06/15 Fix issues

app/blueprints/auth/routes.py

@@ -80,13 +80,13 @@ def login():
         user.last_login_at = datetime.utcnow()
         db.session.commit()
         nxt = request.args.get("next")
-        if nxt and nxt.startswith("/"):
+        if nxt and nxt.startswith("/") and not nxt.startswith("//"):
             return redirect(nxt)
         return redirect(url_for("main.index"))
     return render_template("auth/login.html", form=form)
 
 
-@auth_bp.route("/logout")
+@auth_bp.route("/logout", methods=["POST"])
 @login_required
 def logout():
     logout_user()
@@ -119,7 +119,7 @@ def reset_request():
     if form.validate_on_submit():
         user = User.query.filter_by(email=form.email.data.lower()).first()
         if user:
-            token = generate_token(user.id, _RESET_SALT)
+            token = generate_token((user.id, user.password_hash[:20]), _RESET_SALT)
             link = url_for("auth.reset_password", token=token, _external=True)
             send_email(user.email, _("Reset your password"),
                        _("Reset link: %(link)s", link=link))
@@ -131,14 +131,19 @@ def reset_request():
 
 @auth_bp.route("/reset/<token>", methods=["GET", "POST"])
 def reset_password(token):
-    user_id = read_token(token, _RESET_SALT,
+    payload = read_token(token, _RESET_SALT,
                          current_app.config["TOKEN_RESET_MAX_AGE"])
-    if user_id is None:
+    # payload is (user_id, pw_fingerprint) — fingerprint invalidates on use
+    if not isinstance(payload, (list, tuple)) or len(payload) != 2:
         flash(_("Reset link is invalid or expired."), "danger")
         return redirect(url_for("auth.reset_request"))
+    user_id, pw_fingerprint = payload
     user = db.session.get(User, user_id)
     if user is None:
         abort(404)
+    if user.password_hash[:20] != pw_fingerprint:
+        flash(_("Reset link has already been used."), "danger")
+        return redirect(url_for("auth.reset_request"))
     form = ResetForm()
     if form.validate_on_submit():
         user.set_password(form.password.data)

app/blueprints/i18n/routes.py

@@ -4,6 +4,7 @@ Order: explicit session choice -> authenticated user.locale -> Accept-Language -
 """
 from flask import Blueprint, session, redirect, request, current_app, url_for
 from flask_login import current_user
+from app.utils import safe_referrer
 
 i18n_bp = Blueprint("i18n", __name__)
 
@@ -34,5 +35,4 @@ def set_lang(code):
             from app.extensions import db
             current_user.locale = code
             db.session.commit()
-    target = request.referrer or url_for("main.index")
-    return redirect(target)
+    return redirect(safe_referrer(url_for("main.index")))

app/blueprints/messaging/routes.py

@@ -11,6 +11,7 @@ from app.services import messaging as msvc
 from app.services import favorites as fsvc
 from app.services.contact import contact_revealed, mask_body
 from app.blueprints.messaging.forms import MessageForm
+from app.utils import safe_referrer
 
 messaging_bp = Blueprint("messaging", __name__)
 
@@ -37,6 +38,7 @@ def conversation(conv_id):
         abort(403)
 
     msvc.mark_conversation_read(conv, current_user)
+    # reveal controls the "contact info hidden" banner for the current reader
     reveal = contact_revealed(current_user)
     form = MessageForm()
 
@@ -47,9 +49,10 @@ def conversation(conv_id):
         except msvc.MessagingError as e:
             flash(str(e), "danger")
 
-    # mask contact info in messages for low-trust users
+    # Mask is based on the *sender's* trust so a low-trust sender cannot
+    # slip contact info through to a trusted reader.
     masked_messages = [
-        (msg, mask_body(msg.body, reveal=reveal))
+        (msg, mask_body(msg.body, reveal=contact_revealed(msg.sender)))
         for msg in conv.messages
     ]
     return render_template("messaging/conversation.html",
@@ -103,8 +106,8 @@ def toggle_favorite(listing_id):
     if request.headers.get("X-Requested-With") == "XMLHttpRequest":
         return jsonify(favorited=now_fav)
     flash(_("Saved.") if now_fav else _("Removed from saved."), "info")
-    return redirect(request.referrer or url_for("listings.detail",
-                                                listing_id=listing_id))
+    return redirect(safe_referrer(url_for("listings.detail",
+                                         listing_id=listing_id)))
 
 
 @messaging_bp.route("/my/favorites")