2001 From: Finn Stutzenstein Date: Thu, 22 Oct 2026 18:03:07 +0000 Subject: [PATCH] Make the login case-insensitive and keep non-admins off the user list The login compared the email case-sensitively, although emails are stored lowercased, so "Fritz@finn.st" could not log in. After changing the password without ?return=detail, non-admins were redirected to the user list, which is a 404 for them; they now go back to their detail page. Co-Authored-By: Claude Opus 5.5 --- max/db/users.py | 2 +- max/routes/base_user_views.py | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/max/db/users.py b/max/db/users.py index 9620345..6eaa082 100644 --- a/max/db/users.py +++ b/max/db/users.py @@ -29,7 +29,7 @@ base_user_query = ( @with_cursor def get_user_by_email(cur, email): - return get_user(cur, f"{base_user_query} WHERE e.email=%s", email) + return get_user(cur, f"{base_user_query} WHERE e.email=lower(%s)", email) @with_cursor diff --git a/max/routes/base_user_views.py b/max/routes/base_user_views.py index 04b8879..6b3bd27 100644 --- a/max/routes/base_user_views.py +++ b/max/routes/base_user_views.py @@ -24,7 +24,8 @@ class FetchUserTemplateGetView(FetchUserMixin, BaseTemplateGetView): class BackToUsersMixin(ReturnToMixin): def get_back_text_and_url(self): - if self.get_return_to() == RETURN_DETAIL: + # Non-admins cannot access the user list + if self.get_return_to() == RETURN_DETAIL or not self.auth_user.is_admin: return self.user.email, url_for("user-detail", user_id=self.user.id) else: return t("User list"), url_for("user-list")