From e0235688988cbc991861dcb72b0c0c23a05ce48b Mon Sep 17 00:00:00 2001 From: Diana Huang Date: Thu, 18 Dec 2014 14:45:56 -0500 Subject: [PATCH] Prevent inactive users from logging in through registration page. --- common/djangoapps/third_party_auth/pipeline.py | 4 ++-- common/djangoapps/third_party_auth/tests/specs/base.py | 5 +++++ 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/common/djangoapps/third_party_auth/pipeline.py b/common/djangoapps/third_party_auth/pipeline.py index 0a54701fbde7..cb75c7354499 100644 --- a/common/djangoapps/third_party_auth/pipeline.py +++ b/common/djangoapps/third_party_auth/pipeline.py @@ -528,12 +528,12 @@ def ensure_user_information( if dispatch_to_login_2: return redirect(_create_redirect_url(AUTH_DISPATCH_URLS[AUTH_ENTRY_LOGIN_2], strategy)) - if is_register and user_unset: + if is_register and (user_unset or user_inactive): return redirect(_create_redirect_url(AUTH_DISPATCH_URLS[AUTH_ENTRY_REGISTER], strategy)) # TODO (ECOM-369): Consolidate this with `is_register` # once the A/B test completes. # pylint: disable=fixme - if is_register_2 and user_unset: + if is_register_2 and (user_unset or user_inactive): return redirect(_create_redirect_url(AUTH_DISPATCH_URLS[AUTH_ENTRY_REGISTER_2], strategy)) diff --git a/common/djangoapps/third_party_auth/tests/specs/base.py b/common/djangoapps/third_party_auth/tests/specs/base.py index 3c34754931ea..68ea3a60085c 100644 --- a/common/djangoapps/third_party_auth/tests/specs/base.py +++ b/common/djangoapps/third_party_auth/tests/specs/base.py @@ -685,6 +685,11 @@ def test_full_pipeline_succeeds_registering_new_account(self): created_user = self.get_user_by_email(strategy, email) self.assert_password_overridden_by_pipeline(overridden_password, created_user.username) + # force the user to be active so we can check login afterwards + # TODO: test path when user is not active + strategy.request.user.is_active = True + strategy.request.user.save() + # At this point the user object exists, but there is no associated # social auth. self.assert_social_auth_does_not_exist_for_user(created_user, strategy)