I have written a code for registration and login in django. While doing login, I am getting the error "Invalid salt"
Following is the code:
#api_view(['POST'])
def login(request):
email = request.data.get('email')
mobile_number = request.data.get('mobile_number')
pin = request.data.get('pin')
res = dict()
print(dict, "dictonaryyyyyy")
if email != None:
email_result = Users.objects.filter(email= email).first()
print(email_result.pin, "emaillll")
if email_result != None:
if bcrypt.checkpw(pin.encode("utf-8"), email_result.pin.encode('utf-8')):
# if bcrypt.checkpw(pin, )
print("........")
payload_data = dict()
payload_data['email'] = email_result.email
token = generate_token(payload_data)
print(token, "token.........")
res['messages'] = "Authentication Successful"
res['status'] = 200,
res['token'] = token
return Response(res, status = status.HTTP_200_OK)
...
...
How to get rid of this error?
It got solved, the hashed password was being saved as a binary instead of string at the time of registrattion.
To convert it into a string, the pin is required to be decoded at the time of creating the object.
pin = pin.decode('utf-8'),
Related
I am trying to follow along with a couple online tutorials for creating a reset password feature in my app. Both these tutorials use itsdangerous TimedJSONWebSignatureSerializer, which has since been deprecated, so I'm working with an older version of itsdangerous. Probably not best practice, I know.
The issue that I'm running into is that when I'm in the reset_token function and use verify_token(), its supposed to return the variable "email" to me, which I then save in "user". The reset_token function runs through the first time to bring up the html page and on this first run through, user = the email address, as it should. However, then when I hit "submit" on my reset password page, the code runs through a second time and then user = None, which therefore makes my query not work.
How do I make "email" not turn to None on the second run through of my code?
from flask import Flask, request, render_template, session, redirect, url_for
import mysql.connector
from flask_mail import Mail, Message
from itsdangerous import TimedJSONWebSignatureSerializer as Serializer
def get_token(user, expires_sec=600):
serial = Serializer(app.config['SECRET_KEY'], expires_in=expires_sec)
return serial.dumps({'user_id': user}).decode('utf-8')
def verify_token(token):
serial = Serializer(app.config['SECRET_KEY'])
try:
email = serial.loads(token)['user_id']
except:
return None
return email
def send_mail(email):
token = get_token(email)
msg = Message('Password Reset Request', recipients=[email], sender='censoring this :)')
msg.body = f'''
To reset your password, please follow the link below.
{url_for('reset_token', token=token, _external=True)}
If you did not request a password reset, please ignore this message.
'''
mail.send(msg)
#app.route('/password_reset', methods=['post', 'get'])
def password_reset():
error = None
success = None
def check(s):
email_format = r'\b[A-Za-z0-9._%+-]+#[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b'
if re.match(email_format, s):
return True
else:
return False
if request.method == 'POST':
email = request.form.get('email')
if not check(email):
error = "*Invalid email"
else:
query = "SELECT * FROM users WHERE email = %s"
cursor.execute(query, (email,))
cursor.fetchall()
count_rows = cursor.rowcount
if count_rows < 1:
error = "*We do not have that email address on file."
else:
send_mail(email)
success = "*Reset request sent. Please check your email."
return render_template('password_reset.html', error=error, msg=success)
#app.route('/password_reset/<token>', methods=['get', 'post'])
def reset_token(token):
error = None
success = None
user = verify_token(token)
print(user)
if user is None:
error = "That token is either invalid or expired. Please try again."
return redirect(url_for('password_reset'))
if request.method == 'POST':
password = request.form.get('password')
password_2 = request.form.get('password_2')
if len(password) < 6:
error = "*Your password must have at least 6 characters."
elif password != password_2:
error = "*Passwords do not match."
else:
query = "UPDATE users SET password=%s WHERE email=%s"
cursor.execute(query, (password, user))
mydb.commit()
success = "Your password has been created!"
return render_template('change_password.html')
I am trying to get User as foreignkey in a model but getting error.
When I try:
qr.claimed = True
user = get_object_or_404(User,id=request.user.id)
qr.branch = user
qr.save();
OUTPUT:
AttributeError: 'str' object has no attribute 'user'
When I try to POST:
qr.claimed = True
get_user = request.POST.get('branch')
user = User.objects.get(id=get_user)
qr.branch = user
qr.save();
OUTPUT:
AttributeError: 'str' object has no attribute 'POST'
When I define user in another python file and try to fetch from there:
qr.claimed = True
get_user = pythonfile.user
user = User.objects.get(id=get_user)
qr.branch = user
qr.save();
OUTPUT:
TypeError: Field 'id' expected a number but got <function user at 0x0E777E38>.
request.user -> AttributeError: 'str' object has no attribute 'user'
request.POST -> AttributeError: 'str' object has no attribute 'POST'
Any error with request or missing any package to install/import?
UPDATE:
#csrf_exempt
def decodeAjax(request):
if request.POST:
decodedData = barCode.decode(request.POST['imgBase64'])
if decodedData:
json_data = json.dumps(decodedData)
print(json_data)
return JsonResponse(json_data,safe=False)
return JsonResponse({"code" : 'NO BarCode Found'})
def decode(request):
# Find barcodes and QR codes
imgstr = re.search(r'base64,(.*)', request).group(1) #url
image_bytes = io.BytesIO(base64.b64decode(imgstr))
im = Image.open(image_bytes)
arr = np.array(im)[:, :, 0]
decodedObjects = pyzbar.decode(arr)
#print(decodedObjects)
# return decodedObjects.Decoded
# Print results
data = []
for obj in decodedObjects:
qrs = Scanner.objects.all()
for qr in qrs:
if obj.data.decode('utf-8') in qr.ID:
dt = 'Successfully Claimed!'
btn = 'Claim Another'
img = 'tick.gif'
if qr.claimed == True:
dt = 'Already Claimed at %s'%(localtime(qr.scanned_at))
img = 'cross.png'
else:
qr.claimed = True
qr.save();
break
else:
dt = 'Invalid QR Code'
btn = 'Try Another'
img = 'cross.png'
data.append({
"code":obj.data.decode('utf-8') ,
#"type": obj.type,
"dt": dt,
"btn":btn,
"img":img
})
return data
You check the method with:
#csrf_exempt
def decodeAjax(request):
if request.method == 'POST':
decodedData = barCode.decode(request.POST['imgBase64'])
# …
The item you pass to decode is not a HttpRequest object, but the image in base64 encoding. You thus might want to rename this to:
def decode(base64img):
imgstr = re.search(r'base64,(.*)', base64img).group(1)
# …
If you need the request somewhere, you will need to pass request, not request.POST['imgBase64'].
furthermore I would really advise not to make methods with a CSRF exeption. You can send the CSRF token as specified in the AJAX section of the documentation.
I have a problem with users trying to register on my application (which is a Flask app deployed on Pythonanywhere with MongoDB Atlas).
Basically when they register they receive an email with a token that they need to click on to confirm. When they click on that link they should enter the application, but instead they receive an error.
When I check the error log, this is what I see (under "/auth/register") when it calls:
existing_user = User.get_by_email(session["email"])
return super(SecureCookieSession, self).__getitem__(key)
Exception KeyError: 'email' was thrown out.
It seems that somehow the session["email"] does not work?
This is my code:
#app.route('/confirm/<token>')
def confirm_email(token):
try:
email = ts.loads(token, salt="email-confirm-key", max_age=7200)
except:
return render_template("token_expired.html")
user = Database.find_one(collection="users", query={"email": email})
return redirect(url_for("register_user"))
#app.route("/auth/register", methods=["GET", "POST"])
def register_user():
existing_user = User.get_by_email(session["email"])
if existing_user is None:
email = session["email"].lower() # our website is making a request to our app
username = session["username"]
companyname = session["companyname"].lower()
password = session["password"].encode("utf-8")
hashed_password = bcrypt.hashpw(password, bcrypt.gensalt())
User.register(email, username, companyname, hashed_password)
session["companyname"] = companyname
excisting_company = Database.find_one(collection="companies", query={"email": session["email"]})
if excisting_company is None:
new_company = NewCompany(session["companyname"], session["email"])
new_company.company_save_to_mongo()
else:
return "A company has already been registered under your email address"
else:
return render_template("email_already_exists.html")
return redirect(url_for("user_results"))
#classmethod
def get_by_email(cls, email):
find_email = Database.find_one(collection="users", query={"email": email})
if find_email is not None:
return cls(email=find_email["email"], username=find_email["username"],
companyname=find_email["companyname"], hashed_password=find_email["password"],
date=find_email["date"], _id=find_email["_id"])
I cant seem to figure out why, as when I register myself it works just fine.
Your help would be greatly appreciated here, many thanks in advance.
UPDATE:
Here is where I set the session["email"]:
#app.route("/email_confirmation", methods=["GET", "POST"])
def confirmation():
email = request.form["email"].lower()
companyname = request.form["companyname"].lower()
password = request.form["password"]
username = request.form["username"]
session["password"] = password
session["email"] = email
session["companyname"] = companyname
session["username"] = username
existing_user = User.get_by_email(email)
if existing_user is None:
msg = Message("Confirm your email", sender=("hello#weliketalent.com"),
recipients=[email])
token = ts.dumps(email, salt="email-confirm-key")
confirm_url = url_for("confirm_email", token=token, _external=True)
msg.html = render_template("email/activate.html", confirm_url=confirm_url)
mail.send(msg)
The error is telling you that there is no "email" value in session object.
I don't see you setting this value anywhere in your code. How is it supposed to get there? Somebody needs to set it somewhere before this code runs.
In addition to that, you should design your code not to crash in such cases, as this could be a security vulnerability. You can use if "email" not in session for test.
Am new to the bottle framework but we want to use it for a project which we are working on. This is the code causing the error. This is my full code in my file.
I can add the imported modules also if need arises
`
import model
import sessionDAO
import userDAO
import bottle
import re
import cgi
import logging
#bottle.route('/')
def index_page():
cookie = bottle.request.get_cookie('session',path='/')
username = sessions.get_username(cookie)
return bottle.template('blog_template', dict(username=username))
#bottle.get('/signup')
def signup():
return bottle.template('signup',dict(username="", password="",
password_error="",
email="", username_error="", email_error="",
verify_error =""))
#bottle.get('/login')
def login():
return bottle.template('login', dict(username='',password='', login_error=''))
#bottle.get('/welcome')
def welcome():
cookie = bottle.request.get_cookie('session',path='/')
username = sessions.get_username(cookie)
if username is None:
print "welcome cant verify/identify user, sending you to the signup page"
bottle.redirect('/signup')
return bottle.template('welcome',dict(username=username))
#bottle.get('/internal_error')
#bottle.view('error_template')
def internal_error():
return dict(error='System encountered a DB error ')
#bottle.get('/logout')
def logout():
cookie = bottle.request.get_cookie('session',path='/')
sessions.end_session(cookie)
bottle.response.set_cookie('session','', path='/')
bottle.redirect('/signup')
#bottle.post('/login')
def process_login():
username = bottle.request.forms.get('username')
password = bottle.request.forms.get('password')
print "user submitted ", username, "pass ", password
user_record = users.validate_login(username,password)
if user_record:
session_id = sessions.start_session(user_record.id)
