06/15 Fix issues

app/blueprints/auth/routes.py

@@ -80,13 +80,13 @@ def login():
         user.last_login_at = datetime.utcnow()
         db.session.commit()
         nxt = request.args.get("next")
-        if nxt and nxt.startswith("/"):
+        if nxt and nxt.startswith("/") and not nxt.startswith("//"):
             return redirect(nxt)
         return redirect(url_for("main.index"))
     return render_template("auth/login.html", form=form)
 
 
-@auth_bp.route("/logout")
+@auth_bp.route("/logout", methods=["POST"])
 @login_required
 def logout():
     logout_user()
@@ -119,7 +119,7 @@ def reset_request():
     if form.validate_on_submit():
         user = User.query.filter_by(email=form.email.data.lower()).first()
         if user:
-            token = generate_token(user.id, _RESET_SALT)
+            token = generate_token((user.id, user.password_hash[:20]), _RESET_SALT)
             link = url_for("auth.reset_password", token=token, _external=True)
             send_email(user.email, _("Reset your password"),
                        _("Reset link: %(link)s", link=link))
@@ -131,14 +131,19 @@ def reset_request():
 
 @auth_bp.route("/reset/<token>", methods=["GET", "POST"])
 def reset_password(token):
-    user_id = read_token(token, _RESET_SALT,
+    payload = read_token(token, _RESET_SALT,
                          current_app.config["TOKEN_RESET_MAX_AGE"])
-    if user_id is None:
+    # payload is (user_id, pw_fingerprint) — fingerprint invalidates on use
+    if not isinstance(payload, (list, tuple)) or len(payload) != 2:
         flash(_("Reset link is invalid or expired."), "danger")
         return redirect(url_for("auth.reset_request"))
+    user_id, pw_fingerprint = payload
     user = db.session.get(User, user_id)
     if user is None:
         abort(404)
+    if user.password_hash[:20] != pw_fingerprint:
+        flash(_("Reset link has already been used."), "danger")
+        return redirect(url_for("auth.reset_request"))
     form = ResetForm()
     if form.validate_on_submit():
         user.set_password(form.password.data)