CSRF protection. #361

[zzz-spline-users.git] / splinext / users / controllers / accounts.py

diff --git a/splinext/users/controllers/accounts.py b/splinext/users/controllers/accounts.py
index a4c1b71..55b6319 100644 (file)
--- a/splinext/users/controllers/accounts.py
+++ b/splinext/users/controllers/accounts.py
@@ -1,12 +1,13 @@
 import logging
-from openid.consumer.consumer import Consumer
+from openid.consumer.consumer import Consumer, SUCCESS, CANCEL
 from openid.extensions.sreg import SRegRequest, SRegResponse
 from openid.store.filestore import FileOpenIDStore
 from openid.yadis.discover import DiscoveryFailure
 from sqlalchemy.orm.exc import NoResultFound
 
 from pylons import config, request, response, session, tmpl_context as c, url
-from pylons.controllers.util import abort, redirect_to
+from pylons.controllers.util import abort, redirect
+from pylons.decorators.secure import authenticate_form
 from routes import request_config
 
 from spline.model import meta
@@ -59,7 +60,7 @@ class AccountsController(BaseController):
         return_url = url(host=host, controller='accounts', action='login_finish')
         new_url = auth_request.redirectURL(return_to=return_url,
                                            realm=protocol + '://' + host)
-        redirect_to(new_url)
+        redirect(new_url)
 
     def login_finish(self):
         """Step two of logging in; the OpenID provider redirects back here."""
@@ -69,7 +70,11 @@ class AccountsController(BaseController):
         return_url = url(host=host, controller='accounts', action='login_finish')
         res = cons.complete(request.params, return_url)
 
-        if res.status != 'success':
+        if res.status == CANCEL:
+            # I guess..  just..  back to the homepage?
+            h.flash(u"""Login canceled.""", icon='user-silhouette')
+            redirect(url('/'))
+        elif res.status != SUCCESS:
             return 'Error!  %s' % res.message
 
         try:
@@ -102,8 +107,9 @@ class AccountsController(BaseController):
         h.flash(u"""Hello, {0}!""".format(user.name),
                 icon='user')
 
-        redirect_to('/', _code=303)
+        redirect(url('/'), code=303)
 
+    @authenticate_form
     def logout(self):
         """Logs the user out."""
 
@@ -114,4 +120,4 @@ class AccountsController(BaseController):
             h.flash(u"""Logged out.""",
                     icon='user-silhouette')
 
-        redirect_to('/', _code=303)
+        redirect(url('/'), code=303)