From 6462315eb262f3501f3f5d0b25b6d1283e5142d5 Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 15:21:01 +0000
Subject: [PATCH 1/79] Add a change password link for local auth


---

diff --git a/pagure/login_forms.py b/pagure/login_forms.py
index 0518fd0..3755310 100644
--- a/pagure/login_forms.py
+++ b/pagure/login_forms.py
@@ -86,3 +86,18 @@ class NewUserForm(wtf.Form):
         'Confirm password  <span class="error">*</span>',
         [wtforms.validators.Required(), same_password]
     )
+
+class ChangePasswordForm(wtf.Form):
+    """ Form to reset one's password in the local database. """
+    old_password = wtforms.PasswordField(
+        'Old Password  <span class="error">*</span>',
+        [wtforms.validators.Required()]
+    )
+    password = wtforms.PasswordField(
+        'Password  <span class="error">*</span>',
+        [wtforms.validators.Required()]
+    )
+    confirm_password = wtforms.PasswordField(
+        'Confirm password  <span class="error">*</span>',
+        [wtforms.validators.Required(), same_password]
+    )
diff --git a/pagure/templates/login/password_change.html b/pagure/templates/login/password_change.html
index bef3946..26a5836 100644
--- a/pagure/templates/login/password_change.html
+++ b/pagure/templates/login/password_change.html
@@ -1,6 +1,7 @@
 {% extends "master.html" %}
 {% from "_formhelper.html" import render_bootstrap_field %}
 
+<<<<<<< HEAD
 {% block title %}Lost password{% endblock %}
 {% set tag = "home" %}
 
@@ -25,5 +26,27 @@
     </div>
   </div>
 </div>
+=======
+{% block title %}Change password{% endblock %}
+{%block tag %}home{% endblock %}
+
+{% block content %}
+<h2>Change password</h2>
+
+<form action="{{ url_for('change_password', username=g.fas_user.username) }}" method="POST">
+  <table>
+    {{ render_field_in_row(form.old_password) }}
+    {{ render_field_in_row(form.password) }}
+    {{ render_field_in_row(form.confirm_password) }}
+  </table>
+  <p class="buttons indent">
+    <input type="submit" class="submit positive button" value="Update">
+    <a href="{{ url_for('index') }}">
+      <input type="button" value="Cancel" class="button">
+    </a>
+    {{ form.csrf_token }}
+  </p>
+</form>
+>>>>>>> Add a change password link for local auth
 
 {% endblock %}
diff --git a/pagure/templates/user_settings.html b/pagure/templates/user_settings.html
index 69db47d..bcd9528 100644
--- a/pagure/templates/user_settings.html
+++ b/pagure/templates/user_settings.html
@@ -38,6 +38,7 @@
 
 
 {% block content %}
+<<<<<<< HEAD
 <div class="container p-t-3">
   <div class="col-md-8 col-md-offset-2">
     <div class="card m-b-3">
@@ -64,6 +65,26 @@
             </a>
       </div>
       <div class="list-group list-group-flush">
+=======
+<section class="user_settings">
+    <header>
+        <h2>{{ user.user }}'s settings</h2>
+    </header>
+    <table>
+      <tr>
+        <th>Full name</th>
+        <td> {{ user.fullname }} </td>
+      </tr>
+      <tr>
+        <td>
+            {% if config.get('PAGURE_AUTH')=='local' %}
+                <a href="{{ url_for('change_password', username=g.fas_user.username) }}">Change password</a>
+            {% endif %}
+        </td>
+     </tr>
+      <tr>
+        <th>Emails</th>
+>>>>>>> Add a change password link for local auth
         {% for email in user.emails %}
           {{ render_email(email, form) }}
         {% endfor %}
diff --git a/pagure/ui/login.py b/pagure/ui/login.py
index 2117514..ede0308 100644
--- a/pagure/ui/login.py
+++ b/pagure/ui/login.py
@@ -262,6 +262,44 @@ def reset_password(token):
 # Methods specific to local login.
 #
 
+@APP.route('/password/change/<username>/', methods=['GET', 'POST'])
+@APP.route('/password/change/<username>', methods=['GET', 'POST'])
+def change_password(username):
+    """ Method to change the password for local auth users.
+    """
+    form = forms.ChangePasswordForm()
+    user_obj = pagure.lib.search_user(SESSION, username=username)
+    if not user_obj:
+        flask.flash('No user associated with this username.', 'error')
+        return flask.redirect(flask.url_for('auth_login'))
+    if form.validate_on_submit():
+        old_password = '%s%s' % (
+            form.old_password.data, APP.config.get('PASSWORD_SEED', None))
+        if user_obj.password == hashlib.sha512(old_password).hexdigest():
+            password = '%s%s' % (
+                form.password.data, APP.config.get('PASSWORD_SEED', None))
+            user_obj.password = hashlib.sha512(password).hexdigest()
+            SESSION.add(user_obj)
+
+        try:
+            SESSION.commit()
+            flask.flash(
+                'Password changed')
+        except SQLAlchemyError as err:
+            SESSION.rollback()
+            flask.flash('Could not set the new password.', 'error')
+            APP.logger.debug(
+                'Password lost change - Error setting password.')
+            APP.logger.exception(err)
+
+        return flask.redirect(flask.url_for('auth_login'))
+
+    return flask.render_template(
+        'login/password_change.html',
+        form=form,
+        username=username,
+    )
+
 
 def send_confirmation_email(user):
     """ Sends the confirmation email asking the user to confirm its email

From ba183189bcd4d494d0a493bd6494306d7077ba33 Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 15:21:01 +0000
Subject: [PATCH 2/79] Add bcrypt method for password storing


---

diff --git a/pagure/templates/login/password_change.html b/pagure/templates/login/password_change.html
index 26a5836..bef3946 100644
--- a/pagure/templates/login/password_change.html
+++ b/pagure/templates/login/password_change.html
@@ -1,7 +1,6 @@
 {% extends "master.html" %}
 {% from "_formhelper.html" import render_bootstrap_field %}
 
-<<<<<<< HEAD
 {% block title %}Lost password{% endblock %}
 {% set tag = "home" %}
 
@@ -26,27 +25,5 @@
     </div>
   </div>
 </div>
-=======
-{% block title %}Change password{% endblock %}
-{%block tag %}home{% endblock %}
-
-{% block content %}
-<h2>Change password</h2>
-
-<form action="{{ url_for('change_password', username=g.fas_user.username) }}" method="POST">
-  <table>
-    {{ render_field_in_row(form.old_password) }}
-    {{ render_field_in_row(form.password) }}
-    {{ render_field_in_row(form.confirm_password) }}
-  </table>
-  <p class="buttons indent">
-    <input type="submit" class="submit positive button" value="Update">
-    <a href="{{ url_for('index') }}">
-      <input type="button" value="Cancel" class="button">
-    </a>
-    {{ form.csrf_token }}
-  </p>
-</form>
->>>>>>> Add a change password link for local auth
 
 {% endblock %}
diff --git a/pagure/templates/login/password_recover.html b/pagure/templates/login/password_recover.html
new file mode 100644
index 0000000..57d9f92
--- /dev/null
+++ b/pagure/templates/login/password_recover.html
@@ -0,0 +1,25 @@
+{% extends "master.html" %}
+{% from "_formhelper.html" import render_field_in_row %}
+
+{% block title %}Change password{% endblock %}
+{%block tag %}home{% endblock %}
+
+{% block content %}
+<h2>Change password</h2>
+
+<form action="{{ url_for('change_password', username=g.fas_user.username) }}" method="POST">
+  <table>
+    {{ render_field_in_row(form.old_password) }}
+    {{ render_field_in_row(form.password) }}
+    {{ render_field_in_row(form.confirm_password) }}
+  </table>
+  <p class="buttons indent">
+    <input type="submit" class="submit positive button" value="Update">
+    <a href="{{ url_for('index') }}">
+      <input type="button" value="Cancel" class="button">
+    </a>
+    {{ form.csrf_token }}
+  </p>
+</form>
+
+{% endblock %}
diff --git a/pagure/templates/master.html b/pagure/templates/master.html
index 1d928c5..b08fbf9 100644
--- a/pagure/templates/master.html
+++ b/pagure/templates/master.html
@@ -78,7 +78,7 @@
               </a>
             </li>
             {% endif %}
-          {% endif %}
+         {% endif %}
         </ul>
       </div>
     </nav>
diff --git a/pagure/ui/login.py b/pagure/ui/login.py
index ede0308..d32b340 100644
--- a/pagure/ui/login.py
+++ b/pagure/ui/login.py
@@ -12,6 +12,7 @@
 import hashlib
 import datetime
 import urlparse
+import bcrypt
 
 import flask
 from sqlalchemy.exc import SQLAlchemyError
@@ -44,9 +45,8 @@ def new_user():
             flask.flash('Email address already taken.', 'error')
             return flask.redirect(flask.request.url)
 
-        password = '%s%s' % (
-            form.password.data, APP.config.get('PASSWORD_SEED', None))
-        form.password.data = hashlib.sha512(password).hexdigest()
+        password = bcrypt.hashpw(form.password.data, bcrypt.gensalt())
+        form.password.data = password
 
         token = pagure.lib.login.id_generator(40)
 
@@ -98,12 +98,12 @@ def do_login():
 
     if form.validate_on_submit():
         username = form.username.data
-        password = '%s%s' % (
-            form.password.data, APP.config.get('PASSWORD_SEED', None))
-        password = hashlib.sha512(password).hexdigest()
 
         user_obj = pagure.lib.search_user(SESSION, username=username)
+        password = bcrypt.hashpw(form.password.data, user_obj.password)
+
         if not user_obj or user_obj.password != password:
+            print user_obj.password, password
             flask.flash('Username or password invalid.', 'error')
             return flask.redirect(flask.url_for('auth_login'))
         elif user_obj.token:
@@ -232,9 +232,7 @@ def reset_password(token):
 
     if form.validate_on_submit():
 
-        password = '%s%s' % (
-            form.password.data, APP.config.get('PASSWORD_SEED', None))
-        user_obj.password = hashlib.sha512(password).hexdigest()
+        user_obj.password = bcrypt.hashpw(form.password.data, bcrypt.gensalt())
         user_obj.token = None
         SESSION.add(user_obj)
 
@@ -273,12 +271,9 @@ def change_password(username):
         flask.flash('No user associated with this username.', 'error')
         return flask.redirect(flask.url_for('auth_login'))
     if form.validate_on_submit():
-        old_password = '%s%s' % (
-            form.old_password.data, APP.config.get('PASSWORD_SEED', None))
-        if user_obj.password == hashlib.sha512(old_password).hexdigest():
-            password = '%s%s' % (
-                form.password.data, APP.config.get('PASSWORD_SEED', None))
-            user_obj.password = hashlib.sha512(password).hexdigest()
+        old_password = bcrypt.hashpw(form.old_password.data, user_obj.password)
+        if user_obj.password == old_password:
+            user_obj.password = bcrypt.hashpw(form.password.data, bcrypt.gensalt())
             SESSION.add(user_obj)
 
         try:
@@ -295,7 +290,7 @@ def change_password(username):
         return flask.redirect(flask.url_for('auth_login'))
 
     return flask.render_template(
-        'login/password_change.html',
+        'login/password_recover.html',
         form=form,
         username=username,
     )

From 4886b40c184c4ead64ff76e65a980e6d7d0e4e54 Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 15:21:01 +0000
Subject: [PATCH 3/79] Add requirement and ensuring backward compatibility


---

diff --git a/pagure/templates/login/password_recover.html b/pagure/templates/login/password_recover.html
index 57d9f92..a61a452 100644
--- a/pagure/templates/login/password_recover.html
+++ b/pagure/templates/login/password_recover.html
@@ -1,25 +1,34 @@
 {% extends "master.html" %}
-{% from "_formhelper.html" import render_field_in_row %}
+{% from "_formhelper.html" import render_bootstrap_field %}
 
 {% block title %}Change password{% endblock %}
 {%block tag %}home{% endblock %}
 
 {% block content %}
-<h2>Change password</h2>
-
-<form action="{{ url_for('change_password', username=g.fas_user.username) }}" method="POST">
-  <table>
-    {{ render_field_in_row(form.old_password) }}
-    {{ render_field_in_row(form.password) }}
-    {{ render_field_in_row(form.confirm_password) }}
-  </table>
-  <p class="buttons indent">
-    <input type="submit" class="submit positive button" value="Update">
-    <a href="{{ url_for('index') }}">
-      <input type="button" value="Cancel" class="button">
-    </a>
-    {{ form.csrf_token }}
-  </p>
-</form>
+<div class="container">
+  <div class="row">
+    <div class="col-md-8 col-md-offset-2">
+      <div class="card m-t-3">
+        <div class="card-header">
+            <strong>Change password</strong>
+        </div>
+        <form action="{{ url_for('change_password', username=g.fas_user.username) }}" method="POST">
+            <table>
+                {{ render_bootstrap_field(form.old_password) }}
+                {{ render_bootstrap_field(form.password) }}
+                {{ render_bootstrap_field(form.confirm_password) }}
+            </table>
+            <p class="buttons indent">
+                <input type="submit" class="submit positive button"  class="btn btn-primary" value="Update">
+                <a href="{{ url_for('index') }}">
+                    <input type="button" value="Cancel" class="button" class="btn btn-secondary">
+                </a>
+                {{ form.csrf_token }}
+            </p>
+        </form>
+     </div>
+   </div>
+  </div>
+</div>
 
 {% endblock %}
diff --git a/pagure/templates/user_settings.html b/pagure/templates/user_settings.html
index bcd9528..0ff9e40 100644
--- a/pagure/templates/user_settings.html
+++ b/pagure/templates/user_settings.html
@@ -38,7 +38,6 @@
 
 
 {% block content %}
-<<<<<<< HEAD
 <div class="container p-t-3">
   <div class="col-md-8 col-md-offset-2">
     <div class="card m-b-3">
@@ -65,26 +64,6 @@
             </a>
       </div>
       <div class="list-group list-group-flush">
-=======
-<section class="user_settings">
-    <header>
-        <h2>{{ user.user }}'s settings</h2>
-    </header>
-    <table>
-      <tr>
-        <th>Full name</th>
-        <td> {{ user.fullname }} </td>
-      </tr>
-      <tr>
-        <td>
-            {% if config.get('PAGURE_AUTH')=='local' %}
-                <a href="{{ url_for('change_password', username=g.fas_user.username) }}">Change password</a>
-            {% endif %}
-        </td>
-     </tr>
-      <tr>
-        <th>Emails</th>
->>>>>>> Add a change password link for local auth
         {% for email in user.emails %}
           {{ render_email(email, form) }}
         {% endfor %}
@@ -109,7 +88,12 @@
         </form>
       </div>
     </div>
-
+    <div class="card m-b-3">
+        {% if config.get('PAGURE_AUTH')=='local' %}
+            <a href="{{ url_for('change_password', username=g.fas_user.username) }}">Change password</a>
+        {% endif %}
+    </div>
   </div>
 </div>
+
 {% endblock %}
diff --git a/pagure/ui/login.py b/pagure/ui/login.py
index d32b340..de925c0 100644
--- a/pagure/ui/login.py
+++ b/pagure/ui/login.py
@@ -45,7 +45,7 @@ def new_user():
             flask.flash('Email address already taken.', 'error')
             return flask.redirect(flask.request.url)
 
-        password = bcrypt.hashpw(form.password.data, bcrypt.gensalt())
+        password = bcrypt.hashpw(str(form.password.data), bcrypt.gensalt())
         form.password.data = password
 
         token = pagure.lib.login.id_generator(40)
@@ -100,17 +100,20 @@ def do_login():
         username = form.username.data
 
         user_obj = pagure.lib.search_user(SESSION, username=username)
-        password = bcrypt.hashpw(form.password.data, user_obj.password)
+        try:
+            password = bcrypt.hashpw(str(form.password.data), user_obj.password)
+        except ValueError:
+             password = '%s%s' % (form.password.data, APP.config.get('PASSWORD_SEED', None))
+             password = hashlib.sha512(password).hexdigest()
 
         if not user_obj or user_obj.password != password:
-            print user_obj.password, password
             flask.flash('Username or password invalid.', 'error')
             return flask.redirect(flask.url_for('auth_login'))
         elif user_obj.token:
             flask.flash(
                 'Invalid user, did you confirm the creation with the url '
-                'provided by email?', 'error')
-            return flask.redirect(flask.url_for('auth_login'))
+               'provided by email?', 'error')
+           return flask.redirect(flask.url_for('auth_login'))
         else:
             visit_key = pagure.lib.login.id_generator(40)
             now = datetime.datetime.utcnow()
@@ -232,7 +235,7 @@ def reset_password(token):
 
     if form.validate_on_submit():
 
-        user_obj.password = bcrypt.hashpw(form.password.data, bcrypt.gensalt())
+        user_obj.password = bcrypt.hashpw(str(form.password.data), bcrypt.gensalt())
         user_obj.token = None
         SESSION.add(user_obj)
 
@@ -271,9 +274,9 @@ def change_password(username):
         flask.flash('No user associated with this username.', 'error')
         return flask.redirect(flask.url_for('auth_login'))
     if form.validate_on_submit():
-        old_password = bcrypt.hashpw(form.old_password.data, user_obj.password)
+        old_password = bcrypt.hashpw(str(orm.old_password.data), user_obj.password)
         if user_obj.password == old_password:
-            user_obj.password = bcrypt.hashpw(form.password.data, bcrypt.gensalt())
+            user_obj.password = bcrypt.hashpw(str(form.password.data), bcrypt.gensalt())
             SESSION.add(user_obj)
 
         try:
diff --git a/requirements.txt b/requirements.txt
index 82074eb..c65e4df 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -26,3 +26,4 @@ sqlalchemy >= 0.8
 straight.plugin==1.4.0-post-1
 trollius-redis
 wtforms
+bcrypt

From fd0f49f247e2e3e3b560db93ffb0b27a2b7015dc Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 15:21:01 +0000
Subject: [PATCH 4/79] Add constant time function


---

diff --git a/pagure/ui/login.py b/pagure/ui/login.py
index de925c0..95f3eea 100644
--- a/pagure/ui/login.py
+++ b/pagure/ui/login.py
@@ -13,6 +13,8 @@ import hashlib
 import datetime
 import urlparse
 import bcrypt
+from kitchen.text.converters import to_unicode
+from cryptography.hazmat.primitives import constant_time
 
 import flask
 from sqlalchemy.exc import SQLAlchemyError
@@ -44,9 +46,12 @@ def new_user():
         if pagure.lib.search_user(SESSION, email=email):
             flask.flash('Email address already taken.', 'error')
             return flask.redirect(flask.request.url)
-
-        password = bcrypt.hashpw(str(form.password.data), bcrypt.gensalt())
-        form.password.data = password
+        try:
+            form.password.data = str(form.password.data)
+        except UnicodeEncodeError:
+            form.password.data = to_unicode(form.password.data)
+        password = bcrypt.hashpw(form.password.data, bcrypt.gensalt())
+        form.password.data = '$2$'+password
 
         token = pagure.lib.login.id_generator(40)
 
@@ -89,7 +94,7 @@ def new_user():
 
 @APP.route('/dologin', methods=['POST'])
 def do_login():
-    """ Lo the user in user.
+    """ Log the user in user.
     """
     form = forms.LoginForm()
     next_url = flask.request.args.get('next_url')
@@ -98,22 +103,27 @@ def do_login():
 
     if form.validate_on_submit():
         username = form.username.data
-
         user_obj = pagure.lib.search_user(SESSION, username=username)
-        try:
-            password = bcrypt.hashpw(str(form.password.data), user_obj.password)
-        except ValueError:
+        if user_obj.password.startswith("$2$"):
+                password = bcrypt.hashpw(form.password.data, user_obj.password[3:])
+        elif user_obj.password.startswith("$1$"):
              password = '%s%s' % (form.password.data, APP.config.get('PASSWORD_SEED', None))
              password = hashlib.sha512(password).hexdigest()
+             if constant_time.bytes_eq(user_obj.password[3:], password):
+                user_obj.password = "$2$"+bcrypt.hashpw(form.password.data, bcrypt.gensalt())
+                password = bcrypt.hashpw(form.password.data, user_obj.password[3:])
+                SESSION.add(user_obj);
 
