CGM_Public/pretix_cgo
1
0
Fork 0
forked from CGM_Public/pretix_original
Code Pull Requests Actions Activity

Fix #1521 -- External authenticated users cannot delete events (#1523)

Browse Source 
* Remove check password for event deletion, instead require recent login.

* Reauthenticate for backends using authentication_url.

* Require recent login for data shredder and prompt slug instead of password.

* Fix tests for recent login required on event delete and data shred.

* Pull request remarks for recent login required for event delete and data shred.

* Remove unused imported check_password.
This commit is contained in:
Maico Timmerman
2019-12-16 10:45:01 +01:00
committed by Raphael Michel
parent 28242e52aa
commit 82feca6e38
10 changed files with 45 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
src/pretix/control/templates/pretixcontrol/user/reauth.html
View File

@@ -8,7 +8,11 @@
{% csrf_token %}
<h3>{% trans "Welcome back!" %}</h3>
<p>
{% trans "We just want to make sure it's really you. Please re-enter your password to continue." %}
{% if form.backend.url %}
{% blocktrans trimmed with login_provider=form.backend.verbose_name %}We just want to make sure it's really you. Please re-authenticate with '{{ login_provider }}'.{% endblocktrans %}
{% else %}
{% trans "We just want to make sure it's really you. Please re-enter your password to continue." %}
{% endif %}
</p>
{% bootstrap_form form %}
<input class="form-control" id="webauthn-response" name="webauthn"
@@ -23,9 +27,15 @@
</small></p>
{% endif %}
<div class="form-group text-right flip">
<button type="submit" class="btn btn-primary btn-block">
{% trans "Continue" %}
</button>
{% if form.backend.url %}
<a href="{{ form.backend.url }}" class="btn btn-primary btn-block">
{% trans "Continue" %}
</a>
{% else %}
<button type="submit" class="btn btn-primary btn-block">
{% trans "Continue" %}
</button>
{% endif %}
<a href="{% url "control:auth.logout" %}" class="btn btn-link btn-block">
{% trans "Log in as someone else" %}
</a>