Fix #1521 -- External authenticated users cannot delete events (#1523)

* Remove check password for event deletion, instead require recent login.

* Reauthenticate for backends using authentication_url.

* Require recent login for data shredder and prompt slug instead of password.

* Fix tests for recent login required on event delete and data shred.

* Pull request remarks for recent login required for event delete and data shred.

* Remove unused imported check_password.
This commit is contained in:
Maico Timmerman
2019-12-16 10:45:01 +01:00
committed by Raphael Michel
parent 28242e52aa
commit 82feca6e38
10 changed files with 45 additions and 41 deletions

View File

@@ -1,4 +1,5 @@
import datetime
import time
from decimal import Decimal
import pytz
@@ -1553,8 +1554,10 @@ class EventDeletionTest(SoupTest):
self.client.login(email='dummy@dummy.dummy', password='dummy')
def test_delete_allowed(self):
session = self.client.session
session['pretix_auth_login_time'] = int(time.time())
session.save()
self.client.post('/control/event/ccc/30c3/delete/', {
'user_pw': 'dummy',
'slug': '30c3'
})