Ticket #14405: patch-14405.4.diff

views.py

@@ -27 +27 @@
 
     redirect_to = request.REQUEST.get(redirect_field_name, '')
 
-    if request.method == "POST":
-        form = authentication_form(data=request.POST)
-        if form.is_valid():
+    if request.method == "POST" or request.user.is_authenticated():
+        if request.method == "POST" and not request.user.is_authenticated():
+            form = authentication_form(data=request.POST)
+        if request.user.is_authenticated() or form.is_valid():
             # Light security check -- make sure redirect_to isn't garbage.
             if not redirect_to or ' ' in redirect_to:
                 redirect_to = settings.LOGIN_REDIRECT_URL
@@ -39 +40 @@
             # should be allowed. This regex checks if there is a '//' *before* a
             # question mark.
             elif '//' in redirect_to and re.match(r'[^\?]*//', redirect_to):
-                    redirect_to = settings.LOGIN_REDIRECT_URL
-
+                redirect_to = settings.LOGIN_REDIRECT_URL
+            
             # Okay, security checks complete. Log the user in.
-            auth_login(request, form.get_user())
+            if request.method == "POST" and not request.user.is_authenticated():
+                auth_login(request, form.get_user())
+                if request.session.test_cookie_worked():
+                    request.session.delete_test_cookie()
 
-            if request.session.test_cookie_worked():
-                request.session.delete_test_cookie()
-
             return HttpResponseRedirect(redirect_to)
 
     else: