45 lines
1.2 KiB
Python
45 lines
1.2 KiB
Python
from flask import session
|
|
|
|
from max.db import get_user_by_email
|
|
from max.translations import t
|
|
|
|
from .hashing import BLF_CRYPT_PREFIX, check_password
|
|
from .passwords import rehash_password_if_needed
|
|
|
|
# Hash of a random, unknown password. It is checked for unknown users, so the
|
|
# response time does not tell whether an email exists.
|
|
DUMMY_HASH = (
|
|
BLF_CRYPT_PREFIX + "$2b$12$J27D9dEpQ5ff/I48HG05p.97oJGTO7UiaKGIbVuzV6nw0lo6gZ5wq"
|
|
)
|
|
|
|
LOGIN_FAILED_MESSAGE = "Email or password is wrong, or the account is deactivated"
|
|
|
|
|
|
def login(email, password):
|
|
if not isinstance(email, str) or not isinstance(password, str):
|
|
return t(LOGIN_FAILED_MESSAGE)
|
|
if not email or not password:
|
|
return t(LOGIN_FAILED_MESSAGE)
|
|
|
|
user = get_user_by_email(email)
|
|
if user is None:
|
|
check_password(password, DUMMY_HASH)
|
|
return t(LOGIN_FAILED_MESSAGE)
|
|
|
|
if not check_password(password, user.passwordhash):
|
|
return t(LOGIN_FAILED_MESSAGE)
|
|
|
|
if not user.enabled:
|
|
return t(LOGIN_FAILED_MESSAGE)
|
|
|
|
rehash_password_if_needed(user, password)
|
|
|
|
# Start a new session (new id, new CSRF token) against session fixation.
|
|
session.clear()
|
|
session["user_id"] = user.id
|
|
return None
|
|
|
|
|
|
def logout():
|
|
session.clear()
|