From f941762e3487817a04e78a97e3ed0d047af550c1 Mon Sep 17 00:00:00 2001 From: NguyenND Date: Mon, 27 Apr 2026 15:13:24 -0400 Subject: [PATCH] 04/27 Updated customer invitation allow customer to create username & password 4 --- app/models/user.py | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/app/models/user.py b/app/models/user.py index a2e047f..ae9eb38 100644 --- a/app/models/user.py +++ b/app/models/user.py @@ -83,12 +83,19 @@ class User(UserMixin, db.Model): user = User.query.filter_by(set_password_token=token).first() if user is None: return None + # Guard: account must still be in pending-setup state + if user.password_set: + return None if user.set_password_token_expires is None: return None if now_eastern() > user.set_password_token_expires: return None - # Constant-time comparison — prevents timing oracle on the stored token - if not hmac.compare_digest(user.set_password_token, token): + # Constant-time comparison — prevents timing oracle on the stored token. + # Wrapped in try/except to guard against unexpected type mismatches. + try: + if not hmac.compare_digest(user.set_password_token, token): + return None + except (TypeError, ValueError): return None return user