Skip to content
Snippets Groups Projects
Verified Commit 936562db authored by f00wl's avatar f00wl
Browse files

User not in session, abort instead of if statement

parent a4c9ce9b
No related branches found
No related tags found
No related merge requests found
...@@ -30,10 +30,8 @@ def signin(): ...@@ -30,10 +30,8 @@ def signin():
@blueprint.route("/totp/verify", methods=["GET", "POST"]) @blueprint.route("/totp/verify", methods=["GET", "POST"])
def totp_verify(): def totp_verify():
form = forms.TotpForm() form = forms.TotpForm()
if "username" in session: username = session.get("username") or flask.abort(403)
user = models.User.query.filter_by(username=session["username"]).first() or flask.abort(403) user = models.User.query.filter_by(username=username).first() or flask.abort(403)
else:
return flask.redirect(flask.url_for(".signin"))
if form.validate_on_submit(): if form.validate_on_submit():
if user.auths[models.Auth.TOTP].check_totp(form.totp.data): if user.auths[models.Auth.TOTP].check_totp(form.totp.data):
flask_login.login_user(user) flask_login.login_user(user)
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment