mirror of
https://github.com/zulip/zulip.git
synced 2025-10-23 04:52:12 +00:00
0c227217b2
create_preregistration_user is a footgun, because it takes the realm from the request. The calling code is supposed to validate that registration for the realm is allowed first, but can sometimes do that on "realm" taken from something else than the request - and later on calls create_preregistration_user, thus leading to prereg user creation on unvalidated request.realm. It's safer, and makes more sense, for this function to take the intended realm as argument, instead of taking the entire request. It follows that the same should be done for prepare_activation_url.
68 lines
2.5 KiB
Python
68 lines
2.5 KiB
Python
from typing import Any
|
|
|
|
from django.conf import settings
|
|
from django.http import HttpRequest, HttpResponse
|
|
from django.views.decorators.csrf import csrf_exempt
|
|
|
|
from confirmation.models import Confirmation, create_confirmation_link
|
|
from zerver.context_processors import get_realm_from_request
|
|
from zerver.lib.response import json_success
|
|
from zerver.lib.subdomains import get_subdomain
|
|
from zerver.models import UserProfile
|
|
from zerver.views.auth import create_preregistration_user
|
|
from zerver.views.registration import accounts_register
|
|
|
|
|
|
# This is used only by the Puppeteer test in 01-realm-creation.js.
|
|
def confirmation_key(request: HttpRequest) -> HttpResponse:
|
|
return json_success(request.session.get("confirmation_key"))
|
|
|
|
|
|
def modify_postdata(request: HttpRequest, **kwargs: Any) -> None:
|
|
request.POST._mutable = True
|
|
for key, value in kwargs.items():
|
|
request.POST[key] = value
|
|
request.POST._mutable = False
|
|
|
|
|
|
@csrf_exempt
|
|
def register_development_user(request: HttpRequest) -> HttpResponse:
|
|
if get_subdomain(request) == "":
|
|
request.META["HTTP_HOST"] = settings.REALM_HOSTS["zulip"]
|
|
count = UserProfile.objects.count()
|
|
name = f"user-{count}"
|
|
email = f"{name}@zulip.com"
|
|
realm = get_realm_from_request(request)
|
|
prereg = create_preregistration_user(
|
|
email, realm, realm_creation=False, password_required=False
|
|
)
|
|
activation_url = create_confirmation_link(prereg, Confirmation.USER_REGISTRATION)
|
|
key = activation_url.split("/")[-1]
|
|
# Need to add test data to POST request as it doesn't originally contain the required parameters
|
|
modify_postdata(request, key=key, full_name=name, password="test", terms="true")
|
|
|
|
return accounts_register(request)
|
|
|
|
|
|
@csrf_exempt
|
|
def register_development_realm(request: HttpRequest) -> HttpResponse:
|
|
count = UserProfile.objects.count()
|
|
name = f"user-{count}"
|
|
email = f"{name}@zulip.com"
|
|
realm_name = f"realm-{count}"
|
|
prereg = create_preregistration_user(email, None, realm_creation=True, password_required=False)
|
|
activation_url = create_confirmation_link(prereg, Confirmation.REALM_CREATION)
|
|
key = activation_url.split("/")[-1]
|
|
# Need to add test data to POST request as it doesn't originally contain the required parameters
|
|
modify_postdata(
|
|
request,
|
|
key=key,
|
|
realm_name=realm_name,
|
|
full_name=name,
|
|
password="test",
|
|
realm_subdomain=realm_name,
|
|
terms="true",
|
|
)
|
|
|
|
return accounts_register(request)
|