-        if not user_obj or user_obj.password != password:
+
+
+        if not user_obj or user_obj.password[3:] != password:
             flask.flash('Username or password invalid.', 'error')
             return flask.redirect(flask.url_for('auth_login'))
         elif user_obj.token:
             flask.flash(
                 'Invalid user, did you confirm the creation with the url '
                'provided by email?', 'error')
-           return flask.redirect(flask.url_for('auth_login'))
+            return flask.redirect(flask.url_for('auth_login'))
         else:
             visit_key = pagure.lib.login.id_generator(40)
             now = datetime.datetime.utcnow()
@@ -235,7 +245,7 @@ def reset_password(token):
 
     if form.validate_on_submit():
 
-        user_obj.password = bcrypt.hashpw(str(form.password.data), bcrypt.gensalt())
+        user_obj.password = '$2$'+bcrypt.hashpw(form.password.data, bcrypt.gensalt())
         user_obj.token = None
         SESSION.add(user_obj)
 
@@ -274,9 +284,9 @@ def change_password(username):
         flask.flash('No user associated with this username.', 'error')
         return flask.redirect(flask.url_for('auth_login'))
     if form.validate_on_submit():
-        old_password = bcrypt.hashpw(str(orm.old_password.data), user_obj.password)
-        if user_obj.password == old_password:
-            user_obj.password = bcrypt.hashpw(str(form.password.data), bcrypt.gensalt())
+        old_password = bcrypt.hashpw(form.old_password.data, user_obj.password[3:])
+        if constant_time.bytes_eq(user_obj.password[3:], old_password):
+            user_obj.password = '$2$'+bcrypt.hashpw(form.password.data, bcrypt.gensalt())
             SESSION.add(user_obj)
 
         try:

From 3d73eaf18be2fedb07841c9eb0c74edb6ba64801 Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 15:21:01 +0000
Subject: [PATCH 5/79] Fix constant tim function and different way of handling versions


---

diff --git a/pagure/ui/login.py b/pagure/ui/login.py
index 95f3eea..fe5615f 100644
--- a/pagure/ui/login.py
+++ b/pagure/ui/login.py
@@ -13,7 +13,7 @@ import hashlib
 import datetime
 import urlparse
 import bcrypt
-from kitchen.text.converters import to_unicode
+from kitchen.text.converters import to_unicode, to_bytes
 from cryptography.hazmat.primitives import constant_time
 
 import flask
@@ -46,11 +46,8 @@ def new_user():
         if pagure.lib.search_user(SESSION, email=email):
             flask.flash('Email address already taken.', 'error')
             return flask.redirect(flask.request.url)
-        try:
-            form.password.data = str(form.password.data)
-        except UnicodeEncodeError:
-            form.password.data = to_unicode(form.password.data)
-        password = bcrypt.hashpw(form.password.data, bcrypt.gensalt())
+
+        password = bcrypt.hashpw(to_unicode(form.password.data), bcrypt.gensalt())
         form.password.data = '$2$'+password
 
         token = pagure.lib.login.id_generator(40)
@@ -104,27 +101,26 @@ def do_login():
     if form.validate_on_submit():
         username = form.username.data
         user_obj = pagure.lib.search_user(SESSION, username=username)
-        if user_obj.password.startswith("$2$"):
-                password = bcrypt.hashpw(form.password.data, user_obj.password[3:])
-        elif user_obj.password.startswith("$1$"):
-             password = '%s%s' % (form.password.data, APP.config.get('PASSWORD_SEED', None))
-             password = hashlib.sha512(password).hexdigest()
-             if constant_time.bytes_eq(user_obj.password[3:], password):
-                user_obj.password = "$2$"+bcrypt.hashpw(form.password.data, bcrypt.gensalt())
-                password = bcrypt.hashpw(form.password.data, user_obj.password[3:])
-                SESSION.add(user_obj);
-
-
-
-        if not user_obj or user_obj.password[3:] != password:
+        _, version, password = user_obj.password.split('$', 2)
+        if version == '2':
+                password = bcrypt.hashpw(to_unicode(form.password.data), password)
+        elif version == '1':
+                password = '%s%s' % (to_unicode(form.password.data), APP.config.get('PASSWORD_SEED', None))
+                password = hashlib.sha512(password).hexdigest()
+        if not user_obj or not constant_time.bytes_eq(to_bytes(user_obj.password[3:]), to_bytes(password)):
             flask.flash('Username or password invalid.', 'error')
             return flask.redirect(flask.url_for('auth_login'))
         elif user_obj.token:
             flask.flash(
                 'Invalid user, did you confirm the creation with the url '
-               'provided by email?', 'error')
+                'provided by email?', 'error')
             return flask.redirect(flask.url_for('auth_login'))
         else:
+
+            if version == '1':
+                user_obj.password = "$2$"+bcrypt.hashpw(to_unicode(form.password.data), bcrypt.gensalt())
+                SESSION.add(user_obj)
+
             visit_key = pagure.lib.login.id_generator(40)
             now = datetime.datetime.utcnow()
             expiry = now + datetime.timedelta(days=30)
@@ -245,7 +241,7 @@ def reset_password(token):
 
     if form.validate_on_submit():
 
-        user_obj.password = '$2$'+bcrypt.hashpw(form.password.data, bcrypt.gensalt())
+        user_obj.password = '$2$'+bcrypt.hashpw(to_unicode(form.password.data), bcrypt.gensalt())
         user_obj.token = None
         SESSION.add(user_obj)
 
@@ -285,7 +281,7 @@ def change_password(username):
         return flask.redirect(flask.url_for('auth_login'))
     if form.validate_on_submit():
         old_password = bcrypt.hashpw(form.old_password.data, user_obj.password[3:])
-        if constant_time.bytes_eq(user_obj.password[3:], old_password):
+        if constant_time.bytes_eq(to_bytes(user_obj.password[3:]), to_bytes(old_password)):
             user_obj.password = '$2$'+bcrypt.hashpw(form.password.data, bcrypt.gensalt())
             SESSION.add(user_obj)
 

From 9ec0cf3577c5a9accd26499eee403fcb0852b3d2 Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 15:21:01 +0000
Subject: [PATCH 6/79] Fix pep8 error and better backward compatibility


---

diff --git a/pagure/ui/login.py b/pagure/ui/login.py
index fe5615f..908adaf 100644
--- a/pagure/ui/login.py
+++ b/pagure/ui/login.py
@@ -48,6 +48,7 @@ def new_user():
             return flask.redirect(flask.request.url)
 
         password = bcrypt.hashpw(to_unicode(form.password.data), bcrypt.gensalt())
+
         form.password.data = '$2$'+password
 
         token = pagure.lib.login.id_generator(40)
@@ -102,14 +103,22 @@ def do_login():
         username = form.username.data
         user_obj = pagure.lib.search_user(SESSION, username=username)
         _, version, password = user_obj.password.split('$', 2)
+
         if version == '2':
                 password = bcrypt.hashpw(to_unicode(form.password.data), password)
-        elif version == '1':
-                password = '%s%s' % (to_unicode(form.password.data), APP.config.get('PASSWORD_SEED', None))
+
+        else:
+                password = '%s%s' % (to_unicode(form.password.data),
+                                        APP.config.get('PASSWORD_SEED', None))
                 password = hashlib.sha512(password).hexdigest()
-        if not user_obj or not constant_time.bytes_eq(to_bytes(user_obj.password[3:]), to_bytes(password)):
+
+        if not user_obj or not constant_time.bytes_eq(
+                                    to_bytes(user_obj.password[3:]),
+                                    to_bytes(password)):
+
             flask.flash('Username or password invalid.', 'error')
             return flask.redirect(flask.url_for('auth_login'))
+
         elif user_obj.token:
             flask.flash(
                 'Invalid user, did you confirm the creation with the url '
@@ -117,8 +126,10 @@ def do_login():
             return flask.redirect(flask.url_for('auth_login'))
         else:
 
-            if version == '1':
-                user_obj.password = "$2$"+bcrypt.hashpw(to_unicode(form.password.data), bcrypt.gensalt())
+            if version is not '2':
+                user_obj.password = "$2$"+bcrypt.hashpw(
+                                            to_unicode(form.password.data),
+                                            bcrypt.gensalt())
                 SESSION.add(user_obj)
 
             visit_key = pagure.lib.login.id_generator(40)
@@ -241,7 +252,10 @@ def reset_password(token):
 
     if form.validate_on_submit():
 
-        user_obj.password = '$2$'+bcrypt.hashpw(to_unicode(form.password.data), bcrypt.gensalt())
+        user_obj.password = '$2$'+bcrypt.hashpw(
+                                   to_unicode(form.password.data),
+                                   bcrypt.gensalt())
+
         user_obj.token = None
         SESSION.add(user_obj)
 
@@ -280,11 +294,22 @@ def change_password(username):
         flask.flash('No user associated with this username.', 'error')
         return flask.redirect(flask.url_for('auth_login'))
     if form.validate_on_submit():
-        old_password = bcrypt.hashpw(form.old_password.data, user_obj.password[3:])
-        if constant_time.bytes_eq(to_bytes(user_obj.password[3:]), to_bytes(old_password)):
-            user_obj.password = '$2$'+bcrypt.hashpw(form.password.data, bcrypt.gensalt())
+        old_password = bcrypt.hashpw(
+            form.old_password.data, user_obj.password[3:])
+
+        if constant_time.bytes_eq(to_bytes(user_obj.password[3:]),
+                                  to_bytes(old_password)):
+
+            user_obj.password = '$2$' + \
+                bcrypt.hashpw(form.password.data, bcrypt.gensalt())
             SESSION.add(user_obj)
 
+        else:
+            flask.flash(
+                'Invalid user, this user never asked for a password change',
+                'error')
+            return flask.redirect(flask.url_for('auth_login'))
+
         try:
             SESSION.commit()
             flask.flash(

From cfd1ff91c9f3af2ca23d4f57ba48d3a3aa5d9738 Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 15:21:01 +0000
Subject: [PATCH 7/79] Add seperate function for hashing


---

diff --git a/pagure/ui/login.py b/pagure/ui/login.py
index 908adaf..510b3b8 100644
--- a/pagure/ui/login.py
+++ b/pagure/ui/login.py
@@ -29,6 +29,17 @@ from pagure import APP, SESSION
 # pylint: disable=E1101
 
 
+def generate_hashed_value(password):
+    """ Generate hash value for password
+    """
+    return '$2$' + bcrypt.hashpw(to_unicode(password), bcrypt.gensalt())
+
+def retrive_hashed_value(password, hash_value):
+    """Retrive hash value to compare
+    """
+    return bcrypt.hashpw(to_unicode(password), hash_value)
+
+
 @APP.route('/user/new/', methods=['GET', 'POST'])
 @APP.route('/user/new', methods=['GET', 'POST'])
 def new_user():
@@ -47,9 +58,7 @@ def new_user():
             flask.flash('Email address already taken.', 'error')
             return flask.redirect(flask.request.url)
 
-        password = bcrypt.hashpw(to_unicode(form.password.data), bcrypt.gensalt())
-
-        form.password.data = '$2$'+password
+        form.password.data = generate_hashed_value(form.password.data)
 
         token = pagure.lib.login.id_generator(40)
 
@@ -102,18 +111,23 @@ def do_login():
     if form.validate_on_submit():
         username = form.username.data
         user_obj = pagure.lib.search_user(SESSION, username=username)
-        _, version, password = user_obj.password.split('$', 2)
+        _, version, user_password = user_obj.password.split('$', 2)
 
         if version == '2':
-                password = bcrypt.hashpw(to_unicode(form.password.data), password)
+                password = retrive_hashed_value(form.password.data, user_password)
 
-        else:
+        elif version == '1':
                 password = '%s%s' % (to_unicode(form.password.data),
                                         APP.config.get('PASSWORD_SEED', None))
                 password = hashlib.sha512(password).hexdigest()
 
+        else:
+             flask.flash('Something is wrong with your account', 'error')
+             return flask.redirect(flask.url_for('auth_login'))
+
+
         if not user_obj or not constant_time.bytes_eq(
-                                    to_bytes(user_obj.password[3:]),
+                                    to_bytes(user_password),
                                     to_bytes(password)):
 
             flask.flash('Username or password invalid.', 'error')
@@ -127,9 +141,7 @@ def do_login():
         else:
 
             if version is not '2':
-                user_obj.password = "$2$"+bcrypt.hashpw(
-                                            to_unicode(form.password.data),
-                                            bcrypt.gensalt())
+                user_obj.password = generate_hashed_value(form.password.data)
                 SESSION.add(user_obj)
 
             visit_key = pagure.lib.login.id_generator(40)
@@ -252,9 +264,7 @@ def reset_password(token):
 
     if form.validate_on_submit():
 
-        user_obj.password = '$2$'+bcrypt.hashpw(
-                                   to_unicode(form.password.data),
-                                   bcrypt.gensalt())
+        user_obj.password = generate_hashed_value(form.password.data)
 
         user_obj.token = None
         SESSION.add(user_obj)
@@ -290,23 +300,24 @@ def change_password(username):
     """
     form = forms.ChangePasswordForm()
     user_obj = pagure.lib.search_user(SESSION, username=username)
+    _, version, user_password = user_obj.password.split('$', 2)
+
     if not user_obj:
         flask.flash('No user associated with this username.', 'error')
         return flask.redirect(flask.url_for('auth_login'))
     if form.validate_on_submit():
-        old_password = bcrypt.hashpw(
-            form.old_password.data, user_obj.password[3:])
+        old_password = retrive_hashed_value(
+            form.old_password.data, user_password)
 
-        if constant_time.bytes_eq(to_bytes(user_obj.password[3:]),
+        if constant_time.bytes_eq(to_bytes(user_password),
                                   to_bytes(old_password)):
 
-            user_obj.password = '$2$' + \
-                bcrypt.hashpw(form.password.data, bcrypt.gensalt())
+            user_obj.password = generate_hashed_value(form.password.data)
             SESSION.add(user_obj)
 
         else:
             flask.flash(
-                'Invalid user, this user never asked for a password change',
+                'Invalid user, old password does not match',
                 'error')
             return flask.redirect(flask.url_for('auth_login'))
 

From 2c089b745b4ca0ca961a3352c105db43aef20058 Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 15:21:01 +0000
Subject: [PATCH 8/79] Refactor and cleaning code


---

diff --git a/pagure/lib/login.py b/pagure/lib/login.py
index 5f20977..bd171bb 100644
--- a/pagure/lib/login.py
+++ b/pagure/lib/login.py
@@ -10,6 +10,7 @@
 
 import random
 import string
+import bcrypt
 
 from pagure.lib import model
 
@@ -61,3 +62,13 @@ def get_users_by_group(session, group):
     )
 
     return query.all()
+
+def generate_hashed_value(password):
+    """ Generate hash value for password
+    """
+    return '$2$' + bcrypt.hashpw(to_unicode(password), bcrypt.gensalt())
+
+def retrieve_hashed_value(password, hash_value):
+    """Retrieve hash value to compare
+    """
+    return bcrypt.hashpw(to_unicode(password), hash_value)
diff --git a/pagure/ui/login.py b/pagure/ui/login.py
index 510b3b8..8f6b663 100644
--- a/pagure/ui/login.py
+++ b/pagure/ui/login.py
@@ -25,21 +25,11 @@ import pagure.lib.login
 import pagure.lib.model as model
 import pagure.lib.notify
 from pagure import APP, SESSION
+from pagure.lib.login import generate_hashed_value, retrieve_hashed_value
 
 # pylint: disable=E1101
 
 
-def generate_hashed_value(password):
-    """ Generate hash value for password
-    """
-    return '$2$' + bcrypt.hashpw(to_unicode(password), bcrypt.gensalt())
-
-def retrive_hashed_value(password, hash_value):
-    """Retrive hash value to compare
-    """
-    return bcrypt.hashpw(to_unicode(password), hash_value)
-
-
 @APP.route('/user/new/', methods=['GET', 'POST'])
 @APP.route('/user/new', methods=['GET', 'POST'])
 def new_user():
@@ -114,7 +104,7 @@ def do_login():
         _, version, user_password = user_obj.password.split('$', 2)
 
         if version == '2':
-                password = retrive_hashed_value(form.password.data, user_password)
+                password = retrieve_hashed_value(form.password.data, user_password)
 
         elif version == '1':
                 password = '%s%s' % (to_unicode(form.password.data),
@@ -140,7 +130,7 @@ def do_login():
             return flask.redirect(flask.url_for('auth_login'))
         else:
 
-            if version is not '2':
+            if version != '2':
                 user_obj.password = generate_hashed_value(form.password.data)
                 SESSION.add(user_obj)
 
@@ -306,8 +296,14 @@ def change_password(username):
         flask.flash('No user associated with this username.', 'error')
         return flask.redirect(flask.url_for('auth_login'))
     if form.validate_on_submit():
-        old_password = retrive_hashed_value(
-            form.old_password.data, user_password)
+        if version == '2':
+            old_password = retrieve_hashed_value(
+                form.old_password.data, user_password)
+
+        elif version == '1':
+            old_password = '%s%s' % (to_unicode(form.old_password.data),
+                                        APP.config.get('PASSWORD_SEED', None))
+            old_password = hashlib.sha512(old_password).hexdigest()
 
         if constant_time.bytes_eq(to_bytes(user_password),
                                   to_bytes(old_password)):

From 0b007cd3fb081439bb2c8de47c2bfbbfade6f1b4 Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 15:21:01 +0000
Subject: [PATCH 9/79] Add fucntions in lib


---

diff --git a/pagure/lib/login.py b/pagure/lib/login.py
index bd171bb..d944b1a 100644
--- a/pagure/lib/login.py
+++ b/pagure/lib/login.py
@@ -13,6 +13,7 @@ import string
 import bcrypt
 
 from pagure.lib import model
+from kitchen.text.converters import to_unicode, to_bytes
 
 
 def id_generator(size=15, chars=string.ascii_uppercase + string.digits):
@@ -69,6 +70,20 @@ def generate_hashed_value(password):
     return '$2$' + bcrypt.hashpw(to_unicode(password), bcrypt.gensalt())
 
 def retrieve_hashed_value(password, hash_value):
-    """Retrieve hash value to compare
+    """ Retrieve hash value to compare
     """
     return bcrypt.hashpw(to_unicode(password), hash_value)
+
+def get_password(entered_password, user_password, version):
+    """ Version checking and returning the password
+    """
+    if version == '2':
+         password = retrieve_hashed_value(
+                entered_password, user_password)
+         return password
+
+    elif version == '1':
+            password = '%s%s' % (to_unicode(entered_password),
+                                        APP.config.get('PASSWORD_SEED', None))
+            password = hashlib.sha512(password).hexdigest()
+            return password
diff --git a/pagure/ui/login.py b/pagure/ui/login.py
index 8f6b663..7a8e186 100644
--- a/pagure/ui/login.py
+++ b/pagure/ui/login.py
@@ -25,11 +25,12 @@ import pagure.lib.login
 import pagure.lib.model as model
 import pagure.lib.notify
 from pagure import APP, SESSION
-from pagure.lib.login import generate_hashed_value, retrieve_hashed_value
+from pagure.lib.login import generate_hashed_value, retrieve_hashed_value, get_password
 
 # pylint: disable=E1101
 
 
+
 @APP.route('/user/new/', methods=['GET', 'POST'])
 @APP.route('/user/new', methods=['GET', 'POST'])
 def new_user():
@@ -103,18 +104,7 @@ def do_login():
         user_obj = pagure.lib.search_user(SESSION, username=username)
         _, version, user_password = user_obj.password.split('$', 2)
 
-        if version == '2':
-                password = retrieve_hashed_value(form.password.data, user_password)
-
-        elif version == '1':
-                password = '%s%s' % (to_unicode(form.password.data),
-                                        APP.config.get('PASSWORD_SEED', None))
-                password = hashlib.sha512(password).hexdigest()
-
-        else:
-             flask.flash('Something is wrong with your account', 'error')
-             return flask.redirect(flask.url_for('auth_login'))
-
+        password = get_password(form.password.data, user_password, version)
 
         if not user_obj or not constant_time.bytes_eq(
                                     to_bytes(user_password),
@@ -125,8 +115,8 @@ def do_login():
 
         elif user_obj.token:
             flask.flash(
-                'Invalid user, did you confirm the creation with the url '
-                'provided by email?', 'error')
+               'Invalid user, did you confirm the creation with the url '
+               'provided by email?', 'error')
             return flask.redirect(flask.url_for('auth_login'))
         else:
 
@@ -296,14 +286,8 @@ def change_password(username):
         flask.flash('No user associated with this username.', 'error')
         return flask.redirect(flask.url_for('auth_login'))
     if form.validate_on_submit():
-        if version == '2':
-            old_password = retrieve_hashed_value(
-                form.old_password.data, user_password)
-
-        elif version == '1':
-            old_password = '%s%s' % (to_unicode(form.old_password.data),
-                                        APP.config.get('PASSWORD_SEED', None))
-            old_password = hashlib.sha512(old_password).hexdigest()
+
+        old_password = get_password(form.old_password.data, user_password, version)
 
         if constant_time.bytes_eq(to_bytes(user_password),
                                   to_bytes(old_password)):

From fc2582cbf1453bb4b67620028222356dae7a539e Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 15:21:01 +0000
Subject: [PATCH 10/79] Add alembic migration for password


---

diff --git a/alembic/versions/1b6d7dc5600a_versioning_passwords.py b/alembic/versions/1b6d7dc5600a_versioning_passwords.py
new file mode 100644
index 0000000..39391f7
--- /dev/null
+++ b/alembic/versions/1b6d7dc5600a_versioning_passwords.py
@@ -0,0 +1,23 @@
+"""versioning_passwords
+
+Revision ID: 1b6d7dc5600a
+Revises: 3b441ef4e928
+Create Date: 2016-01-13 07:57:23.465676
+
+"""
+
+# revision identifiers, used by Alembic.
+revision = '1b6d7dc5600a'
+down_revision = '3b441ef4e928'
+
+from alembic import op
+import sqlalchemy as sa
+
+
+def upgrade():
+        op.execute('''UPDATE "users" SET password = '$1$' || password;''')
+
+
+
+def downgrade():
+        raise ValueError("Password can not be downgraded")

From 288e6b8f8eb37db28859562fab25f13fc23490a2 Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 15:21:01 +0000
Subject: [PATCH 11/79] Fix sql alchemy update


---

diff --git a/alembic/versions/1b6d7dc5600a_versioning_passwords.py b/alembic/versions/1b6d7dc5600a_versioning_passwords.py
index 39391f7..d482549 100644
--- a/alembic/versions/1b6d7dc5600a_versioning_passwords.py
+++ b/alembic/versions/1b6d7dc5600a_versioning_passwords.py
@@ -12,11 +12,14 @@ down_revision = '3b441ef4e928'
 
 from alembic import op
 import sqlalchemy as sa
-
+import sqlalchemy.orm
+from pagure.lib import model
 
 def upgrade():
-        op.execute('''UPDATE "users" SET password = '$1$' || password;''')
-
+        engine = op.get_bind().engine
+        session = sa.orm.scoped_session(sa.orm.sessionmaker(bind=engine))
+        session.query(model.User).update({model.User.password: '$1$' + model.User.password}, synchronize_session=False);
+        session.commit()
 
 
 def downgrade():

From 28d8419a4e4ea9aac6ac1a4e92c1b7d09076ef74 Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 15:21:01 +0000
Subject: [PATCH 12/79] Cleaning up and implementing pep8 standards


---

diff --git a/alembic/versions/1b6d7dc5600a_versioning_passwords.py b/alembic/versions/1b6d7dc5600a_versioning_passwords.py
index d482549..ff1aced 100644
--- a/alembic/versions/1b6d7dc5600a_versioning_passwords.py
+++ b/alembic/versions/1b6d7dc5600a_versioning_passwords.py
@@ -15,12 +15,14 @@ import sqlalchemy as sa
 import sqlalchemy.orm
 from pagure.lib import model
 
+
 def upgrade():
-        engine = op.get_bind().engine
-        session = sa.orm.scoped_session(sa.orm.sessionmaker(bind=engine))
-        session.query(model.User).update({model.User.password: '$1$' + model.User.password}, synchronize_session=False);
-        session.commit()
+    engine = op.get_bind().engine
+    session = sa.orm.scoped_session(sa.orm.sessionmaker(bind=engine))
+    session.query(model.User).update(
+        {model.User.password: '$1$' + model.User.password}, synchronize_session=False)
+    session.commit()
 
 
 def downgrade():
-        raise ValueError("Password can not be downgraded")
+    raise ValueError("Password can not be downgraded")
diff --git a/pagure/lib/login.py b/pagure/lib/login.py
index d944b1a..4f5c466 100644
--- a/pagure/lib/login.py
+++ b/pagure/lib/login.py
@@ -64,26 +64,32 @@ def get_users_by_group(session, group):
 
     return query.all()
 
+
 def generate_hashed_value(password):
     """ Generate hash value for password
     """
     return '$2$' + bcrypt.hashpw(to_unicode(password), bcrypt.gensalt())
 
+
 def retrieve_hashed_value(password, hash_value):
     """ Retrieve hash value to compare
     """
     return bcrypt.hashpw(to_unicode(password), hash_value)
 
+
 def get_password(entered_password, user_password, version):
     """ Version checking and returning the password
     """
     if version == '2':
-         password = retrieve_hashed_value(
-                entered_password, user_password)
-         return password
+        password = retrieve_hashed_value(entered_password, user_password)
 
     elif version == '1':
-            password = '%s%s' % (to_unicode(entered_password),
-                                        APP.config.get('PASSWORD_SEED', None))
-            password = hashlib.sha512(password).hexdigest()
-            return password
+        password = '%s%s' % (to_unicode(entered_password),
+                             APP.config.get('PASSWORD_SEED', None))
+        password = hashlib.sha512(password).hexdigest()
+
+    else:
+        flask.flash('Something went wrong')
+        return flask.redirect(flask.url_for('auth_login'))
+
+    return password
diff --git a/pagure/ui/login.py b/pagure/ui/login.py
index 7a8e186..c4c126d 100644
--- a/pagure/ui/login.py
+++ b/pagure/ui/login.py
@@ -29,8 +29,6 @@ from pagure.lib.login import generate_hashed_value, retrieve_hashed_value, get_p
 
 # pylint: disable=E1101
 
-
-
 @APP.route('/user/new/', methods=['GET', 'POST'])
 @APP.route('/user/new', methods=['GET', 'POST'])
 def new_user():
@@ -107,16 +105,16 @@ def do_login():
         password = get_password(form.password.data, user_password, version)
 
         if not user_obj or not constant_time.bytes_eq(
-                                    to_bytes(user_password),
-                                    to_bytes(password)):
+                to_bytes(user_password),
+                to_bytes(password)):
 
             flask.flash('Username or password invalid.', 'error')
             return flask.redirect(flask.url_for('auth_login'))
 
         elif user_obj.token:
             flask.flash(
-               'Invalid user, did you confirm the creation with the url '
-               'provided by email?', 'error')
+                'Invalid user, did you confirm the creation with the url '
+                'provided by email?', 'error')
             return flask.redirect(flask.url_for('auth_login'))
         else:
 
@@ -287,7 +285,8 @@ def change_password(username):
         return flask.redirect(flask.url_for('auth_login'))
     if form.validate_on_submit():
 
-        old_password = get_password(form.old_password.data, user_password, version)
+        old_password = get_password(
+            form.old_password.data, user_password, version)
 
         if constant_time.bytes_eq(to_bytes(user_password),
                                   to_bytes(old_password)):

From d2de34d9f31276011b94313c4862e1dbcf58890b Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 15:21:01 +0000
Subject: [PATCH 13/79] Fix constant function in pagure/ui


---

diff --git a/pagure/lib/login.py b/pagure/lib/login.py
index 4f5c466..a978f5d 100644
--- a/pagure/lib/login.py
+++ b/pagure/lib/login.py
@@ -14,6 +14,7 @@ import bcrypt
 
 from pagure.lib import model
 from kitchen.text.converters import to_unicode, to_bytes
+from cryptography.hazmat.primitives import constant_time
 
 
 def id_generator(size=15, chars=string.ascii_uppercase + string.digits):
@@ -92,4 +93,4 @@ def get_password(entered_password, user_password, version):
         flask.flash('Something went wrong')
         return flask.redirect(flask.url_for('auth_login'))
 
-    return password
+    return constant_time.bytes_eq(to_bytes(entered_password), to_bytes(user_password))
diff --git a/pagure/ui/login.py b/pagure/ui/login.py
index c4c126d..e5f0d4d 100644
--- a/pagure/ui/login.py
+++ b/pagure/ui/login.py
@@ -14,7 +14,6 @@ import datetime
 import urlparse
 import bcrypt
 from kitchen.text.converters import to_unicode, to_bytes
-from cryptography.hazmat.primitives import constant_time
 
 import flask
 from sqlalchemy.exc import SQLAlchemyError
@@ -29,6 +28,7 @@ from pagure.lib.login import generate_hashed_value, retrieve_hashed_value, get_p
 
 # pylint: disable=E1101
 
+
 @APP.route('/user/new/', methods=['GET', 'POST'])
 @APP.route('/user/new', methods=['GET', 'POST'])
 def new_user():
@@ -102,11 +102,7 @@ def do_login():
         user_obj = pagure.lib.search_user(SESSION, username=username)
         _, version, user_password = user_obj.password.split('$', 2)
 
-        password = get_password(form.password.data, user_password, version)
-
-        if not user_obj or not constant_time.bytes_eq(
-                to_bytes(user_password),
-                to_bytes(password)):
+        if not user_obj or not get_password(form.password.data, user_password, version):
 
             flask.flash('Username or password invalid.', 'error')
             return flask.redirect(flask.url_for('auth_login'))
@@ -285,11 +281,7 @@ def change_password(username):
         return flask.redirect(flask.url_for('auth_login'))
     if form.validate_on_submit():
 
-        old_password = get_password(
-            form.old_password.data, user_password, version)
-
-        if constant_time.bytes_eq(to_bytes(user_password),
-                                  to_bytes(old_password)):
+        if get_password(form.old_password.data, user_password, version):
 
             user_obj.password = generate_hashed_value(form.password.data)
             SESSION.add(user_obj)

From 2e428683e85928082ef3b784fae0ef0052bb58a7 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:01 +0000
Subject: [PATCH 14/79] Add unit-tests for pagure.lib.login


---

diff --git a/tests/test_progit_lib_login.py b/tests/test_progit_lib_login.py
new file mode 100644
index 0000000..ee5431e
--- /dev/null
+++ b/tests/test_progit_lib_login.py
@@ -0,0 +1,54 @@
+# -*- coding: utf-8 -*-
+
+"""
+ (c) 2016 - Copyright Red Hat Inc
+
+ Authors:
+   Pierre-Yves Chibon <pingou@pingoured.fr>
+
+"""
+
+__requires__ = ['SQLAlchemy >= 0.8']
+import pkg_resources
+
+import unittest
+import shutil
+import sys
+import os
+
+from mock import patch
+
+sys.path.insert(0, os.path.join(os.path.dirname(
+    os.path.abspath(__file__)), '..'))
+
+import pagure.lib
+import pagure.lib.login
+import tests
+
+
+class PagureLibLogintests(tests.Modeltests):
+    """ Tests for pagure.lib.login """
+
+    def test_id_generator(self):
+        ''' Test pagure.lib.login.id_generator. '''
+        self.assertEqual(
+            pagure.lib.login.id_generator(size=3, chars=['a']),
+            'aaa'
+        )
+
+    def test_get_users_by_group(self):
+        ''' Test pagure.lib.login.get_users_by_group. '''
+
+        users = pagure.lib.login.get_users_by_group(self.session, 'foo')
+        self.assertEqual(users, [])
+
+    def test_get_session_by_visitkey(self):
+        ''' Test pagure.lib.login.get_session_by_visitkey. '''
+
+        session = pagure.lib.login.get_session_by_visitkey(self.session, 'foo')
+        self.assertEqual(session, None)
+
+
+if __name__ == '__main__':
+    SUITE = unittest.TestLoader().loadTestsFromTestCase(PagureLibLogintests)
+    unittest.TextTestRunner(verbosity=2).run(SUITE)

From 376d409e24c8c153d5b86369a4019860c55b561b Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:01 +0000
Subject: [PATCH 15/79] Let the version be determined within get_password instead of being provided to it


---

diff --git a/pagure/lib/login.py b/pagure/lib/login.py
index a978f5d..a88fcf1 100644
--- a/pagure/lib/login.py
+++ b/pagure/lib/login.py
@@ -81,6 +81,8 @@ def retrieve_hashed_value(password, hash_value):
 def get_password(entered_password, user_password, version):
     """ Version checking and returning the password
     """
+    _, version, user_password = user_password.split('$', 2)
+
     if version == '2':
         password = retrieve_hashed_value(entered_password, user_password)
 

From 9ce0b3da0893e56ba9af6c7a4c5505e0fb26676f Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:01 +0000
Subject: [PATCH 16/79] Rename get_password to check_password and give it the seed used at first


We used to have a global seed for all the passwords, stored in the
configuration of the application. But the backend cannot access this
configuration, so it needs to be given to the function.

---

diff --git a/pagure/lib/login.py b/pagure/lib/login.py
index a88fcf1..8848bfa 100644
--- a/pagure/lib/login.py
+++ b/pagure/lib/login.py
@@ -78,7 +78,7 @@ def retrieve_hashed_value(password, hash_value):
     return bcrypt.hashpw(to_unicode(password), hash_value)
 
 
-def get_password(entered_password, user_password, version):
+def check_password(entered_password, user_password, seed=None):
     """ Version checking and returning the password
     """
     _, version, user_password = user_password.split('$', 2)
@@ -87,8 +87,7 @@ def get_password(entered_password, user_password, version):
         password = retrieve_hashed_value(entered_password, user_password)
 
     elif version == '1':
-        password = '%s%s' % (to_unicode(entered_password),
-                             APP.config.get('PASSWORD_SEED', None))
+        password = '%s%s' % (to_unicode(entered_password), seed)
         password = hashlib.sha512(password).hexdigest()
 
     else:

From b853a3aa29ea2d8262dda6246a98abb8d7726a26 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:01 +0000
Subject: [PATCH 17/79] We want to compare the password stored with the password given


But since we stored the encrypted version of the password, we need to
compare it with the encrypted version of the password given, not the
clear text version.

---

diff --git a/pagure/lib/login.py b/pagure/lib/login.py
index 8848bfa..4e17bc0 100644
--- a/pagure/lib/login.py
+++ b/pagure/lib/login.py
@@ -94,4 +94,5 @@ def check_password(entered_password, user_password, seed=None):
         flask.flash('Something went wrong')
         return flask.redirect(flask.url_for('auth_login'))
 
-    return constant_time.bytes_eq(to_bytes(entered_password), to_bytes(user_password))
+    return constant_time.bytes_eq(
+        to_bytes(password), to_bytes(user_password))

From 461e9973572a575b04b9206d29736fbe3aef3383 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:01 +0000
Subject: [PATCH 18/79] The backend cannot do anything but raise an exception if something is wrong


---

diff --git a/pagure/lib/login.py b/pagure/lib/login.py
index 4e17bc0..9657369 100644
--- a/pagure/lib/login.py
+++ b/pagure/lib/login.py
@@ -91,8 +91,9 @@ def check_password(entered_password, user_password, seed=None):
         password = hashlib.sha512(password).hexdigest()
 
     else:
-        flask.flash('Something went wrong')
-        return flask.redirect(flask.url_for('auth_login'))
+        raise pagure.exceptions.PagureException(
+            'Password of unknown version found in the database'
+        )
 
     return constant_time.bytes_eq(
         to_bytes(password), to_bytes(user_password))

From 2634a43551c1b678afcf5ed5610de2ee44328c5e Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:01 +0000
Subject: [PATCH 19/79] Let's make sure we have at least two '$' before doing the split


This will ensure we are not going to run into an exception:
ValueError: need more than X values to unpack

---

diff --git a/pagure/lib/login.py b/pagure/lib/login.py
index 9657369..c38f32c 100644
--- a/pagure/lib/login.py
+++ b/pagure/lib/login.py
@@ -81,6 +81,11 @@ def retrieve_hashed_value(password, hash_value):
 def check_password(entered_password, user_password, seed=None):
     """ Version checking and returning the password
     """
+    if not user_password.count('$') >= 2:
+        raise pagure.exceptions.PagureException(
+            'Password of unknown version found in the database'
+        )
+
     _, version, user_password = user_password.split('$', 2)
 
     if version == '2':

From 7da30cd11c001ae60be51939f190d8845504f24b Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:01 +0000
Subject: [PATCH 20/79] Adjust the login controller to the change made to the backend library


- Raises an exception for invalid passwords
- Split is done in the backend directly
- Adjust the error messages returned to the user

---

diff --git a/pagure/ui/login.py b/pagure/ui/login.py
index e5f0d4d..ec54d5e 100644
--- a/pagure/ui/login.py
+++ b/pagure/ui/login.py
@@ -100,10 +100,17 @@ def do_login():
     if form.validate_on_submit():
         username = form.username.data
         user_obj = pagure.lib.search_user(SESSION, username=username)
-        _, version, user_password = user_obj.password.split('$', 2)
 
-        if not user_obj or not get_password(form.password.data, user_password, version):
+        try:
+            password_checks = check_password(
+                form.old_password.data, user_obj.password,
+                seed=APP.config.get('PASSWORD_SEED', None))
+        except pagure.exceptions.PagureException as err:
+            APP.logger.exception(err)
+            flask.flash('Username or password of invalid format.', 'error')
+            return flask.redirect(flask.url_for('auth_login'))
 
+        if not user_obj or not password_checks:
             flask.flash('Username or password invalid.', 'error')
             return flask.redirect(flask.url_for('auth_login'))
 
@@ -112,9 +119,10 @@ def do_login():
                 'Invalid user, did you confirm the creation with the url '
                 'provided by email?', 'error')
             return flask.redirect(flask.url_for('auth_login'))
+
         else:
 
-            if version != '2':
+            if not user_obj.password.startswith('$2$'):
                 user_obj.password = generate_hashed_value(form.password.data)
                 SESSION.add(user_obj)
 
@@ -274,22 +282,32 @@ def change_password(username):
     """
     form = forms.ChangePasswordForm()
     user_obj = pagure.lib.search_user(SESSION, username=username)
-    _, version, user_password = user_obj.password.split('$', 2)
 
     if not user_obj:
         flask.flash('No user associated with this username.', 'error')
         return flask.redirect(flask.url_for('auth_login'))
+
     if form.validate_on_submit():
 
-        if get_password(form.old_password.data, user_password, version):
+        try:
+            password_checks = check_password(
+                form.old_password.data, user_obj.password,
+                seed=APP.config.get('PASSWORD_SEED', None))
+        except pagure.exceptions.PagureException as err:
+            APP.logger.exception(err)
+            flask.flash(
+                'Could not update your password, either user or password '
+                'could not be checked', 'error')
+            return flask.redirect(flask.url_for('auth_login'))
 
+        if password_checks:
             user_obj.password = generate_hashed_value(form.password.data)
             SESSION.add(user_obj)
 
         else:
             flask.flash(
-                'Invalid user, old password does not match',
-                'error')
+                'Could not update your password, either user or password '
+                'could not be checked', 'error')
             return flask.redirect(flask.url_for('auth_login'))
 
         try:

From 3e58b0cfad43660f0c11820aeaa413c76cf6dd02 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:01 +0000
Subject: [PATCH 21/79] Start working on the new unit-tests for pagure.lib.login


These tests start to test the code from Farhaan to improve the status of
local accounts.

---

diff --git a/tests/test_progit_lib_login.py b/tests/test_progit_lib_login.py
index ee5431e..cd676e4 100644
--- a/tests/test_progit_lib_login.py
+++ b/tests/test_progit_lib_login.py
@@ -48,6 +48,27 @@ class PagureLibLogintests(tests.Modeltests):
         session = pagure.lib.login.get_session_by_visitkey(self.session, 'foo')
         self.assertEqual(session, None)
 
+    def test_generate_hashed_value(self):
+        ''' Test pagure.lib.login.generate_hashed_value. '''
+        password = pagure.lib.login.generate_hashed_value('foo')
+        self.assertTrue(password.startswith('$2$'))
+        self.assertEqual(len(password), 63)
+
+    def test_retrieve_hashed_value(self):
+        ''' Test pagure.lib.login.retrieve_hashed_value. '''
+
+        password = pagure.lib.login.generate_hashed_value('foo')
+        foo = pagure.lib.login.retrieve_hashed_value('foo', password[3:])
+        self.assertNotEqual(foo, None)
+
+    def test_check_password(self):
+        ''' Test pagure.lib.login.check_password. '''
+
+        password = pagure.lib.login.generate_hashed_value('foo')
+        self.assertTrue(
+            pagure.lib.login.check_password('foo', password)
+        )
+
 
 if __name__ == '__main__':
     SUITE = unittest.TestLoader().loadTestsFromTestCase(PagureLibLogintests)

From 4166a2d33215a7afbc648165bfe9898983816b8f Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 15:21:01 +0000
Subject: [PATCH 22/79] Fix import issue and redundant code


---

diff --git a/pagure/lib/login.py b/pagure/lib/login.py
index c38f32c..663ea4d 100644
--- a/pagure/lib/login.py
+++ b/pagure/lib/login.py
@@ -72,12 +72,6 @@ def generate_hashed_value(password):
     return '$2$' + bcrypt.hashpw(to_unicode(password), bcrypt.gensalt())
 
 
-def retrieve_hashed_value(password, hash_value):
-    """ Retrieve hash value to compare
-    """
-    return bcrypt.hashpw(to_unicode(password), hash_value)
-
-
 def check_password(entered_password, user_password, seed=None):
     """ Version checking and returning the password
     """
@@ -89,7 +83,7 @@ def check_password(entered_password, user_password, seed=None):
     _, version, user_password = user_password.split('$', 2)
 
     if version == '2':
-        password = retrieve_hashed_value(entered_password, user_password)
+        password = bcrypt.hashpw(to_unicode(entered_password), user_password)
 
     elif version == '1':
         password = '%s%s' % (to_unicode(entered_password), seed)
diff --git a/pagure/ui/login.py b/pagure/ui/login.py
index ec54d5e..9b0f855 100644
--- a/pagure/ui/login.py
+++ b/pagure/ui/login.py
@@ -24,7 +24,7 @@ import pagure.lib.login
 import pagure.lib.model as model
 import pagure.lib.notify
 from pagure import APP, SESSION
-from pagure.lib.login import generate_hashed_value, retrieve_hashed_value, get_password
+from pagure.lib.login import generate_hashed_value, check_password
 
 # pylint: disable=E1101
 

From 0b1c13b538571d39227fbca919310a6dc9562e22 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:01 +0000
Subject: [PATCH 23/79] Add the squeleton for unit-testing the local login controller


---

diff --git a/tests/test_pagure_flask_ui_login.py b/tests/test_pagure_flask_ui_login.py
new file mode 100644
index 0000000..4cf45c6
--- /dev/null
+++ b/tests/test_pagure_flask_ui_login.py
@@ -0,0 +1,51 @@
+# -*- coding: utf-8 -*-
+
+"""
+ (c) 2016 - Copyright Red Hat Inc
+
+ Authors:
+   Pierre-Yves Chibon <pingou@pingoured.fr>
+
+"""
+
+__requires__ = ['SQLAlchemy >= 0.8']
+import pkg_resources
+
+import datetime
+import json
+import unittest
+import shutil
+import sys
+import tempfile
+import os
+
+import pygit2
+from mock import patch
+
+sys.path.insert(0, os.path.join(os.path.dirname(
+    os.path.abspath(__file__)), '..'))
+
+import pagure.lib
+import tests
+from pagure.lib.repo import PagureRepo
+
+
+class PagureFlaskLogintests(tests.Modeltests):
+    """ Tests for flask app controller of pagure """
+
+    def setUp(self):
+        """ Set up the environnment, ran before every tests. """
+        super(PagureFlaskLogintests, self).setUp()
+
+        pagure.APP.config['TESTING'] = True
+        pagure.APP.config['EMAIL_SEND'] = True
+        pagure.SESSION = self.session
+        pagure.ui.SESSION = self.session
+        pagure.ui.login.SESSION = self.session
+
+        self.app = pagure.APP.test_client()
+
+
+if __name__ == '__main__':
+    SUITE = unittest.TestLoader().loadTestsFromTestCase(PagureFlaskLogintests)
+    unittest.TextTestRunner(verbosity=2).run(SUITE)

From 250169fc6bb05da7d33a192b5b04655863ea4db0 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:02 +0000
Subject: [PATCH 24/79] Make sure we enforce local auth otherwise it'll be hard


---

diff --git a/tests/test_pagure_flask_ui_login.py b/tests/test_pagure_flask_ui_login.py
index 4cf45c6..ed0ad95 100644
--- a/tests/test_pagure_flask_ui_login.py
+++ b/tests/test_pagure_flask_ui_login.py
@@ -39,6 +39,7 @@ class PagureFlaskLogintests(tests.Modeltests):
 
         pagure.APP.config['TESTING'] = True
         pagure.APP.config['EMAIL_SEND'] = True
+        pagure.APP.config['PAGURE_AUTH'] = 'local'
         pagure.SESSION = self.session
         pagure.ui.SESSION = self.session
         pagure.ui.login.SESSION = self.session

From b94671cc3615c9c2cff58e4c3e86a43baf7bc6db Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:02 +0000
Subject: [PATCH 25/79] Add the first tests for the new_user endpoint


---

diff --git a/tests/test_pagure_flask_ui_login.py b/tests/test_pagure_flask_ui_login.py
index ed0ad95..6284bf2 100644
--- a/tests/test_pagure_flask_ui_login.py
+++ b/tests/test_pagure_flask_ui_login.py
@@ -25,10 +25,13 @@ from mock import patch
 sys.path.insert(0, os.path.join(os.path.dirname(
     os.path.abspath(__file__)), '..'))
 
+
 import pagure.lib
 import tests
 from pagure.lib.repo import PagureRepo
 
+import pagure.ui.login
+
 
 class PagureFlaskLogintests(tests.Modeltests):
     """ Tests for flask app controller of pagure """
@@ -46,6 +49,63 @@ class PagureFlaskLogintests(tests.Modeltests):
 
         self.app = pagure.APP.test_client()
 
+    def test_new_user(self):
+        """ Test the new_user endpoint. """
+
+        # Check before:
+        items = pagure.lib.search_user(self.session)
+        self.assertEqual(2, len(items))
+
+        # First access the new user page
+        output = self.app.get('/user/new')
+        self.assertEqual(output.status_code, 200)
+        self.assertIn('<title>New user - Pagure</title>', output.data)
+        self.assertIn(
+            '<form action="/user/new" method="post">', output.data)
+
+        # Create the form to send there
+
+        # This has all the data needed
+        data = {
+            'user': 'foo',
+            'fullname': 'user foo',
+            'email_address': 'foo@example.com',
+            'password': 'barpass',
+            'confirm_password': 'barpass',
+        }
+
+        # Submit this form  -  Doesn't work since there is no csrf token
+        output = self.app.post('/user/new', data=data)
+        self.assertEqual(output.status_code, 200)
+        self.assertIn('<title>New user - Pagure</title>', output.data)
+        self.assertIn(
+            '<form action="/user/new" method="post">', output.data)
+
+        csrf_token = output.data.split(
+                'name="csrf_token" type="hidden" value="')[1].split('">')[0]
+
+        # Submit the form with the csrf token
+        data['csrf_token'] = csrf_token
+        output = self.app.post('/user/new', data=data, follow_redirects=True)
+        self.assertEqual(output.status_code, 200)
+        self.assertIn('<title>New user - Pagure</title>', output.data)
+        self.assertIn(
+            '<form action="/user/new" method="post">', output.data)
+        self.assertIn('Username already taken.', output.data)
+
+        # Submit the form with another user name
+        data['user'] = 'foouser'
+        output = self.app.post('/user/new', data=data, follow_redirects=True)
+        self.assertEqual(output.status_code, 200)
+        self.assertIn('<title>Login - Pagure</title>', output.data)
+        self.assertIn(
+            'User created, please check your email to activate the account',
+            output.data)
+
+        # Check after:
+        items = pagure.lib.search_user(self.session)
+        self.assertEqual(3, len(items))
+
 
 if __name__ == '__main__':
     SUITE = unittest.TestLoader().loadTestsFromTestCase(PagureFlaskLogintests)

From 82c87f843a954b929001cf629c65509697684607 Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 15:21:02 +0000
Subject: [PATCH 26/79] Fix test in lib_login


---

diff --git a/tests/test_progit_lib_login.py b/tests/test_progit_lib_login.py
index cd676e4..d64c22f 100644
--- a/tests/test_progit_lib_login.py
+++ b/tests/test_progit_lib_login.py
@@ -54,13 +54,6 @@ class PagureLibLogintests(tests.Modeltests):
         self.assertTrue(password.startswith('$2$'))
         self.assertEqual(len(password), 63)
 
-    def test_retrieve_hashed_value(self):
-        ''' Test pagure.lib.login.retrieve_hashed_value. '''
-
-        password = pagure.lib.login.generate_hashed_value('foo')
-        foo = pagure.lib.login.retrieve_hashed_value('foo', password[3:])
-        self.assertNotEqual(foo, None)
-
     def test_check_password(self):
         ''' Test pagure.lib.login.check_password. '''
 

From 5f96cdc9501bdef8a17363e4d07973ae90fad08c Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:02 +0000
Subject: [PATCH 27/79] Add test for when someone creates an account for an existing email


---

diff --git a/tests/test_pagure_flask_ui_login.py b/tests/test_pagure_flask_ui_login.py
index 6284bf2..24da8fb 100644
--- a/tests/test_pagure_flask_ui_login.py
+++ b/tests/test_pagure_flask_ui_login.py
@@ -69,7 +69,7 @@ class PagureFlaskLogintests(tests.Modeltests):
         data = {
             'user': 'foo',
             'fullname': 'user foo',
-            'email_address': 'foo@example.com',
+            'email_address': 'foo@bar.com',
             'password': 'barpass',
             'confirm_password': 'barpass',
         }
@@ -93,10 +93,17 @@ class PagureFlaskLogintests(tests.Modeltests):
             '<form action="/user/new" method="post">', output.data)
         self.assertIn('Username already taken.', output.data)
 
-        # Submit the form with another user name
+        # Submit the form with another username
         data['user'] = 'foouser'
         output = self.app.post('/user/new', data=data, follow_redirects=True)
         self.assertEqual(output.status_code, 200)
+        self.assertIn('<title>New user - Pagure</title>', output.data)
+        self.assertIn('Email address already taken.', output.data)
+
+        # Submit the form with proper data
+        data['email_address'] = 'foo@example.com'
+        output = self.app.post('/user/new', data=data, follow_redirects=True)
+        self.assertEqual(output.status_code, 200)
         self.assertIn('<title>Login - Pagure</title>', output.data)
         self.assertIn(
             'User created, please check your email to activate the account',

From e15dd4612a5f6738af255aff21e0b62ce2ee9a3a Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:02 +0000
Subject: [PATCH 28/79] Let's ignore the lines we cannot test


---

diff --git a/pagure/ui/login.py b/pagure/ui/login.py
index 9b0f855..2948436 100644
--- a/pagure/ui/login.py
+++ b/pagure/ui/login.py
@@ -72,7 +72,7 @@ def new_user():
             flask.flash(
                 'User created, please check your email to activate the '
                 'account')
-        except SQLAlchemyError as err:
+        except SQLAlchemyError as err:  # pragma: no cover
             SESSION.rollback()
             flask.flash('Could not create user.')
             APP.logger.debug('Could not create user.')
@@ -211,7 +211,7 @@ def lost_password():
             send_lostpassword_email(user_obj)
             flask.flash(
                 'Check your email to finish changing your password')
-        except SQLAlchemyError as err:
+        except SQLAlchemyError as err:  # pragma: no cover
             SESSION.rollback()
             flask.flash(
                 'Could not set the token allowing changing a password.',
@@ -255,7 +255,7 @@ def reset_password(token):
             SESSION.commit()
             flask.flash(
                 'Password changed')
-        except SQLAlchemyError as err:
+        except SQLAlchemyError as err:  # pragma: no cover
             SESSION.rollback()
             flask.flash('Could not set the new password.', 'error')
             APP.logger.debug(
@@ -314,7 +314,7 @@ def change_password(username):
             SESSION.commit()
             flask.flash(
                 'Password changed')
-        except SQLAlchemyError as err:
+        except SQLAlchemyError as err:  # pragma: no cover
             SESSION.rollback()
             flask.flash('Could not set the new password.', 'error')
             APP.logger.debug(

From 0a64a504bdb265df096db26edeaffb44fea0aa10 Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 15:21:02 +0000
Subject: [PATCH 29/79] Fix hashlib import and version 1 test for password


---

diff --git a/tests/test_progit_lib_login.py b/tests/test_progit_lib_login.py
index d64c22f..ea4a37e 100644
--- a/tests/test_progit_lib_login.py
+++ b/tests/test_progit_lib_login.py
@@ -23,6 +23,8 @@ sys.path.insert(0, os.path.join(os.path.dirname(
 
 import pagure.lib
 import pagure.lib.login
+import hashlib
+from pagure import APP
 import tests
 
 
@@ -61,7 +63,11 @@ class PagureLibLogintests(tests.Modeltests):
         self.assertTrue(
             pagure.lib.login.check_password('foo', password)
         )
-
+        password = '%s%s' % ('foo', APP.config.get('PASSWORD_SEED', None))
+        password = '$1$'+hashlib.sha512(password).hexdigest()
+        self.assertTrue(
+             pagure.lib.login.check_password('foo', password)
+        )
 
 if __name__ == '__main__':
     SUITE = unittest.TestLoader().loadTestsFromTestCase(PagureLibLogintests)

From 355681fd042f4b7867f0fe83f5fe5fef04f07d8e Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 15:21:02 +0000
Subject: [PATCH 30/79] Fix all tests in lib


---

diff --git a/pagure/lib/login.py b/pagure/lib/login.py
index 663ea4d..553886e 100644
--- a/pagure/lib/login.py
+++ b/pagure/lib/login.py
@@ -12,6 +12,8 @@ import random
 import string
 import bcrypt
 
+import hashlib
+import pagure
 from pagure.lib import model
 from kitchen.text.converters import to_unicode, to_bytes
 from cryptography.hazmat.primitives import constant_time
diff --git a/tests/test_progit_lib_login.py b/tests/test_progit_lib_login.py
index ea4a37e..4edae54 100644
--- a/tests/test_progit_lib_login.py
+++ b/tests/test_progit_lib_login.py
@@ -22,6 +22,7 @@ sys.path.insert(0, os.path.join(os.path.dirname(
     os.path.abspath(__file__)), '..'))
 
 import pagure.lib
+from pagure.exceptions import PagureException
 import pagure.lib.login
 import hashlib
 from pagure import APP
@@ -64,10 +65,17 @@ class PagureLibLogintests(tests.Modeltests):
             pagure.lib.login.check_password('foo', password)
         )
         password = '%s%s' % ('foo', APP.config.get('PASSWORD_SEED', None))
-        password = '$1$'+hashlib.sha512(password).hexdigest()
+        password = '$1$' + hashlib.sha512(password).hexdigest()
         self.assertTrue(
-             pagure.lib.login.check_password('foo', password)
+            pagure.lib.login.check_password('foo', password)
         )
+        password = '%s%s' % ('foo', APP.config.get('PASSWORD_SEED', None))
+        password = hashlib.sha512(password).hexdigest()
+        with self.assertRaises(PagureException):
+            pagure.lib.login.check_password('foo', password)
+        password = '$3$' + password
+        with self.assertRaises(PagureException):
+            pagure.lib.login.check_password('foo', password)
 
 if __name__ == '__main__':
     SUITE = unittest.TestLoader().loadTestsFromTestCase(PagureLibLogintests)

From a1412f5f577dd2d728bd26572fd66e4edbdb4c03 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:02 +0000
Subject: [PATCH 31/79] Improve the lib.login tests


- Add a little bit of documentation in the tests
- Test that password match when they should and don't match when they should
- Be consistent in the way we check for exceptions

---

diff --git a/tests/test_progit_lib_login.py b/tests/test_progit_lib_login.py
index 4edae54..7ad9c60 100644
--- a/tests/test_progit_lib_login.py
+++ b/tests/test_progit_lib_login.py
@@ -60,22 +60,36 @@ class PagureLibLogintests(tests.Modeltests):
     def test_check_password(self):
         ''' Test pagure.lib.login.check_password. '''
 
+        # Version 2
         password = pagure.lib.login.generate_hashed_value('foo')
         self.assertTrue(
-            pagure.lib.login.check_password('foo', password)
-        )
+            pagure.lib.login.check_password('foo', password))
+        self.assertFalse(
+            pagure.lib.login.check_password('bar', password))
+
+        # Version 1
         password = '%s%s' % ('foo', APP.config.get('PASSWORD_SEED', None))
         password = '$1$' + hashlib.sha512(password).hexdigest()
-        self.assertTrue(
-            pagure.lib.login.check_password('foo', password)
-        )
+        self.assertTrue(pagure.lib.login.check_password('foo', password))
+        self.assertFalse(pagure.lib.login.check_password('bar', password))
+
+        # Invalid password  -  No version
         password = '%s%s' % ('foo', APP.config.get('PASSWORD_SEED', None))
         password = hashlib.sha512(password).hexdigest()
-        with self.assertRaises(PagureException):
-            pagure.lib.login.check_password('foo', password)
+        self.assertRaises(
+            PagureException,
+            pagure.lib.login.check_password,
+            'foo', password
+        )
+
+        # Invalid password  -  Invalid version
         password = '$3$' + password
-        with self.assertRaises(PagureException):
-            pagure.lib.login.check_password('foo', password)
+        self.assertRaises(
+            PagureException,
+            pagure.lib.login.check_password,
+            'foo',
+            password
+        )
 
 if __name__ == '__main__':
     SUITE = unittest.TestLoader().loadTestsFromTestCase(PagureLibLogintests)

From 3e373be118076ec5f595d462190e7c80bd8251c7 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:02 +0000
Subject: [PATCH 32/79] The login form has only a password field not an old_password one


---

diff --git a/pagure/ui/login.py b/pagure/ui/login.py
index 2948436..09f4f66 100644
--- a/pagure/ui/login.py
+++ b/pagure/ui/login.py
@@ -103,7 +103,7 @@ def do_login():
 
         try:
             password_checks = check_password(
-                form.old_password.data, user_obj.password,
+                form.password.data, user_obj.password,
                 seed=APP.config.get('PASSWORD_SEED', None))
         except pagure.exceptions.PagureException as err:
             APP.logger.exception(err)

From aad311acbbab7805513ae2f57231fecb44d14df7 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:02 +0000
Subject: [PATCH 33/79] If there is no user associated with the username provided, bail out


---

diff --git a/pagure/ui/login.py b/pagure/ui/login.py
index 09f4f66..da14423 100644
--- a/pagure/ui/login.py
+++ b/pagure/ui/login.py
@@ -100,6 +100,9 @@ def do_login():
     if form.validate_on_submit():
         username = form.username.data
         user_obj = pagure.lib.search_user(SESSION, username=username)
+        if not user_obj:
+            flask.flash('Username or password invalid.', 'error')
+            return flask.redirect(flask.url_for('auth_login'))
 
         try:
             password_checks = check_password(

From a4c6663052571c5055b4faa3afcec1bf56d6f2db Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:02 +0000
Subject: [PATCH 34/79] Start writing unit-tests for the do_login endpoint


---

diff --git a/tests/test_pagure_flask_ui_login.py b/tests/test_pagure_flask_ui_login.py
index 24da8fb..cdcd668 100644
--- a/tests/test_pagure_flask_ui_login.py
+++ b/tests/test_pagure_flask_ui_login.py
@@ -113,6 +113,58 @@ class PagureFlaskLogintests(tests.Modeltests):
         items = pagure.lib.search_user(self.session)
         self.assertEqual(3, len(items))
 
+    def test_do_login(self):
+        """ Test the do_login endpoint. """
+
+        output = self.app.get('/login/')
+        self.assertEqual(output.status_code, 200)
+        self.assertIn('<title>Login - Pagure</title>', output.data)
+        self.assertIn(
+            '<form action="/dologin" method="post">', output.data)
+
+        # This has all the data needed
+        data = {
+            'username': 'foouser',
+            'password': 'barpass',
+        }
+
+        # Submit this form  -  Doesn't work since there is no csrf token
+        output = self.app.post('/dologin', data=data, follow_redirects=True)
+        self.assertEqual(output.status_code, 200)
+        self.assertIn('<title>Login - Pagure</title>', output.data)
+        self.assertIn(
+            '<form action="/dologin" method="post">', output.data)
+        self.assertIn('Insufficient information provided', output.data)
+
+        csrf_token = output.data.split(
+                'name="csrf_token" type="hidden" value="')[1].split('">')[0]
+
+        # Submit the form with the csrf token  -  but invalid user
+        data['csrf_token'] = csrf_token
+        output = self.app.post('/dologin', data=data, follow_redirects=True)
+        self.assertEqual(output.status_code, 200)
+        self.assertIn('<title>Login - Pagure</title>', output.data)
+        self.assertIn(
+            '<form action="/dologin" method="post">', output.data)
+        self.assertIn('Username or password invalid.', output.data)
+
+        # Create a local user
+        self.test_new_user()
+
+        items = pagure.lib.search_user(self.session)
+        self.assertEqual(3, len(items))
+
+        # Submit the form with the csrf token  -  but invalid user
+        data['csrf_token'] = csrf_token
+        output = self.app.post('/dologin', data=data, follow_redirects=True)
+        self.assertEqual(output.status_code, 200)
+        self.assertIn('<title>Login - Pagure</title>', output.data)
+        self.assertIn(
+            '<form action="/dologin" method="post">', output.data)
+        self.assertIn(
+            'Invalid user, did you confirm the creation with the url '
+            'provided by email?', output.data)
+
 
 if __name__ == '__main__':
     SUITE = unittest.TestLoader().loadTestsFromTestCase(PagureFlaskLogintests)

From fa9239ca3ead1853596a18cd6bf0e1d971bb9ab3 Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 15:21:02 +0000
Subject: [PATCH 35/79] Add wrong password check


---

diff --git a/tests/test_pagure_flask_ui_login.py b/tests/test_pagure_flask_ui_login.py
index cdcd668..c7ceaa2 100644
--- a/tests/test_pagure_flask_ui_login.py
+++ b/tests/test_pagure_flask_ui_login.py
@@ -165,6 +165,17 @@ class PagureFlaskLogintests(tests.Modeltests):
             'Invalid user, did you confirm the creation with the url '
             'provided by email?', output.data)
 
+        # Wrong password submitted
+        data['password'] = 'password'
+        output = self.app.post('/dologin', data=data, follow_redirects=True)
+        self.assertEqual(output.status_code, 200)
+        self.assertIn('<title>Login - Pagure</title>', output.data)
+        self.assertIn(
+            '<form action="/dologin" method="post">', output.data)
+        self.assertIn('Username or password invalid.', output.data)
+
+
+
 
 if __name__ == '__main__':
     SUITE = unittest.TestLoader().loadTestsFromTestCase(PagureFlaskLogintests)

From 66f5d8ad0ba2d087051c8d74438fb7e39861ec7e Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 15:21:02 +0000
Subject: [PATCH 36/79] Add test when csrf token is not verified


---

diff --git a/tests/test_pagure_flask_ui_login.py b/tests/test_pagure_flask_ui_login.py
index c7ceaa2..3709426 100644
--- a/tests/test_pagure_flask_ui_login.py
+++ b/tests/test_pagure_flask_ui_login.py
@@ -174,7 +174,16 @@ class PagureFlaskLogintests(tests.Modeltests):
             '<form action="/dologin" method="post">', output.data)
         self.assertIn('Username or password invalid.', output.data)
 
-
+        # When account is not confirmed i.e user_obj != None
+        data['password'] = 'barpass'
+        output = self.app.post('/dologin', data=data, follow_redirects=True)
+        self.assertEqual(output.status_code, 200)
+        self.assertIn('<title>Login - Pagure</title>', output.data)
+        self.assertIn(
+            '<form action="/dologin" method="post">', output.data)
+        self.assertIn(
+            'Invalid user, did you confirm the creation with the url '
+            'provided by email?', output.data)
 
 
 if __name__ == '__main__':

From f362a3989425c436a58c6e330e8482048bb49229 Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 15:21:02 +0000
Subject: [PATCH 37/79] Add a change password link for local auth


---

diff --git a/pagure/templates/login/password_change.html b/pagure/templates/login/password_change.html
index bef3946..26a5836 100644
--- a/pagure/templates/login/password_change.html
+++ b/pagure/templates/login/password_change.html
@@ -1,6 +1,7 @@
 {% extends "master.html" %}
 {% from "_formhelper.html" import render_bootstrap_field %}
 
+<<<<<<< HEAD
 {% block title %}Lost password{% endblock %}
 {% set tag = "home" %}
 
@@ -25,5 +26,27 @@
     </div>
   </div>
 </div>
+=======
+{% block title %}Change password{% endblock %}
+{%block tag %}home{% endblock %}
+
+{% block content %}
+<h2>Change password</h2>
+
+<form action="{{ url_for('change_password', username=g.fas_user.username) }}" method="POST">
+  <table>
+    {{ render_field_in_row(form.old_password) }}
+    {{ render_field_in_row(form.password) }}
+    {{ render_field_in_row(form.confirm_password) }}
+  </table>
+  <p class="buttons indent">
+    <input type="submit" class="submit positive button" value="Update">
+    <a href="{{ url_for('index') }}">
+      <input type="button" value="Cancel" class="button">
+    </a>
+    {{ form.csrf_token }}
+  </p>
+</form>
+>>>>>>> Add a change password link for local auth
 
 {% endblock %}
diff --git a/pagure/templates/user_settings.html b/pagure/templates/user_settings.html
index 0ff9e40..717453a 100644
--- a/pagure/templates/user_settings.html
+++ b/pagure/templates/user_settings.html
@@ -38,6 +38,7 @@
 
 
 {% block content %}
+<<<<<<< HEAD
 <div class="container p-t-3">
   <div class="col-md-8 col-md-offset-2">
     <div class="card m-b-3">
@@ -64,6 +65,26 @@
             </a>
       </div>
       <div class="list-group list-group-flush">
+=======
+<section class="user_settings">
+    <header>
+        <h2>{{ user.user }}'s settings</h2>
+    </header>
+    <table>
+      <tr>
+        <th>Full name</th>
+        <td> {{ user.fullname }} </td>
+      </tr>
+      <tr>
+        <td>
+            {% if config.get('PAGURE_AUTH')=='local' %}
+                <a href="{{ url_for('change_password', username=g.fas_user.username) }}">Change password</a>
+            {% endif %}
+        </td>
+     </tr>
+      <tr>
+        <th>Emails</th>
+>>>>>>> Add a change password link for local auth
         {% for email in user.emails %}
           {{ render_email(email, form) }}
         {% endfor %}

From 952360cdfd0130b8c595d1395e266cf34cb744f6 Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 15:21:02 +0000
Subject: [PATCH 38/79] Add bcrypt method for password storing


---

diff --git a/pagure/templates/login/password_change.html b/pagure/templates/login/password_change.html
index 26a5836..bef3946 100644
--- a/pagure/templates/login/password_change.html
+++ b/pagure/templates/login/password_change.html
@@ -1,7 +1,6 @@
 {% extends "master.html" %}
 {% from "_formhelper.html" import render_bootstrap_field %}
 
-<<<<<<< HEAD
 {% block title %}Lost password{% endblock %}
 {% set tag = "home" %}
 
@@ -26,27 +25,5 @@
     </div>
   </div>
 </div>
-=======
-{% block title %}Change password{% endblock %}
-{%block tag %}home{% endblock %}
-
-{% block content %}
-<h2>Change password</h2>
-
-<form action="{{ url_for('change_password', username=g.fas_user.username) }}" method="POST">
-  <table>
-    {{ render_field_in_row(form.old_password) }}
-    {{ render_field_in_row(form.password) }}
-    {{ render_field_in_row(form.confirm_password) }}
-  </table>
-  <p class="buttons indent">
-    <input type="submit" class="submit positive button" value="Update">
-    <a href="{{ url_for('index') }}">
-      <input type="button" value="Cancel" class="button">
-    </a>
-    {{ form.csrf_token }}
-  </p>
-</form>
->>>>>>> Add a change password link for local auth
 
 {% endblock %}
diff --git a/pagure/templates/login/password_recover.html b/pagure/templates/login/password_recover.html
index a61a452..2b22488 100644
--- a/pagure/templates/login/password_recover.html
+++ b/pagure/templates/login/password_recover.html
@@ -5,6 +5,7 @@
 {%block tag %}home{% endblock %}
 
 {% block content %}
+<<<<<<< HEAD
 <div class="container">
   <div class="row">
     <div class="col-md-8 col-md-offset-2">
diff --git a/pagure/ui/login.py b/pagure/ui/login.py
index da14423..e0c045d 100644
--- a/pagure/ui/login.py
+++ b/pagure/ui/login.py
@@ -13,7 +13,6 @@ import hashlib
 import datetime
 import urlparse
 import bcrypt
-from kitchen.text.converters import to_unicode, to_bytes
 
 import flask
 from sqlalchemy.exc import SQLAlchemyError

From fa5395ea0a9e36f5795c6f2a8d9e27ac125a3937 Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 15:21:02 +0000
Subject: [PATCH 39/79] Add requirement and ensuring backward compatibility


---

diff --git a/pagure/templates/login/password_recover.html b/pagure/templates/login/password_recover.html
index 2b22488..310163d 100644
--- a/pagure/templates/login/password_recover.html
+++ b/pagure/templates/login/password_recover.html
@@ -5,7 +5,7 @@
 {%block tag %}home{% endblock %}
 
 {% block content %}
-<<<<<<< HEAD
+
 <div class="container">
   <div class="row">
     <div class="col-md-8 col-md-offset-2">
diff --git a/pagure/templates/user_settings.html b/pagure/templates/user_settings.html
index 717453a..0ff9e40 100644
--- a/pagure/templates/user_settings.html
+++ b/pagure/templates/user_settings.html
@@ -38,7 +38,6 @@
 
 
 {% block content %}
-<<<<<<< HEAD
 <div class="container p-t-3">
   <div class="col-md-8 col-md-offset-2">
     <div class="card m-b-3">
@@ -65,26 +64,6 @@
             </a>
       </div>
       <div class="list-group list-group-flush">
-=======
-<section class="user_settings">
-    <header>
-        <h2>{{ user.user }}'s settings</h2>
-    </header>
-    <table>
-      <tr>
-        <th>Full name</th>
-        <td> {{ user.fullname }} </td>
-      </tr>
-      <tr>
-        <td>
-            {% if config.get('PAGURE_AUTH')=='local' %}
-                <a href="{{ url_for('change_password', username=g.fas_user.username) }}">Change password</a>
-            {% endif %}
-        </td>
-     </tr>
-      <tr>
-        <th>Emails</th>
->>>>>>> Add a change password link for local auth
         {% for email in user.emails %}
           {{ render_email(email, form) }}
         {% endfor %}
diff --git a/pagure/ui/login.py b/pagure/ui/login.py
index e0c045d..6343233 100644
--- a/pagure/ui/login.py
+++ b/pagure/ui/login.py
@@ -119,6 +119,7 @@ def do_login():
         elif user_obj.token:
             flask.flash(
                 'Invalid user, did you confirm the creation with the url '
+
                 'provided by email?', 'error')
             return flask.redirect(flask.url_for('auth_login'))
 
@@ -248,6 +249,7 @@ def reset_password(token):
 
     if form.validate_on_submit():
 
+
         user_obj.password = generate_hashed_value(form.password.data)
 
         user_obj.token = None

From df24133eb0ed1c13759f796186406fd57c8ab364 Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 15:21:02 +0000
Subject: [PATCH 40/79] Add constant time function


---

diff --git a/pagure/ui/login.py b/pagure/ui/login.py
index 6343233..dc316db 100644
--- a/pagure/ui/login.py
+++ b/pagure/ui/login.py
@@ -13,6 +13,8 @@ import hashlib
 import datetime
 import urlparse
 import bcrypt
+from kitchen.text.converters import to_unicode
+from cryptography.hazmat.primitives import constant_time
 
 import flask
 from sqlalchemy.exc import SQLAlchemyError
@@ -119,7 +121,6 @@ def do_login():
         elif user_obj.token:
             flask.flash(
                 'Invalid user, did you confirm the creation with the url '
-
                 'provided by email?', 'error')
             return flask.redirect(flask.url_for('auth_login'))
 

From 7f16f7719fd85795312b2484791c11d37424edcd Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 15:21:02 +0000
Subject: [PATCH 41/79] Fix constant tim function and different way of handling versions


---

diff --git a/pagure/ui/login.py b/pagure/ui/login.py
index dc316db..268eaa7 100644
--- a/pagure/ui/login.py
+++ b/pagure/ui/login.py
@@ -13,7 +13,7 @@ import hashlib
 import datetime
 import urlparse
 import bcrypt
-from kitchen.text.converters import to_unicode
+from kitchen.text.converters import to_unicode, to_bytes
 from cryptography.hazmat.primitives import constant_time
 
 import flask

From 0175c56e03d2e15e75f27c46a91d86cda5e4e248 Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 15:21:02 +0000
Subject: [PATCH 42/79] Fix pep8 error and better backward compatibility


---

diff --git a/pagure/ui/login.py b/pagure/ui/login.py
index 268eaa7..4738693 100644
--- a/pagure/ui/login.py
+++ b/pagure/ui/login.py
@@ -125,7 +125,6 @@ def do_login():
             return flask.redirect(flask.url_for('auth_login'))
 
         else:
-
             if not user_obj.password.startswith('$2$'):
                 user_obj.password = generate_hashed_value(form.password.data)
                 SESSION.add(user_obj)

From b82159e77d683be7a6a3caf8f38e20882ee7f3c8 Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 15:21:02 +0000
Subject: [PATCH 43/79] Add seperate function for hashing


---

diff --git a/pagure/ui/login.py b/pagure/ui/login.py
index 4738693..be9da07 100644
--- a/pagure/ui/login.py
+++ b/pagure/ui/login.py
@@ -30,6 +30,17 @@ from pagure.lib.login import generate_hashed_value, check_password
 # pylint: disable=E1101
 
 
+def generate_hashed_value(password):
+    """ Generate hash value for password
+    """
+    return '$2$' + bcrypt.hashpw(to_unicode(password), bcrypt.gensalt())
+
+def retrive_hashed_value(password, hash_value):
+    """Retrive hash value to compare
+    """
+    return bcrypt.hashpw(to_unicode(password), hash_value)
+
+
 @APP.route('/user/new/', methods=['GET', 'POST'])
 @APP.route('/user/new', methods=['GET', 'POST'])
 def new_user():
@@ -125,7 +136,7 @@ def do_login():
             return flask.redirect(flask.url_for('auth_login'))
 
         else:
-            if not user_obj.password.startswith('$2$'):
+
                 user_obj.password = generate_hashed_value(form.password.data)
                 SESSION.add(user_obj)
 

From 59c476082c389837c7e6162896916a4cf953008e Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 15:21:02 +0000
Subject: [PATCH 44/79] Refactor and cleaning code


---

diff --git a/pagure/ui/login.py b/pagure/ui/login.py
index be9da07..d1de438 100644
--- a/pagure/ui/login.py
+++ b/pagure/ui/login.py
@@ -30,17 +30,6 @@ from pagure.lib.login import generate_hashed_value, check_password
 # pylint: disable=E1101
 
 
-def generate_hashed_value(password):
-    """ Generate hash value for password
-    """
-    return '$2$' + bcrypt.hashpw(to_unicode(password), bcrypt.gensalt())
-
-def retrive_hashed_value(password, hash_value):
-    """Retrive hash value to compare
-    """
-    return bcrypt.hashpw(to_unicode(password), hash_value)
-
-
 @APP.route('/user/new/', methods=['GET', 'POST'])
 @APP.route('/user/new', methods=['GET', 'POST'])
 def new_user():

From 924cc29d0a878f733788b45cc0b491d6d6d054b6 Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 15:21:02 +0000
Subject: [PATCH 45/79] Add fucntions in lib


---

diff --git a/pagure/ui/login.py b/pagure/ui/login.py
index d1de438..8f1978f 100644
--- a/pagure/ui/login.py
+++ b/pagure/ui/login.py
@@ -25,11 +25,16 @@ import pagure.lib.login
 import pagure.lib.model as model
 import pagure.lib.notify
 from pagure import APP, SESSION
+<<<<<<< HEAD
 from pagure.lib.login import generate_hashed_value, check_password
+=======
+from pagure.lib.login import generate_hashed_value, retrieve_hashed_value, get_password
+>>>>>>> Add fucntions in lib
 
 # pylint: disable=E1101
 
 
+
 @APP.route('/user/new/', methods=['GET', 'POST'])
 @APP.route('/user/new', methods=['GET', 'POST'])
 def new_user():
@@ -120,8 +125,8 @@ def do_login():
 
         elif user_obj.token:
             flask.flash(
-                'Invalid user, did you confirm the creation with the url '
-                'provided by email?', 'error')
+               'Invalid user, did you confirm the creation with the url '
+               'provided by email?', 'error')
             return flask.redirect(flask.url_for('auth_login'))
 
         else:
@@ -293,6 +298,8 @@ def change_password(username):
 
     if form.validate_on_submit():
 
+        old_password = get_password(form.old_password.data, user_password, version)
+
         try:
             password_checks = check_password(
                 form.old_password.data, user_obj.password,

From fa2071b37764a88eab23bb97f2c56c3299ca25b8 Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 15:21:02 +0000
Subject: [PATCH 46/79] Fix sql alchemy update


---

diff --git a/alembic/versions/1b6d7dc5600a_versioning_passwords.py b/alembic/versions/1b6d7dc5600a_versioning_passwords.py
index ff1aced..d134690 100644
--- a/alembic/versions/1b6d7dc5600a_versioning_passwords.py
+++ b/alembic/versions/1b6d7dc5600a_versioning_passwords.py
@@ -17,11 +17,10 @@ from pagure.lib import model
 
 
 def upgrade():
-    engine = op.get_bind().engine
-    session = sa.orm.scoped_session(sa.orm.sessionmaker(bind=engine))
-    session.query(model.User).update(
-        {model.User.password: '$1$' + model.User.password}, synchronize_session=False)
-    session.commit()
+        engine = op.get_bind().engine
+        session = sa.orm.scoped_session(sa.orm.sessionmaker(bind=engine))
+        session.query(model.User).update({model.User.password: '$1$' + model.User.password}, synchronize_session=False);
+        session.commit()
 
 
 def downgrade():

From fa5c9a00f43e877b44ec083f1fc243a1c697e49d Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 15:21:02 +0000
Subject: [PATCH 47/79] Cleaning up and implementing pep8 standards


---

diff --git a/alembic/versions/1b6d7dc5600a_versioning_passwords.py b/alembic/versions/1b6d7dc5600a_versioning_passwords.py
index d134690..ff1aced 100644
--- a/alembic/versions/1b6d7dc5600a_versioning_passwords.py
+++ b/alembic/versions/1b6d7dc5600a_versioning_passwords.py
@@ -17,10 +17,11 @@ from pagure.lib import model
 
 
 def upgrade():
-        engine = op.get_bind().engine
-        session = sa.orm.scoped_session(sa.orm.sessionmaker(bind=engine))
-        session.query(model.User).update({model.User.password: '$1$' + model.User.password}, synchronize_session=False);
-        session.commit()
+    engine = op.get_bind().engine
+    session = sa.orm.scoped_session(sa.orm.sessionmaker(bind=engine))
+    session.query(model.User).update(
+        {model.User.password: '$1$' + model.User.password}, synchronize_session=False)
+    session.commit()
 
 
 def downgrade():
diff --git a/pagure/ui/login.py b/pagure/ui/login.py
index 8f1978f..27b3018 100644
--- a/pagure/ui/login.py
+++ b/pagure/ui/login.py
@@ -25,16 +25,10 @@ import pagure.lib.login
 import pagure.lib.model as model
 import pagure.lib.notify
 from pagure import APP, SESSION
-<<<<<<< HEAD
 from pagure.lib.login import generate_hashed_value, check_password
-=======
-from pagure.lib.login import generate_hashed_value, retrieve_hashed_value, get_password
->>>>>>> Add fucntions in lib
 
 # pylint: disable=E1101
 
-
-
 @APP.route('/user/new/', methods=['GET', 'POST'])
 @APP.route('/user/new', methods=['GET', 'POST'])
 def new_user():
@@ -125,8 +119,8 @@ def do_login():
 
         elif user_obj.token:
             flask.flash(
-               'Invalid user, did you confirm the creation with the url '
-               'provided by email?', 'error')
+                'Invalid user, did you confirm the creation with the url '
+                'provided by email?', 'error')
             return flask.redirect(flask.url_for('auth_login'))
 
         else:
@@ -298,7 +292,8 @@ def change_password(username):
 
     if form.validate_on_submit():
 
-        old_password = get_password(form.old_password.data, user_password, version)
+        old_password = get_password(
+            form.old_password.data, user_password, version)
 
         try:
             password_checks = check_password(

From 7bec187628be4f5d80183c1807b7b891e5efbb90 Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 15:21:02 +0000
Subject: [PATCH 48/79] Fix constant function in pagure/ui


---

diff --git a/pagure/ui/login.py b/pagure/ui/login.py
index 27b3018..f87dd19 100644
--- a/pagure/ui/login.py
+++ b/pagure/ui/login.py
@@ -13,8 +13,6 @@ import hashlib
 import datetime
 import urlparse
 import bcrypt
-from kitchen.text.converters import to_unicode, to_bytes
-from cryptography.hazmat.primitives import constant_time
 
 import flask
 from sqlalchemy.exc import SQLAlchemyError
@@ -29,6 +27,7 @@ from pagure.lib.login import generate_hashed_value, check_password
 
 # pylint: disable=E1101
 
+
 @APP.route('/user/new/', methods=['GET', 'POST'])
 @APP.route('/user/new', methods=['GET', 'POST'])
 def new_user():
@@ -292,9 +291,6 @@ def change_password(username):
 
     if form.validate_on_submit():
 
-        old_password = get_password(
-            form.old_password.data, user_password, version)
-
         try:
             password_checks = check_password(
                 form.old_password.data, user_obj.password,

From dacf4b15b142bc43160ddc1d2d7960da414a0e3e Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:02 +0000
Subject: [PATCH 49/79] Adjust the login controller to the change made to the backend library


- Raises an exception for invalid passwords
- Split is done in the backend directly
- Adjust the error messages returned to the user

---

diff --git a/pagure/ui/login.py b/pagure/ui/login.py
index f87dd19..6558cca 100644
--- a/pagure/ui/login.py
+++ b/pagure/ui/login.py
@@ -99,13 +99,10 @@ def do_login():
     if form.validate_on_submit():
         username = form.username.data
         user_obj = pagure.lib.search_user(SESSION, username=username)
-        if not user_obj:
-            flask.flash('Username or password invalid.', 'error')
-            return flask.redirect(flask.url_for('auth_login'))
 
         try:
             password_checks = check_password(
-                form.password.data, user_obj.password,
+                form.old_password.data, user_obj.password,
                 seed=APP.config.get('PASSWORD_SEED', None))
         except pagure.exceptions.PagureException as err:
             APP.logger.exception(err)
@@ -123,7 +120,6 @@ def do_login():
             return flask.redirect(flask.url_for('auth_login'))
 
         else:
-
                 user_obj.password = generate_hashed_value(form.password.data)
                 SESSION.add(user_obj)
 

From 7fe9a31e1c3dccb21892a2d2b000a608b2813be1 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:02 +0000
Subject: [PATCH 50/79] Add the squeleton for unit-testing the local login controller


---

diff --git a/tests/test_pagure_flask_ui_login.py b/tests/test_pagure_flask_ui_login.py
index 3709426..34a5f1b 100644
--- a/tests/test_pagure_flask_ui_login.py
+++ b/tests/test_pagure_flask_ui_login.py
@@ -25,7 +25,6 @@ from mock import patch
 sys.path.insert(0, os.path.join(os.path.dirname(
     os.path.abspath(__file__)), '..'))
 
-
 import pagure.lib
 import tests
 from pagure.lib.repo import PagureRepo

From 6d8b89a7fd43ed44a066d14a31b81eb5f43e3a83 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:02 +0000
Subject: [PATCH 51/79] Add the first tests for the new_user endpoint


---

diff --git a/tests/test_pagure_flask_ui_login.py b/tests/test_pagure_flask_ui_login.py
index 34a5f1b..3709426 100644
--- a/tests/test_pagure_flask_ui_login.py
+++ b/tests/test_pagure_flask_ui_login.py
@@ -25,6 +25,7 @@ from mock import patch
 sys.path.insert(0, os.path.join(os.path.dirname(
     os.path.abspath(__file__)), '..'))
 
+
 import pagure.lib
 import tests
 from pagure.lib.repo import PagureRepo

From 0fc6df0b83d9c325f61eb7a1f018fc779e2e431b Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 15:21:02 +0000
Subject: [PATCH 52/79] Fix all tests in lib


---

diff --git a/tests/test_progit_lib_login.py b/tests/test_progit_lib_login.py
index 7ad9c60..08047ce 100644
--- a/tests/test_progit_lib_login.py
+++ b/tests/test_progit_lib_login.py
@@ -90,6 +90,13 @@ class PagureLibLogintests(tests.Modeltests):
             'foo',
             password
         )
+        password = '%s%s' % ('foo', APP.config.get('PASSWORD_SEED', None))
+        password = hashlib.sha512(password).hexdigest()
+        with self.assertRaises(PagureException):
+            pagure.lib.login.check_password('foo', password)
+        password = '$3$' + password
+        with self.assertRaises(PagureException):
+            pagure.lib.login.check_password('foo', password)
 
 if __name__ == '__main__':
     SUITE = unittest.TestLoader().loadTestsFromTestCase(PagureLibLogintests)

From 37540702c930309a1a7418beb16257526d3f0756 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:03 +0000
Subject: [PATCH 53/79] Improve the lib.login tests


- Add a little bit of documentation in the tests
- Test that password match when they should and don't match when they should
- Be consistent in the way we check for exceptions

---

diff --git a/tests/test_progit_lib_login.py b/tests/test_progit_lib_login.py
index 08047ce..94c7f6e 100644
--- a/tests/test_progit_lib_login.py
+++ b/tests/test_progit_lib_login.py
@@ -92,11 +92,20 @@ class PagureLibLogintests(tests.Modeltests):
         )
         password = '%s%s' % ('foo', APP.config.get('PASSWORD_SEED', None))
         password = hashlib.sha512(password).hexdigest()
-        with self.assertRaises(PagureException):
-            pagure.lib.login.check_password('foo', password)
+        self.assertRaises(
+            PagureException,
+            pagure.lib.login.check_password,
+            'foo', password
+        )
+
+        # Invalid password  -  Invalid version
         password = '$3$' + password
-        with self.assertRaises(PagureException):
-            pagure.lib.login.check_password('foo', password)
+        self.assertRaises(
+            PagureException,
+            pagure.lib.login.check_password,
+            'foo',
+            password
+        )
 
 if __name__ == '__main__':
     SUITE = unittest.TestLoader().loadTestsFromTestCase(PagureLibLogintests)

From bd3b36aadc3e001b2ddb0d0932b0bb1e6bc49bd5 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:03 +0000
Subject: [PATCH 54/79] The login form has only a password field not an old_password one


---

diff --git a/pagure/ui/login.py b/pagure/ui/login.py
index 6558cca..7c12cee 100644
--- a/pagure/ui/login.py
+++ b/pagure/ui/login.py
@@ -102,7 +102,7 @@ def do_login():
 
         try:
             password_checks = check_password(
-                form.old_password.data, user_obj.password,
+                form.password.data, user_obj.password,
                 seed=APP.config.get('PASSWORD_SEED', None))
         except pagure.exceptions.PagureException as err:
             APP.logger.exception(err)

From b2efeaa72a8361b7d7f15d2f53bf106d276a0f85 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:03 +0000
Subject: [PATCH 55/79] If there is no user associated with the username provided, bail out


---

diff --git a/pagure/ui/login.py b/pagure/ui/login.py
index 7c12cee..58b3daf 100644
--- a/pagure/ui/login.py
+++ b/pagure/ui/login.py
@@ -99,6 +99,9 @@ def do_login():
     if form.validate_on_submit():
         username = form.username.data
         user_obj = pagure.lib.search_user(SESSION, username=username)
+        if not user_obj:
+            flask.flash('Username or password invalid.', 'error')
+            return flask.redirect(flask.url_for('auth_login'))
 
         try:
             password_checks = check_password(

From e8867bf6b5e3032d0c8bdc871e9f246171620dd0 Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 15:21:03 +0000
Subject: [PATCH 56/79] Add wrong password check


---

diff --git a/tests/test_pagure_flask_ui_login.py b/tests/test_pagure_flask_ui_login.py
index 3709426..5cefcb3 100644
--- a/tests/test_pagure_flask_ui_login.py
+++ b/tests/test_pagure_flask_ui_login.py
@@ -185,6 +185,17 @@ class PagureFlaskLogintests(tests.Modeltests):
             'Invalid user, did you confirm the creation with the url '
             'provided by email?', output.data)
 
+        # Wrong password submitted
+        data['password'] = 'password'
+        output = self.app.post('/dologin', data=data, follow_redirects=True)
+        self.assertEqual(output.status_code, 200)
+        self.assertIn('<title>Login - Pagure</title>', output.data)
+        self.assertIn(
+            '<form action="/dologin" method="post">', output.data)
+        self.assertIn('Username or password invalid.', output.data)
+
+
+
 
 if __name__ == '__main__':
     SUITE = unittest.TestLoader().loadTestsFromTestCase(PagureFlaskLogintests)

From bbbe449c53af6a91ec8261beede50f5789464c43 Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 15:21:03 +0000
Subject: [PATCH 57/79] Add test when csrf token is not verified


---

diff --git a/tests/test_pagure_flask_ui_login.py b/tests/test_pagure_flask_ui_login.py
index 5cefcb3..bbe31fc 100644
--- a/tests/test_pagure_flask_ui_login.py
+++ b/tests/test_pagure_flask_ui_login.py
@@ -194,7 +194,16 @@ class PagureFlaskLogintests(tests.Modeltests):
             '<form action="/dologin" method="post">', output.data)
         self.assertIn('Username or password invalid.', output.data)
 
-
+        # When account is not confirmed i.e user_obj != None
+        data['password'] = 'barpass'
+        output = self.app.post('/dologin', data=data, follow_redirects=True)
+        self.assertEqual(output.status_code, 200)
+        self.assertIn('<title>Login - Pagure</title>', output.data)
+        self.assertIn(
+            '<form action="/dologin" method="post">', output.data)
+        self.assertIn(
+            'Invalid user, did you confirm the creation with the url '
+            'provided by email?', output.data)
 
 
 if __name__ == '__main__':

From b3f47d4dd2aafbd28caf6edb04138bea58956cb0 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:03 +0000
Subject: [PATCH 58/79] Fix the remaining test file with progit in its name


---

diff --git a/tests/test_pagure_lib_login.py b/tests/test_pagure_lib_login.py
new file mode 100644
index 0000000..94c7f6e
--- /dev/null
+++ b/tests/test_pagure_lib_login.py
@@ -0,0 +1,112 @@
+# -*- coding: utf-8 -*-
+
+"""
+ (c) 2016 - Copyright Red Hat Inc
+
+ Authors:
+   Pierre-Yves Chibon <pingou@pingoured.fr>
+
+"""
+
+__requires__ = ['SQLAlchemy >= 0.8']
+import pkg_resources
+
+import unittest
+import shutil
+import sys
+import os
+
+from mock import patch
+
+sys.path.insert(0, os.path.join(os.path.dirname(
+    os.path.abspath(__file__)), '..'))
+
+import pagure.lib
+from pagure.exceptions import PagureException
+import pagure.lib.login
+import hashlib
+from pagure import APP
+import tests
+
+
+class PagureLibLogintests(tests.Modeltests):
+    """ Tests for pagure.lib.login """
+
+    def test_id_generator(self):
+        ''' Test pagure.lib.login.id_generator. '''
+        self.assertEqual(
+            pagure.lib.login.id_generator(size=3, chars=['a']),
+            'aaa'
+        )
+
+    def test_get_users_by_group(self):
+        ''' Test pagure.lib.login.get_users_by_group. '''
+
+        users = pagure.lib.login.get_users_by_group(self.session, 'foo')
+        self.assertEqual(users, [])
+
+    def test_get_session_by_visitkey(self):
+        ''' Test pagure.lib.login.get_session_by_visitkey. '''
+
+        session = pagure.lib.login.get_session_by_visitkey(self.session, 'foo')
+        self.assertEqual(session, None)
+
+    def test_generate_hashed_value(self):
+        ''' Test pagure.lib.login.generate_hashed_value. '''
+        password = pagure.lib.login.generate_hashed_value('foo')
+        self.assertTrue(password.startswith('$2$'))
+        self.assertEqual(len(password), 63)
+
+    def test_check_password(self):
+        ''' Test pagure.lib.login.check_password. '''
+
+        # Version 2
+        password = pagure.lib.login.generate_hashed_value('foo')
+        self.assertTrue(
+            pagure.lib.login.check_password('foo', password))
+        self.assertFalse(
+            pagure.lib.login.check_password('bar', password))
+
+        # Version 1
+        password = '%s%s' % ('foo', APP.config.get('PASSWORD_SEED', None))
+        password = '$1$' + hashlib.sha512(password).hexdigest()
+        self.assertTrue(pagure.lib.login.check_password('foo', password))
+        self.assertFalse(pagure.lib.login.check_password('bar', password))
+
+        # Invalid password  -  No version
+        password = '%s%s' % ('foo', APP.config.get('PASSWORD_SEED', None))
+        password = hashlib.sha512(password).hexdigest()
+        self.assertRaises(
+            PagureException,
+            pagure.lib.login.check_password,
+            'foo', password
+        )
+
+        # Invalid password  -  Invalid version
+        password = '$3$' + password
+        self.assertRaises(
+            PagureException,
+            pagure.lib.login.check_password,
+            'foo',
+            password
+        )
+        password = '%s%s' % ('foo', APP.config.get('PASSWORD_SEED', None))
+        password = hashlib.sha512(password).hexdigest()
+        self.assertRaises(
+            PagureException,
+            pagure.lib.login.check_password,
+            'foo', password
+        )
+
+        # Invalid password  -  Invalid version
+        password = '$3$' + password
+        self.assertRaises(
+            PagureException,
+            pagure.lib.login.check_password,
+            'foo',
+            password
+        )
+
+if __name__ == '__main__':
+    SUITE = unittest.TestLoader().loadTestsFromTestCase(PagureLibLogintests)
+    unittest.TextTestRunner(verbosity=2).run(SUITE)
diff --git a/tests/test_progit_lib_login.py b/tests/test_progit_lib_login.py
deleted file mode 100644
index 94c7f6e..0000000
--- a/tests/test_progit_lib_login.py
+++ /dev/null
@@ -1,112 +0,0 @@
-# -*- coding: utf-8 -*-
-
-"""
- (c) 2016 - Copyright Red Hat Inc
-
- Authors:
-   Pierre-Yves Chibon <pingou@pingoured.fr>
-
-"""
-
-__requires__ = ['SQLAlchemy >= 0.8']
-import pkg_resources
-
-import unittest
-import shutil
-import sys
-import os
-
-from mock import patch
-
-sys.path.insert(0, os.path.join(os.path.dirname(
-    os.path.abspath(__file__)), '..'))
-
-import pagure.lib
-from pagure.exceptions import PagureException
-import pagure.lib.login
-import hashlib
-from pagure import APP
-import tests
-
-
-class PagureLibLogintests(tests.Modeltests):
-    """ Tests for pagure.lib.login """
-
-    def test_id_generator(self):
-        ''' Test pagure.lib.login.id_generator. '''
-        self.assertEqual(
-            pagure.lib.login.id_generator(size=3, chars=['a']),
-            'aaa'
-        )
-
-    def test_get_users_by_group(self):
-        ''' Test pagure.lib.login.get_users_by_group. '''
-
-        users = pagure.lib.login.get_users_by_group(self.session, 'foo')
-        self.assertEqual(users, [])
-
-    def test_get_session_by_visitkey(self):
-        ''' Test pagure.lib.login.get_session_by_visitkey. '''
-
-        session = pagure.lib.login.get_session_by_visitkey(self.session, 'foo')
-        self.assertEqual(session, None)
-
-    def test_generate_hashed_value(self):
-        ''' Test pagure.lib.login.generate_hashed_value. '''
-        password = pagure.lib.login.generate_hashed_value('foo')
-        self.assertTrue(password.startswith('$2$'))
-        self.assertEqual(len(password), 63)
-
-    def test_check_password(self):
-        ''' Test pagure.lib.login.check_password. '''
-
-        # Version 2
-        password = pagure.lib.login.generate_hashed_value('foo')
-        self.assertTrue(
-            pagure.lib.login.check_password('foo', password))
-        self.assertFalse(
-            pagure.lib.login.check_password('bar', password))
-
-        # Version 1
-        password = '%s%s' % ('foo', APP.config.get('PASSWORD_SEED', None))
-        password = '$1$' + hashlib.sha512(password).hexdigest()
-        self.assertTrue(pagure.lib.login.check_password('foo', password))
-        self.assertFalse(pagure.lib.login.check_password('bar', password))
-
-        # Invalid password  -  No version
-        password = '%s%s' % ('foo', APP.config.get('PASSWORD_SEED', None))
-        password = hashlib.sha512(password).hexdigest()
-        self.assertRaises(
-            PagureException,
-            pagure.lib.login.check_password,
-            'foo', password
-        )
-
-        # Invalid password  -  Invalid version
-        password = '$3$' + password
-        self.assertRaises(
-            PagureException,
-            pagure.lib.login.check_password,
-            'foo',
-            password
-        )
-        password = '%s%s' % ('foo', APP.config.get('PASSWORD_SEED', None))
-        password = hashlib.sha512(password).hexdigest()
-        self.assertRaises(
-            PagureException,
-            pagure.lib.login.check_password,
-            'foo', password
-        )
-
-        # Invalid password  -  Invalid version
-        password = '$3$' + password
-        self.assertRaises(
-            PagureException,
-            pagure.lib.login.check_password,
-            'foo',
-            password
-        )
-
-if __name__ == '__main__':
-    SUITE = unittest.TestLoader().loadTestsFromTestCase(PagureLibLogintests)
-    unittest.TextTestRunner(verbosity=2).run(SUITE)

From 3deace26d88dbda5213057e0e33a0ec944079bf0 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:03 +0000
Subject: [PATCH 59/79] Small doc change


---

diff --git a/tests/test_pagure_flask_ui_login.py b/tests/test_pagure_flask_ui_login.py
index bbe31fc..68c4df3 100644
--- a/tests/test_pagure_flask_ui_login.py
+++ b/tests/test_pagure_flask_ui_login.py
@@ -154,7 +154,7 @@ class PagureFlaskLogintests(tests.Modeltests):
         items = pagure.lib.search_user(self.session)
         self.assertEqual(3, len(items))
 
