Ticket #14405: patch-14405.diff

views.py

@@ -26 +26 @@
     """Displays the login form and handles the login action."""
 
     redirect_to = request.REQUEST.get(redirect_field_name, '')
+    
+    # Light security check -- make sure redirect_to isn't garbage.
+    if not redirect_to or ' ' in redirect_to:
+        redirect_to = settings.LOGIN_REDIRECT_URL
+        
+    # Heavier security check -- redirects to http://example.com should
+    # not be allowed, but things like /view/?param=http://example.com
+    # should be allowed. This regex checks if there is a '//' *before* a
+    # question mark.
+    elif '//' in redirect_to and re.match(r'[^\?]*//', redirect_to):
+        redirect_to = settings.LOGIN_REDIRECT_URL
 
+    # Okay, security checks complete.
     if request.method == "POST":
         form = authentication_form(data=request.POST)
         if form.is_valid():
-            # Light security check -- make sure redirect_to isn't garbage.
-            if not redirect_to or ' ' in redirect_to:
-                redirect_to = settings.LOGIN_REDIRECT_URL
 
-            # Heavier security check -- redirects to http://example.com should
-            # not be allowed, but things like /view/?param=http://example.com
-            # should be allowed. This regex checks if there is a '//' *before* a
-            # question mark.
-            elif '//' in redirect_to and re.match(r'[^\?]*//', redirect_to):
-                    redirect_to = settings.LOGIN_REDIRECT_URL
-
-            # Okay, security checks complete. Log the user in.
+            # Log the user in.
             auth_login(request, form.get_user())
 
             if request.session.test_cookie_worked():
@@ -50 +52 @@
             return HttpResponseRedirect(redirect_to)
 
     else:
+        if request.user.is_authenticated(): # they are already logged in
+             return HttpResponseRedirect(redirect_to)
         form = authentication_form(request)
 
     request.session.set_test_cookie()