From 669441e8ec328ef793697c4c83af31db8d52a192 Mon Sep 17 00:00:00 2001
From: Alon Levy <alon@pobox.com>
Date: Tue, 10 Feb 2015 08:41:20 +0200
Subject: server: check for stale cookies on login

---
 src/server/rz_api.py     |  3 ++-
 src/server/rz_user_db.py | 11 +++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)

(limited to 'src/server')

diff --git a/src/server/rz_api.py b/src/server/rz_api.py
index eb1a21d1..a3385e56 100644
--- a/src/server/rz_api.py
+++ b/src/server/rz_api.py
@@ -128,7 +128,8 @@ def diff_commit__set():
 def index():
     email_address = session.get('username')
     rz_username = "Anonymous Stranger"
-    if None != email_address:
+    # check for stale cookies
+    if None != email_address and current_app.user_db.has_email(email_address):
         uid, u_account = current_app.user_db.lookup_user__by_email_address(email_address)
         rz_username = escape(u_account.rz_username)
     server_name = current_app.rz_config.SERVER_NAME
diff --git a/src/server/rz_user_db.py b/src/server/rz_user_db.py
index 149e1e00..c36a64ac 100644
--- a/src/server/rz_user_db.py
+++ b/src/server/rz_user_db.py
@@ -107,6 +107,17 @@ class User_DB(object):
         uid, u = self.__lookup_user__by_email_address(email_address)
         return self.__process_return_value(uid, u)
 
+    def has_email(self, email_address):
+        """
+        Does not throw exceptions, returns True if email is in the database,
+        False otherwise
+        """
+        # FIXME: avoid linear search
+        for uid, u in self.persistent_data_store.items():
+            if u.email_address == email_address:
+                return True
+        return False
+
     def user_add(self, u_account):
         """
         @return: the string uid of the newly added user
-- 
cgit v1.3.1