-        # Submit the form with the csrf token  -  but invalid user
+        # Submit the form with the csrf token  -  but user not confirmed
         data['csrf_token'] = csrf_token
         output = self.app.post('/dologin', data=data, follow_redirects=True)
         self.assertEqual(output.status_code, 200)
@@ -165,7 +165,7 @@ class PagureFlaskLogintests(tests.Modeltests):
             'Invalid user, did you confirm the creation with the url '
             'provided by email?', output.data)
 
-        # Wrong password submitted
+        # User in the DB, csrf provided  -  but wrong password submitted
         data['password'] = 'password'
         output = self.app.post('/dologin', data=data, follow_redirects=True)
         self.assertEqual(output.status_code, 200)

From 9b9f29ce61a3823fcab201034a1419501cb100ec Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:03 +0000
Subject: [PATCH 60/79] Add test for log-in in with a valid user


---

diff --git a/tests/test_pagure_flask_ui_login.py b/tests/test_pagure_flask_ui_login.py
index 68c4df3..407c7be 100644
--- a/tests/test_pagure_flask_ui_login.py
+++ b/tests/test_pagure_flask_ui_login.py
@@ -205,6 +205,34 @@ class PagureFlaskLogintests(tests.Modeltests):
             'Invalid user, did you confirm the creation with the url '
             'provided by email?', output.data)
 
+        # Confirm the user so that we can log in
+        item = pagure.lib.search_user(self.session, username='foouser')
+        self.assertEqual(item.user, 'foouser')
+        self.assertNotEqual(item.token, None)
+
+        # Remove the token
+        item.token = None
+        self.session.add(item)
+        self.session.commit
+
+        # Check the user
+        item = pagure.lib.search_user(self.session, username='foouser')
+        self.assertEqual(item.user, 'foouser')
+        self.assertEqual(item.token, None)
+
+        # Login but cannot save the session to the DB due to the missing IP
+        # address in the flask request
+        data['password'] = 'barpass'
+        output = self.app.post('/dologin', data=data, follow_redirects=True)
+        self.assertEqual(output.status_code, 200)
+        self.assertIn('<title>Home - Pagure</title>', output.data)
+        self.assertIn(
+            '<a class="nav-link" href="/login/?next=http://localhost/">',
+            output.data)
+        self.assertIn(
+            'Could not set the session in the db, please report this error '
+            'to an admin', output.data)
+
 
 if __name__ == '__main__':
     SUITE = unittest.TestLoader().loadTestsFromTestCase(PagureFlaskLogintests)

From 7cc953d0a2b0ee2a0f2d8f422427de8924f9f113 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:03 +0000
Subject: [PATCH 61/79] Add test trying to log-in with an invalid password stored in the DB


---

diff --git a/tests/test_pagure_flask_ui_login.py b/tests/test_pagure_flask_ui_login.py
index 407c7be..acb38e7 100644
--- a/tests/test_pagure_flask_ui_login.py
+++ b/tests/test_pagure_flask_ui_login.py
@@ -233,6 +233,30 @@ class PagureFlaskLogintests(tests.Modeltests):
             'Could not set the session in the db, please report this error '
             'to an admin', output.data)
 
+        # Make the password invalid
+        item = pagure.lib.search_user(self.session, username='foouser')
+        self.assertEqual(item.user, 'foouser')
+        self.assertTrue(item.password.startswith('$2$'))
+
+        # Remove the $2$
+        item.password = item.password[3:]
+        self.session.add(item)
+        self.session.commit
+
+        # Check the password
+        item = pagure.lib.search_user(self.session, username='foouser')
+        self.assertEqual(item.user, 'foouser')
+        self.assertFalse(item.password.startswith('$2$'))
+
+        # Try login again
+        output = self.app.post('/dologin', data=data, follow_redirects=True)
+        self.assertEqual(output.status_code, 200)
+        self.assertIn('<title>Login - Pagure</title>', output.data)
+        self.assertIn(
+            '<form action="/dologin" method="post">', output.data)
+        self.assertIn('Username or password of invalid format.', output.data)
+
+
 
 if __name__ == '__main__':
     SUITE = unittest.TestLoader().loadTestsFromTestCase(PagureFlaskLogintests)

From eac364d527f1ab7247e4f8ff3ddf9488aecc8e0f Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:03 +0000
Subject: [PATCH 62/79] Add unit-tests for the v1 passwords


---

diff --git a/tests/test_pagure_flask_ui_login.py b/tests/test_pagure_flask_ui_login.py
index acb38e7..d3cd4dc 100644
--- a/tests/test_pagure_flask_ui_login.py
+++ b/tests/test_pagure_flask_ui_login.py
@@ -12,6 +12,7 @@ __requires__ = ['SQLAlchemy >= 0.8']
 import pkg_resources
 
 import datetime
+import hashlib
 import json
 import unittest
 import shutil
@@ -256,6 +257,34 @@ class PagureFlaskLogintests(tests.Modeltests):
             '<form action="/dologin" method="post">', output.data)
         self.assertIn('Username or password of invalid format.', output.data)
 
+        # Make the password be version 1
+        item = pagure.lib.search_user(self.session, username='foouser')
+        self.assertEqual(item.user, 'foouser')
+        self.assertTrue(item.password.startswith('$2$'))
+
+        # V1 password
+        password = '%s%s' % ('barpass', None)
+        password = hashlib.sha512(password).hexdigest()
+        item.token = None
+        item.password = '$1$%s' % password
+        self.session.add(item)
+        self.session.commit
+
+        # Check the password
+        item = pagure.lib.search_user(self.session, username='foouser')
+        self.assertEqual(item.user, 'foouser')
+        self.assertTrue(item.password.startswith('$1$'))
+
+        # Log in with a v1 password
+        output = self.app.post('/dologin', data=data, follow_redirects=True)
+        self.assertEqual(output.status_code, 200)
+        self.assertIn('<title>Home - Pagure</title>', output.data)
+        self.assertIn(
+            '<a class="nav-link" href="/login/?next=http://localhost/">',
+            output.data)
+        self.assertIn(
+            'Could not set the session in the db, please report this error '
+            'to an admin', output.data)
 
 
 if __name__ == '__main__':

From 10fbdf0e7a70416b2c78b6f567bb213884bae035 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:03 +0000
Subject: [PATCH 63/79] Add unit-tests for the confirm_user endpoint


---

diff --git a/tests/test_pagure_flask_ui_login.py b/tests/test_pagure_flask_ui_login.py
index d3cd4dc..d19565b 100644
--- a/tests/test_pagure_flask_ui_login.py
+++ b/tests/test_pagure_flask_ui_login.py
@@ -286,6 +286,32 @@ class PagureFlaskLogintests(tests.Modeltests):
             'Could not set the session in the db, please report this error '
             'to an admin', output.data)
 
+    def test_confirm_user(self):
+        """ Test the confirm_user endpoint. """
+
+        output = self.app.get('/confirm/foo', follow_redirects=True)
+        self.assertEqual(output.status_code, 200)
+        self.assertIn('<title>Home - Pagure</title>', output.data)
+        self.assertIn(
+            'No user associated with this token.', output.data)
+
+        # Create a local user
+        self.test_new_user()
+
+        items = pagure.lib.search_user(self.session)
+        self.assertEqual(3, len(items))
+        item = pagure.lib.search_user(self.session, username='foouser')
+        self.assertEqual(item.user, 'foouser')
+        self.assertTrue(item.password.startswith('$2$'))
+        self.assertNotEqual(item.token, None)
+
+        output = self.app.get(
+            '/confirm/%s' % item.token, follow_redirects=True)
+        self.assertEqual(output.status_code, 200)
+        self.assertIn('<title>Login - Pagure</title>', output.data)
+        self.assertIn(
+            'Email confirmed, account activated', output.data)
+
 
 if __name__ == '__main__':
     SUITE = unittest.TestLoader().loadTestsFromTestCase(PagureFlaskLogintests)

From db170cf910022bf41fc8d725ccc757ba4aab9639 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:03 +0000
Subject: [PATCH 64/79] Add unit-tests for the lost_password endpoint


---

diff --git a/tests/test_pagure_flask_ui_login.py b/tests/test_pagure_flask_ui_login.py
index d19565b..3b0b0ff 100644
--- a/tests/test_pagure_flask_ui_login.py
+++ b/tests/test_pagure_flask_ui_login.py
@@ -312,6 +312,58 @@ class PagureFlaskLogintests(tests.Modeltests):
         self.assertIn(
             'Email confirmed, account activated', output.data)
 
+    def test_lost_password(self):
+        """ Test the lost_password endpoint. """
+
+        output = self.app.get('/password/lost')
+        self.assertEqual(output.status_code, 200)
+        self.assertIn('<title>Lost password - Pagure</title>', output.data)
+        self.assertIn(
+            '<form action="/password/lost" method="post">', output.data)
+
+        # Prepare the data to send
+        data = {
+            'username': 'foouser',
+        }
+
+        # Missing CSRF
+        output = self.app.post('/password/lost', data=data)
+        self.assertEqual(output.status_code, 200)
+        self.assertIn('<title>Lost password - Pagure</title>', output.data)
+        self.assertIn(
+            '<form action="/password/lost" method="post">', output.data)
+
+        csrf_token = output.data.split(
+                'name="csrf_token" type="hidden" value="')[1].split('">')[0]
+
+        # With the CSRF  -  But invalid user
+        data['csrf_token'] = csrf_token
+        output = self.app.post(
+            '/password/lost', data=data, follow_redirects=True)
+        self.assertEqual(output.status_code, 200)
+        self.assertIn('<title>Login - Pagure</title>', output.data)
+        self.assertIn('Username invalid.', output.data)
+
+        # With the CSRF and a valid user
+        data['username'] = 'foo'
+        output = self.app.post(
+            '/password/lost', data=data, follow_redirects=True)
+        self.assertEqual(output.status_code, 200)
+        self.assertIn('<title>Login - Pagure</title>', output.data)
+        self.assertIn(
+            'Check your email to finish changing your password', output.data)
+
+        # With the CSRF and a valid user  -  but too quick after the last one
+        data['username'] = 'foo'
+        output = self.app.post(
+            '/password/lost', data=data, follow_redirects=True)
+        self.assertEqual(output.status_code, 200)
+        self.assertIn('<title>Login - Pagure</title>', output.data)
+        self.assertIn(
+            'An email was sent to you less than 3 minutes ago, did you '
+            'check your spam folder? Otherwise, try again after some time.',
+            output.data)
+
 
 if __name__ == '__main__':
     SUITE = unittest.TestLoader().loadTestsFromTestCase(PagureFlaskLogintests)

From 96de3abba85dcb7e6964e8bb5951216e9e722c68 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:03 +0000
Subject: [PATCH 65/79] Adjust copyright, fix date and move comment where it belongs


---

diff --git a/pagure/ui/login.py b/pagure/ui/login.py
index 58b3daf..63fe731 100644
--- a/pagure/ui/login.py
+++ b/pagure/ui/login.py
@@ -1,7 +1,7 @@
 # -*- coding: utf-8 -*-
 
 """
- (c) 2014, 2015 - Copyright Red Hat Inc
+ (c) 2014-2016 - Copyright Red Hat Inc
 
  Authors:
    Pierre-Yves Chibon <pingou@pingoured.fr>
@@ -194,7 +194,7 @@ def lost_password():
             flask.flash('Username invalid.', 'error')
             return flask.redirect(flask.url_for('auth_login'))
         elif user_obj.token:
-            current_time = datetime.datetime.now()
+            current_time = datetime.datetime.utcnow()
             invalid_period = user_obj.updated_on + datetime.timedelta(minutes=3)
             if current_time < invalid_period:
                 flask.flash('An email was sent to you less than 3 minutes ago, '
@@ -272,10 +272,6 @@ def reset_password(token):
     )
 
 
-#
-# Methods specific to local login.
-#
-
 @APP.route('/password/change/<username>/', methods=['GET', 'POST'])
 @APP.route('/password/change/<username>', methods=['GET', 'POST'])
 def change_password(username):
@@ -331,6 +327,10 @@ def change_password(username):
     )
 
 
+#
+# Methods specific to local login.
+#
+
 def send_confirmation_email(user):
     """ Sends the confirmation email asking the user to confirm its email
     address.

From c3ff39fc86e3d2212b66a9d3ded770ad1e31e144 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:03 +0000
Subject: [PATCH 66/79] Add unit-tests for the reset_password endpoint


---

diff --git a/tests/test_pagure_flask_ui_login.py b/tests/test_pagure_flask_ui_login.py
index 3b0b0ff..ef737ed 100644
--- a/tests/test_pagure_flask_ui_login.py
+++ b/tests/test_pagure_flask_ui_login.py
@@ -364,6 +364,59 @@ class PagureFlaskLogintests(tests.Modeltests):
             'check your spam folder? Otherwise, try again after some time.',
             output.data)
 
+    def test_reset_password(self):
+        """ Test the reset_password endpoint. """
+
+        output = self.app.get('/password/reset/foo', follow_redirects=True)
+        self.assertEqual(output.status_code, 200)
+        self.assertIn('<title>Login - Pagure</title>', output.data)
+        self.assertIn('No user associated with this token.', output.data)
+        self.assertIn('<form action="/dologin" method="post">', output.data)
+
+        self.test_lost_password()
+        self.test_new_user()
+
+        # Check the password
+        item = pagure.lib.search_user(self.session, username='foouser')
+        self.assertEqual(item.user, 'foouser')
+        self.assertNotEqual(item.token, None)
+        print item.password
+        self.assertTrue(item.password.startswith('$2$'))
+
+        old_password = item.password
+        token = item.token
+
+        output = self.app.get(
+            '/password/reset/%s' % token, follow_redirects=True)
+        self.assertEqual(output.status_code, 200)
+        self.assertIn('<title>Change password - Pagure</title>', output.data)
+        self.assertIn(
+            '<form action="/password/reset/', output.data)
+
+        data = {
+            'password': 'passwd',
+            'confirm_password': 'passwd',
+        }
+
+        # Missing CSRF
+        output = self.app.post(
+            '/password/reset/%s' % token, data=data, follow_redirects=True)
+        self.assertEqual(output.status_code, 200)
+        self.assertIn('<title>Change password - Pagure</title>', output.data)
+        self.assertIn(
+            '<form action="/password/reset/', output.data)
+
+        csrf_token = output.data.split(
+                'name="csrf_token" type="hidden" value="')[1].split('">')[0]
+
+        # With CSRF
+        data['csrf_token'] = csrf_token
+        output = self.app.post(
+            '/password/reset/%s' % token, data=data, follow_redirects=True)
+        self.assertEqual(output.status_code, 200)
+        self.assertIn('<title>Login - Pagure</title>', output.data)
+        self.assertIn('Password changed', output.data)
+
 
 if __name__ == '__main__':
     SUITE = unittest.TestLoader().loadTestsFromTestCase(PagureFlaskLogintests)

From a6a988b00a6bb6d5a2af1adce6614b721ff9d834 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:03 +0000
Subject: [PATCH 67/79] Adjust the HTML in the template used when updating a password


---

diff --git a/pagure/templates/login/password_recover.html b/pagure/templates/login/password_recover.html
index 310163d..2f3fd53 100644
--- a/pagure/templates/login/password_recover.html
+++ b/pagure/templates/login/password_recover.html
@@ -14,18 +14,12 @@
             <strong>Change password</strong>
         </div>
         <form action="{{ url_for('change_password', username=g.fas_user.username) }}" method="POST">
-            <table>
-                {{ render_bootstrap_field(form.old_password) }}
-                {{ render_bootstrap_field(form.password) }}
-                {{ render_bootstrap_field(form.confirm_password) }}
-            </table>
-            <p class="buttons indent">
-                <input type="submit" class="submit positive button"  class="btn btn-primary" value="Update">
-                <a href="{{ url_for('index') }}">
-                    <input type="button" value="Cancel" class="button" class="btn btn-secondary">
-                </a>
-                {{ form.csrf_token }}
-            </p>
+            {{ render_bootstrap_field(form.old_password) }}
+            {{ render_bootstrap_field(form.password) }}
+            {{ render_bootstrap_field(form.confirm_password) }}
+            {{ form.csrf_token }}
+            <input class="btn btn-primary" type="submit" value="Update" title="Update description">
+            <input type="button" value="Cancel" class="btn btn-default" onclick="history.back();">
         </form>
      </div>
    </div>

From 8a7f3487722998e77a0307fd8c0b2cfd84b91e0d Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:03 +0000
Subject: [PATCH 68/79] Fix the HTML in the password_reset template


---

diff --git a/pagure/templates/login/password_reset.html b/pagure/templates/login/password_reset.html
index 010f385..4cff01f 100644
--- a/pagure/templates/login/password_reset.html
+++ b/pagure/templates/login/password_reset.html
@@ -1,5 +1,5 @@
 {% extends "master.html" %}
-{% from "_formhelper.html" import render_field_in_row %}
+{% from "_formhelper.html" import render_bootstrap_field %}
 
 {% block title %}Change password{% endblock %}
 {% set tag = "home" %}
@@ -16,7 +16,7 @@
           <form action="{{ url_for('.reset_password', token=token)
                 }}" method="post">
             {{ render_bootstrap_field(form.password) }}
-            {{ render_field_in_row(form.confirm_password) }}
+            {{ render_bootstrap_field(form.confirm_password) }}
             <input class="btn btn-primary" type="submit" value="Update">
             <input type="button" value="Cancel" class="btn btn-default" onclick="history.back();">
             {{ form.csrf_token }}

From 91c1b011ac5e93e6574cded93cdda4d0908bb51e Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:03 +0000
Subject: [PATCH 69/79] Remove debug code and do not send email when running the tests


---

diff --git a/tests/test_pagure_flask_ui_login.py b/tests/test_pagure_flask_ui_login.py
index ef737ed..87ae6f2 100644
--- a/tests/test_pagure_flask_ui_login.py
+++ b/tests/test_pagure_flask_ui_login.py
@@ -42,7 +42,7 @@ class PagureFlaskLogintests(tests.Modeltests):
         super(PagureFlaskLogintests, self).setUp()
 
         pagure.APP.config['TESTING'] = True
-        pagure.APP.config['EMAIL_SEND'] = True
+        pagure.APP.config['EMAIL_SEND'] = False
         pagure.APP.config['PAGURE_AUTH'] = 'local'
         pagure.SESSION = self.session
         pagure.ui.SESSION = self.session
@@ -380,7 +380,6 @@ class PagureFlaskLogintests(tests.Modeltests):
         item = pagure.lib.search_user(self.session, username='foouser')
         self.assertEqual(item.user, 'foouser')
         self.assertNotEqual(item.token, None)
-        print item.password
         self.assertTrue(item.password.startswith('$2$'))
 
         old_password = item.password

From 5ae42ac5e0f473a4573c91440f2bde12a6785059 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:03 +0000
Subject: [PATCH 70/79] Commit earlier, before sending the email


---

diff --git a/pagure/ui/login.py b/pagure/ui/login.py
index 63fe731..d9fb542 100644
--- a/pagure/ui/login.py
+++ b/pagure/ui/login.py
@@ -66,7 +66,7 @@ def new_user():
             SESSION.flush()
 
         try:
-            SESSION.flush()
+            SESSION.commit()
             send_confirmation_email(user)
             flask.flash(
                 'User created, please check your email to activate the '
@@ -77,8 +77,6 @@ def new_user():
             APP.logger.debug('Could not create user.')
             APP.logger.exception(err)
 
-        SESSION.commit()
-
         return flask.redirect(flask.url_for('auth_login'))
 
     return flask.render_template(

From c104b9d904409bd833de3d9b9dc0a041e896f0cc Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:03 +0000
Subject: [PATCH 71/79] Fix indentation in the password_recover template


---

diff --git a/pagure/templates/login/password_recover.html b/pagure/templates/login/password_recover.html
index 2f3fd53..8c6bcf9 100644
--- a/pagure/templates/login/password_recover.html
+++ b/pagure/templates/login/password_recover.html
@@ -11,18 +11,22 @@
     <div class="col-md-8 col-md-offset-2">
       <div class="card m-t-3">
         <div class="card-header">
-            <strong>Change password</strong>
+          <strong>Change password</strong>
         </div>
-        <form action="{{ url_for('change_password', username=g.fas_user.username) }}" method="POST">
-            {{ render_bootstrap_field(form.old_password) }}
-            {{ render_bootstrap_field(form.password) }}
-            {{ render_bootstrap_field(form.confirm_password) }}
-            {{ form.csrf_token }}
-            <input class="btn btn-primary" type="submit" value="Update" title="Update description">
-            <input type="button" value="Cancel" class="btn btn-default" onclick="history.back();">
+        <form action="{{ url_for(
+            'change_password', username=g.fas_user.username)
+          }}" method="POST">
+          {{ render_bootstrap_field(form.old_password) }}
+          {{ render_bootstrap_field(form.password) }}
+          {{ render_bootstrap_field(form.confirm_password) }}
+          {{ form.csrf_token }}
+          <input class="btn btn-primary" type="submit" value="Update"
+            title="Update description">
+          <input type="button" value="Cancel" class="btn btn-default"
+            onclick="history.back();">
         </form>
-     </div>
-   </div>
+      </div>
+    </div>
   </div>
 </div>
 

From 23b43c8587acb5715206823b9b570e809bb42e41 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:03 +0000
Subject: [PATCH 72/79] Add unit-tests for the change_password endpoint


---

diff --git a/tests/test_pagure_flask_ui_login.py b/tests/test_pagure_flask_ui_login.py
index 87ae6f2..95ea7ce 100644
--- a/tests/test_pagure_flask_ui_login.py
+++ b/tests/test_pagure_flask_ui_login.py
@@ -46,6 +46,7 @@ class PagureFlaskLogintests(tests.Modeltests):
         pagure.APP.config['PAGURE_AUTH'] = 'local'
         pagure.SESSION = self.session
         pagure.ui.SESSION = self.session
+        pagure.ui.app.SESSION = self.session
         pagure.ui.login.SESSION = self.session
 
         self.app = pagure.APP.test_client()
@@ -416,6 +417,108 @@ class PagureFlaskLogintests(tests.Modeltests):
         self.assertIn('<title>Login - Pagure</title>', output.data)
         self.assertIn('Password changed', output.data)
 
+    def test_change_password(self):
+        """ Test the change_password endpoint. """
+
+        # Not logged in, redirects
+        output = self.app.get('/password/change', follow_redirects=True)
+        self.assertEqual(output.status_code, 200)
+        self.assertIn('<title>Login - Pagure</title>', output.data)
+        self.assertIn('<form action="/dologin" method="post">', output.data)
+
+        user = tests.FakeUser()
+        with tests.user_set(pagure.APP, user):
+            output = self.app.get('/password/change')
+            self.assertEqual(output.status_code, 404)
+            self.assertIn('User not found', output.data)
+
+        user = tests.FakeUser(username='foo')
+        with tests.user_set(pagure.APP, user):
+            output = self.app.get('/password/change')
+            self.assertEqual(output.status_code, 200)
+            self.assertIn('<title>Change password - Pagure</title>', output.data)
+            self.assertIn(
+                '<form action="/password/change" method="post">', output.data)
+
+            data = {
+                'old_password': 'foo',
+                'password': 'foo',
+                'confirm_password': 'foo',
+            }
+
+            # No CSRF token
+            output = self.app.post('/password/change', data=data)
+            self.assertEqual(output.status_code, 200)
+            self.assertIn('<title>Change password - Pagure</title>', output.data)
+            self.assertIn(
+                '<form action="/password/change" method="post">', output.data)
+
+            csrf_token = output.data.split(
+                'name="csrf_token" type="hidden" value="')[1].split('">')[0]
+
+            # With CSRF  -  Invalid password format
+            data['csrf_token'] = csrf_token
+            output = self.app.post(
+                '/password/change', data=data, follow_redirects=True)
+            self.assertEqual(output.status_code, 200)
+            self.assertIn('<title>Home - Pagure</title>', output.data)
+            self.assertIn(
+                'Could not update your password, either user or password '
+                'could not be checked', output.data)
+
+        self.test_new_user()
+
+        # Remove token of foouser
+        item = pagure.lib.search_user(self.session, username='foouser')
+        self.assertEqual(item.user, 'foouser')
+        self.assertNotEqual(item.token, None)
+        self.assertTrue(item.password.startswith('$2$'))
+        item.token = None
+        self.session.add(item)
+        self.session.commit()
+
+        user = tests.FakeUser(username='foouser')
+        with tests.user_set(pagure.APP, user):
+            output = self.app.get('/password/change')
+            self.assertEqual(output.status_code, 200)
+            self.assertIn('<title>Change password - Pagure</title>', output.data)
+            self.assertIn(
+                '<form action="/password/change" method="post">', output.data)
+
+            data = {
+                'old_password': 'foo',
+                'password': 'foo',
+                'confirm_password': 'foo',
+            }
+
+            # No CSRF token
+            output = self.app.post('/password/change', data=data)
+            self.assertEqual(output.status_code, 200)
+            self.assertIn('<title>Change password - Pagure</title>', output.data)
+            self.assertIn(
+                '<form action="/password/change" method="post">', output.data)
+
+            csrf_token = output.data.split(
+                'name="csrf_token" type="hidden" value="')[1].split('">')[0]
+
+            # With CSRF  -  Incorrect password
+            data['csrf_token'] = csrf_token
+            output = self.app.post(
+                '/password/change', data=data, follow_redirects=True)
+            self.assertEqual(output.status_code, 200)
+            self.assertIn('<title>Home - Pagure</title>', output.data)
+            self.assertIn(
+                'Could not update your password, either user or password '
+                'could not be checked', output.data)
+
+            # With CSRF  -  Correct password
+            data['old_password'] = 'barpass'
+            output = self.app.post(
+                '/password/change', data=data, follow_redirects=True)
+            self.assertEqual(output.status_code, 200)
+            self.assertIn('<title>Home - Pagure</title>', output.data)
+            self.assertIn('Password changed', output.data)
+
 
 if __name__ == '__main__':
     SUITE = unittest.TestLoader().loadTestsFromTestCase(PagureFlaskLogintests)

From bd04f3bdc603aac91493bfb69735e94405114da6 Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:03 +0000
Subject: [PATCH 73/79] Fix logging out when using local login


---

diff --git a/pagure/__init__.py b/pagure/__init__.py
index f2617a8..ecdd594 100644
--- a/pagure/__init__.py
+++ b/pagure/__init__.py
@@ -309,6 +309,7 @@ def auth_logout():  # pragma: no cover
             FAS.logout()
             flask.flash("You are no longer logged-in")
     elif APP.config.get('PAGURE_AUTH', None) == 'local':
+        import pagure.ui.login as login
         login.logout()
     return flask.redirect(return_point)
 

From d25b694e90a472361356aaef280c92b6625bc21e Mon Sep 17 00:00:00 2001
From: Pierre-Yves Chibon <pingou@pingoured.fr>
Date: Jan 19 2016 15:21:03 +0000
Subject: [PATCH 74/79] Add unit-tests for the logout method for local login


---

diff --git a/tests/test_pagure_flask_ui_login.py b/tests/test_pagure_flask_ui_login.py
index 95ea7ce..fbb6387 100644
--- a/tests/test_pagure_flask_ui_login.py
+++ b/tests/test_pagure_flask_ui_login.py
@@ -519,6 +519,29 @@ class PagureFlaskLogintests(tests.Modeltests):
             self.assertIn('<title>Home - Pagure</title>', output.data)
             self.assertIn('Password changed', output.data)
 
+    def test_logout(self):
+        """ Test the auth_logout endpoint for local login. """
+
+        output = self.app.get('/logout/', follow_redirects=True)
+        self.assertEqual(output.status_code, 200)
+        self.assertIn('<title>Home - Pagure</title>', output.data)
+        self.assertNotIn('You have been logged out', output.data)
+        self.assertIn(
+            '<a class="nav-link" href="/login/?next=http://localhost/">',
+            output.data)
+
+        user = tests.FakeUser(username='foo')
+        with tests.user_set(pagure.APP, user):
+            output = self.app.get('/logout/', follow_redirects=True)
+            self.assertEqual(output.status_code, 200)
+            self.assertIn('<title>Home - Pagure</title>', output.data)
+            self.assertIn('You have been logged out', output.data)
+            # Due to the way the tests are running we do not actually
+            # log out
+            self.assertIn(
+                '<a href="/logout/?next=http://localhost/">log out</a>',
+                output.data)
+
 
 if __name__ == '__main__':
     SUITE = unittest.TestLoader().loadTestsFromTestCase(PagureFlaskLogintests)

From 19ad5f1c2db1bd01ba96d621aafb1746adea282a Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 15:21:03 +0000
Subject: [PATCH 75/79] Fix login user bug


---

diff --git a/pagure/templates/login/password_recover.html b/pagure/templates/login/password_recover.html
index 8c6bcf9..3e9eae0 100644
--- a/pagure/templates/login/password_recover.html
+++ b/pagure/templates/login/password_recover.html
@@ -13,9 +13,7 @@
         <div class="card-header">
           <strong>Change password</strong>
         </div>
-        <form action="{{ url_for(
-            'change_password', username=g.fas_user.username)
-          }}" method="POST">
+        <form action="{{ url_for('change_password')}}" method="post">
           {{ render_bootstrap_field(form.old_password) }}
           {{ render_bootstrap_field(form.password) }}
           {{ render_bootstrap_field(form.confirm_password) }}
diff --git a/pagure/ui/login.py b/pagure/ui/login.py
index d9fb542..8c5be80 100644
--- a/pagure/ui/login.py
+++ b/pagure/ui/login.py
@@ -22,7 +22,7 @@ import pagure.lib
 import pagure.lib.login
 import pagure.lib.model as model
 import pagure.lib.notify
-from pagure import APP, SESSION
+from pagure import APP, SESSION, cla_required
 from pagure.lib.login import generate_hashed_value, check_password
 
 # pylint: disable=E1101
@@ -193,11 +193,12 @@ def lost_password():
             return flask.redirect(flask.url_for('auth_login'))
         elif user_obj.token:
             current_time = datetime.datetime.utcnow()
-            invalid_period = user_obj.updated_on + datetime.timedelta(minutes=3)
+            invalid_period = user_obj.updated_on + \
+                datetime.timedelta(minutes=3)
             if current_time < invalid_period:
                 flask.flash('An email was sent to you less than 3 minutes ago, '
-                    'did you check your spam folder? Otherwise, '
-                    'try again after some time.', 'error')
+                            'did you check your spam folder? Otherwise, '
+                            'try again after some time.', 'error')
                 return flask.redirect(flask.url_for('auth_login'))
 
         token = pagure.lib.login.id_generator(40)
@@ -268,19 +269,24 @@ def reset_password(token):
         form=form,
         token=token,
     )
+#
+# Methods specific to local login.
+#
 
 
-@APP.route('/password/change/<username>/', methods=['GET', 'POST'])
-@APP.route('/password/change/<username>', methods=['GET', 'POST'])
-def change_password(username):
+@APP.route('/password/change/', methods=['GET', 'POST'])
+@APP.route('/password/change', methods=['GET', 'POST'])
+@cla_required
+def change_password():
     """ Method to change the password for local auth users.
     """
+
     form = forms.ChangePasswordForm()
-    user_obj = pagure.lib.search_user(SESSION, username=username)
+    user_obj = pagure.lib.search_user(
+        SESSION, username=flask.g.fas_user.username)
 
     if not user_obj:
-        flask.flash('No user associated with this username.', 'error')
-        return flask.redirect(flask.url_for('auth_login'))
+        flask.abort(404, 'User not found')
 
     if form.validate_on_submit():
 
@@ -321,14 +327,9 @@ def change_password(username):
     return flask.render_template(
         'login/password_recover.html',
         form=form,
-        username=username,
     )
 
 
-#
-# Methods specific to local login.
-#
-
 def send_confirmation_email(user):
     """ Sends the confirmation email asking the user to confirm its email
     address.
diff --git a/tests/test_pagure_flask_ui_login.py b/tests/test_pagure_flask_ui_login.py
index fbb6387..09f4284 100644
--- a/tests/test_pagure_flask_ui_login.py
+++ b/tests/test_pagure_flask_ui_login.py
@@ -84,7 +84,7 @@ class PagureFlaskLogintests(tests.Modeltests):
             '<form action="/user/new" method="post">', output.data)
 
         csrf_token = output.data.split(
-                'name="csrf_token" type="hidden" value="')[1].split('">')[0]
+            'name="csrf_token" type="hidden" value="')[1].split('">')[0]
 
         # Submit the form with the csrf token
         data['csrf_token'] = csrf_token
@@ -139,7 +139,7 @@ class PagureFlaskLogintests(tests.Modeltests):
         self.assertIn('Insufficient information provided', output.data)
 
         csrf_token = output.data.split(
-                'name="csrf_token" type="hidden" value="')[1].split('">')[0]
+            'name="csrf_token" type="hidden" value="')[1].split('">')[0]
 
         # Submit the form with the csrf token  -  but invalid user
         data['csrf_token'] = csrf_token
@@ -335,7 +335,7 @@ class PagureFlaskLogintests(tests.Modeltests):
             '<form action="/password/lost" method="post">', output.data)
 
         csrf_token = output.data.split(
-                'name="csrf_token" type="hidden" value="')[1].split('">')[0]
+            'name="csrf_token" type="hidden" value="')[1].split('">')[0]
 
         # With the CSRF  -  But invalid user
         data['csrf_token'] = csrf_token
@@ -407,7 +407,7 @@ class PagureFlaskLogintests(tests.Modeltests):
             '<form action="/password/reset/', output.data)
 
         csrf_token = output.data.split(
-                'name="csrf_token" type="hidden" value="')[1].split('">')[0]
+            'name="csrf_token" type="hidden" value="')[1].split('">')[0]
 
         # With CSRF
         data['csrf_token'] = csrf_token
@@ -436,7 +436,8 @@ class PagureFlaskLogintests(tests.Modeltests):
         with tests.user_set(pagure.APP, user):
             output = self.app.get('/password/change')
             self.assertEqual(output.status_code, 200)
-            self.assertIn('<title>Change password - Pagure</title>', output.data)
+            self.assertIn(
+                '<title>Change password - Pagure</title>', output.data)
             self.assertIn(
                 '<form action="/password/change" method="post">', output.data)
 
@@ -449,7 +450,8 @@ class PagureFlaskLogintests(tests.Modeltests):
             # No CSRF token
             output = self.app.post('/password/change', data=data)
             self.assertEqual(output.status_code, 200)
-            self.assertIn('<title>Change password - Pagure</title>', output.data)
+            self.assertIn(
+                '<title>Change password - Pagure</title>', output.data)
             self.assertIn(
                 '<form action="/password/change" method="post">', output.data)
 
@@ -481,7 +483,8 @@ class PagureFlaskLogintests(tests.Modeltests):
         with tests.user_set(pagure.APP, user):
             output = self.app.get('/password/change')
             self.assertEqual(output.status_code, 200)
-            self.assertIn('<title>Change password - Pagure</title>', output.data)
+            self.assertIn(
+                '<title>Change password - Pagure</title>', output.data)
             self.assertIn(
                 '<form action="/password/change" method="post">', output.data)
 
@@ -494,7 +497,8 @@ class PagureFlaskLogintests(tests.Modeltests):
             # No CSRF token
             output = self.app.post('/password/change', data=data)
             self.assertEqual(output.status_code, 200)
-            self.assertIn('<title>Change password - Pagure</title>', output.data)
+            self.assertIn(
+                '<title>Change password - Pagure</title>', output.data)
             self.assertIn(
                 '<form action="/password/change" method="post">', output.data)
 

From 094818d655d7af5069adacb51884e662d7a8d5f6 Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 15:21:03 +0000
Subject: [PATCH 76/79] Fix issue while rebasing


---

diff --git a/pagure/ui/login.py b/pagure/ui/login.py
index 8c5be80..0c415f5 100644
--- a/pagure/ui/login.py
+++ b/pagure/ui/login.py
@@ -121,6 +121,8 @@ def do_login():
             return flask.redirect(flask.url_for('auth_login'))
 
         else:
+
+            if not user_obj.password.startswith('$2$'):
                 user_obj.password = generate_hashed_value(form.password.data)
                 SESSION.add(user_obj)
 

From 96d198ccd072c99939d3a541133f6b569771488e Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 16:19:24 +0000
Subject: [PATCH 77/79] Add name and update the date


---

diff --git a/pagure/lib/login.py b/pagure/lib/login.py
index 553886e..4227c94 100644
--- a/pagure/lib/login.py
+++ b/pagure/lib/login.py
@@ -1,10 +1,11 @@
 # -*- coding: utf-8 -*-
 
 """
- (c) 2015 - Copyright Red Hat Inc
+ (c) 2015-2016 - Copyright Red Hat Inc
 
  Authors:
    Pierre-Yves Chibon <pingou@pingoured.fr>
+   Farhaan Bukhsh <farhaan.bukhsh@gmail.com>
 
 """
 
diff --git a/pagure/ui/login.py b/pagure/ui/login.py
index 0c415f5..e84fb3d 100644
--- a/pagure/ui/login.py
+++ b/pagure/ui/login.py
@@ -5,6 +5,7 @@
 
  Authors:
    Pierre-Yves Chibon <pingou@pingoured.fr>
+   Farhaan Bukhsh <farhaan.bukhsh@gmail.com>
 
 """
 
diff --git a/tests/test_pagure_flask_ui_login.py b/tests/test_pagure_flask_ui_login.py
index 09f4284..454a50f 100644
--- a/tests/test_pagure_flask_ui_login.py
+++ b/tests/test_pagure_flask_ui_login.py
@@ -5,6 +5,7 @@
 
  Authors:
    Pierre-Yves Chibon <pingou@pingoured.fr>
+   Farhaan Bukhsh <farhaan.bukhsh@gmail.com>
 
 """
 
diff --git a/tests/test_pagure_lib_login.py b/tests/test_pagure_lib_login.py
index 94c7f6e..ae1ca5d 100644
--- a/tests/test_pagure_lib_login.py
+++ b/tests/test_pagure_lib_login.py
@@ -5,6 +5,7 @@
 
  Authors:
    Pierre-Yves Chibon <pingou@pingoured.fr>
+   Farhaan Bukhsh <farhaan.bukhsh@gmail.com>
 
 """
 

From 61f9f5311ea5b66772aa11c1661df139426b5f58 Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 16:34:11 +0000
Subject: [PATCH 78/79] Fix error message and redundant ifs


---

diff --git a/pagure/ui/login.py b/pagure/ui/login.py
index e84fb3d..c42ddf3 100644
--- a/pagure/ui/login.py
+++ b/pagure/ui/login.py
@@ -111,7 +111,7 @@ def do_login():
             flask.flash('Username or password of invalid format.', 'error')
             return flask.redirect(flask.url_for('auth_login'))
 
-        if not user_obj or not password_checks:
+        if not password_checks:
             flask.flash('Username or password invalid.', 'error')
             return flask.redirect(flask.url_for('auth_login'))
 
@@ -248,7 +248,6 @@ def reset_password(token):
 
     if form.validate_on_submit():
 
-
         user_obj.password = generate_hashed_value(form.password.data)
 
         user_obj.token = None
@@ -322,7 +321,7 @@ def change_password():
             SESSION.rollback()
             flask.flash('Could not set the new password.', 'error')
             APP.logger.debug(
-                'Password lost change - Error setting password.')
+                'Password change  - Error setting new password.')
             APP.logger.exception(err)
 
         return flask.redirect(flask.url_for('auth_login'))

From 002489888892a7b7f4b615e5a3c790b7c6fc26a7 Mon Sep 17 00:00:00 2001
From: farhaanbukhsh <farhaan.bukhsh@gmail.com>
Date: Jan 19 2016 16:42:58 +0000
Subject: [PATCH 79/79] Fix requirements.txt


---

diff --git a/requirements.txt b/requirements.txt
index c65e4df..ec26e4c 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -26,4 +26,4 @@ sqlalchemy >= 0.8
 straight.plugin==1.4.0-post-1
 trollius-redis
 wtforms
-bcrypt
+py-bcrypt