if session_id is None:
print "internal error"
bottle.redirect('/internal_error')
cookie = session_id
bottle.response.set_cookie('session',cookie, path='/')
bottle.redirect('/welcome')
else:
return bottle.template('login', dict(username=cgi.escape(username),password="",login_error="Invalid Login"))
#bottle.post('/signup')
def register():
username = bottle.request.forms.get('username')
password = bottle.request.forms.get('password')
email = bottle.request.forms.get('email')
verify = bottle.request.forms.get('verify')
errors = {'username':username,'email':email}
if validate_signup(username,password,verify,email,errors):
if not users.add_user(username,password,email):
errors['username_error'] = "User already Exist"
return bottle.template('signup',errors)
session_id = sessions.start_session(username)
print session_id
bottle.response.set_cookie('session', session_id, path='/')
bottle.redirect('/welcome')
else:
print "User did not validate"
return bottle.template('signup',errors)
def validate_signup(username,password,verify,email,errors):
USER_RE = re.compile(r"^[a-zA-Z0-9_-]{3,20}$")
PASS_RE = re.compile(r"^.{6,20}$")
EMAIL_RE = re.compile(r"^[\S]+#[\S]+\.[\S]+$")
errors['username_error'] = ""
errors['password_error'] = ""
errors['verify_error'] = ""
errors['email_error'] = ""
if not USER_RE.match(str(username)):
errors['username_error'] = "Invalid username, try letters and numbers only"
return False
if not PASS_RE.match(str(password)):
errors['password_error'] = "Invalid password"
return False
if password != str(verify):
errors['verify_error'] = 'Password must match'
return False
if email != "":
if not EMAIL_RE.match(str(email)):
errors['email_error'] = 'Invalid email address'
return False
return True
#bottle.error(500)
def error500(error):
logging.debug(str(error))
print str(error)
bottle.redirect('/signup')
# return bottle.template('error_template',dict(error=str(error)))
user_data = model.User
session_data = model.Session
users = userDAO.UserDAO(user_data)
sessions = sessionDAO.SessionDAO(session_data)
app = bottle.app()
`
the set cookie is not working even if I remove the path args..
I want to test this view:
def register(request):
"""
handle user registration
code variable is for testing purposes
"""
if request.method== 'GET':
form = RegisterForm(auto_id=False)
code = 1
return render_to_response('register_home.html',locals(),context_instance=RequestContext(request))
elif request.method == 'POST':
form = RegisterForm(request.POST)
if form.is_valid():
password = form.cleaned_data['password']
password_confirmation = form.cleaned_data['password_confirmation']
if password == password_confirmation:
#if True:
login = form.cleaned_data['login']
email = form.cleaned_data['email']
newsletter = form.cleaned_data['newsletter']
key = register_user(login,email,password,newsletter)
if key:
#send email
send_mail("Dziękujemy za rejestrację"," Klucz aktywacyjny to " + key,settings.EMAIL_HOST_USER,[email])
request.session['email'] = email
return redirect(register_success)
else:
code = 4
error = "Login /email are taken"
return render_to_response('register_home.html',locals(),context_instance=RequestContext(request))
else:
code = 3
error = "invalid password"
return render_to_response('register_home.html',locals(),context_instance=RequestContext(request))
else:
code = 2
return render_to_response('register_home.html',locals(),context_instance=RequestContext(request))
And here is my part of my test:
def test_valid_credentials(self):
#now try to register valid user
data = {'login':'test','password':'zaq12wsx','password_confirmation':'zaq12wsx','terms':True,'newsletter':True,'email':'test#test.com'}
response = self.c.post(reverse('register'),data)
#our user should be registred
self.assertEquals(302, response.status_code,'We dont have benn redirected')
self.assertEqual(len(mail.outbox), 1,'No activation email was sent')
#clen email box
mail.outbox = []
#now try to add anotheer user with the same data
response = self.c.post(reverse('register'),data)
#template should be rendered with error message about used login and email
self.assertEqual(response.context['code'],4)
And here is the error that I got:
,
in test_valid_credentials
self.assertEqual(response.context['code'],4)
TypeError: 'NoneType' object is not subscriptable
I tried it with get method and it works perfectly. Just with post it don't want to work.What am I doing wrong?Best regards
What is the response status? Redirects doesn't have context. Anyway, printing the response should help.
My guess is
key = register_user(login,email,password,newsletter)
throws an exception on duplicate register attempts and thus the handler does not generate a response.