{"action":"created","comment":{"url":"https://api.github.com/repos/CenterForOpenScience/osf.io/pulls/comments/68506317","id":68506317,"diff_hunk":"@@ -51,88 +54,126 @@ def reset_password(auth, **kwargs):\n         }\n         raise HTTPError(400, data=error_data)\n \n-    if request.method == 'POST' and form.validate():\n-        # new random verification key, allows CAS to authenticate the user w/o password one time only.\n-        user_obj.verification_key = security.random_string(20)\n-        user_obj.set_password(form.password.data)\n-        user_obj.save()\n-        status.push_status_message('Password reset', kind='success', trust=False)\n-        # Redirect to CAS and authenticate the user with a verification key.\n-        return redirect(cas.get_login_url(\n-            web_url_for('user_account', _absolute=True),\n-            auto=True,\n-            username=user_obj.username,\n-            verification_key=user_obj.verification_key\n-        ))\n-\n-    forms.push_errors_to_status(form.errors)\n-    return {\n-        'verification_key': verification_key,\n-    }\n+    if request.method == 'GET':\n+        return {\n+            'verification_key': verification_key,\n+        }\n+\n+    if request.method == 'POST':\n+        if form.validate():\n+            # new random verification key, allows CAS to authenticate the user w/o password, one-time only.\n+            # this overwrite also invalidates the verification key generated by forgot_password_post\n+            user_obj.verification_key = generate_verification_key()\n+            user_obj.set_password(form.password.data)\n+            user_obj.save()\n+            status.push_status_message('Password reset', kind='success', trust=False)\n+            # redirect to CAS and authenticate the user with the one-time verification key.\n+            return redirect(cas.get_login_url(\n+                web_url_for('user_account', _absolute=True),\n+                username=user_obj.username,\n+                verification_key=user_obj.verification_key\n+            ))\n+        else:\n+            forms.push_errors_to_status(form.errors)\n+            # Don't go anywhere\n+            return {","path":"framework/auth/views.py","position":114,"original_position":114,"commit_id":"a1d53083ae95a949efba560453b44cc5a4646b9b","original_commit_id":"a1d53083ae95a949efba560453b44cc5a4646b9b","user":{"login":"icereval","id":3111541,"avatar_url":"https://avatars.githubusercontent.com/u/3111541?v=3","gravatar_id":"","url":"https://api.github.com/users/icereval","html_url":"https://github.com/icereval","followers_url":"https://api.github.com/users/icereval/followers","following_url":"https://api.github.com/users/icereval/following{/other_user}","gists_url":"https://api.github.com/users/icereval/gists{/gist_id}","starred_url":"https://api.github.com/users/icereval/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/icereval/subscriptions","organizations_url":"https://api.github.com/users/icereval/orgs","repos_url":"https://api.github.com/users/icereval/repos","events_url":"https://api.github.com/users/icereval/events{/privacy}","received_events_url":"https://api.github.com/users/icereval/received_events","type":"User","site_admin":false},"body":"^","created_at":"2016-06-26T17:39:25Z","updated_at":"2016-06-26T17:39:25Z","html_url":"https://github.com/CenterForOpenScience/osf.io/pull/5804#discussion_r68506317","pull_request_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/pulls/5804","_links":{"self":{"href":"https://api.github.com/repos/CenterForOpenScience/osf.io/pulls/comments/68506317"},"html":{"href":"https://github.com/CenterForOpenScience/osf.io/pull/5804#discussion_r68506317"},"pull_request":{"href":"https://api.github.com/repos/CenterForOpenScience/osf.io/pulls/5804"}}},"pull_request":{"url":"https://api.github.com/repos/CenterForOpenScience/osf.io/pulls/5804","id":72939648,"html_url":"https://github.com/CenterForOpenScience/osf.io/pull/5804","diff_url":"https://github.com/CenterForOpenScience/osf.io/pull/5804.diff","patch_url":"https://github.com/CenterForOpenScience/osf.io/pull/5804.patch","issue_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/issues/5804","number":5804,"state":"open","locked":false,"title":"[Fix][Improvement][Migration] Use CAS for all authentications and refactor Auth logic [#OSF-6438]","user":{"login":"cslzchen","id":3750414,"avatar_url":"https://avatars.githubusercontent.com/u/3750414?v=3","gravatar_id":"","url":"https://api.github.com/users/cslzchen","html_url":"https://github.com/cslzchen","followers_url":"https://api.github.com/users/cslzchen/followers","following_url":"https://api.github.com/users/cslzchen/following{/other_user}","gists_url":"https://api.github.com/users/cslzchen/gists{/gist_id}","starred_url":"https://api.github.com/users/cslzchen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cslzchen/subscriptions","organizations_url":"https://api.github.com/users/cslzchen/orgs","repos_url":"https://api.github.com/users/cslzchen/repos","events_url":"https://api.github.com/users/cslzchen/events{/privacy}","received_events_url":"https://api.github.com/users/cslzchen/received_events","type":"User","site_admin":false},"body":"## Purpose\r\n\r\nSubmitting username and password from OSF directly bypass the CAS Login CSRF protection. This PR moves all authentication (with a few safe exceptions) to be handled directly by CAS.\r\n\r\nUI co-contributer: @billyhunt\r\n\r\n## Main Ticket\r\n\r\nhttps://openscience.atlassian.net/browse/OSF-6438\r\n\r\n## Related Ticket\r\n\r\nhttps://openscience.atlassian.net/browse/SEC-26\r\nhttps://openscience.atlassian.net/browse/OSF-6450\r\nhttps://openscience.atlassian.net/browse/SEC-10 Part 3\r\n\r\n## Related CAS and fakeCAS PR\r\n\r\nhttps://github.com/CenterForOpenScience/cas-overlay/pull/18\r\nhttps://github.com/CenterForOpenScience/fakecas/pull/4\r\n\r\n## Changes\r\n\r\n### OSF Front-end\r\n\r\n- Home Page\r\n    - Replace drop-down sign in form with a button which redirects users to CAS login. \"Forgot Your Password\" and \"Institution Login\" links are moved to CAS as well.\r\n\r\n![home-page](https://cloud.githubusercontent.com/assets/3750414/15897220/aa2cb21e-2d61-11e6-89ea-39a308e72825.png)\r\n\r\n- Signup Page\r\n\r\n    - Remove redundant login from Signup Page. Add \"Already have an account?\" and \"Login through your institution\" to redirect users to CAS login.\r\n\r\n![signup-page](https://cloud.githubusercontent.com/assets/3750414/16128135/6681d8d8-33cd-11e6-9630-791a63faf6aa.png)\r\n\r\n- Forgot Password Notification\r\n\r\n    - Stay on `forgot_password.mako` with push notification instead of redirecting to Sign Up page\r\n\r\n![forgot-password-notification](https://cloud.githubusercontent.com/assets/3750414/16128218/cea108f8-33cd-11e6-92fe-e76f65edea0f.png)\r\n\r\n- Resend Confirmation Notification\r\n\r\n    - Whether unconfirmed email exists or not, use the same notification. This is consistent with Forgot Password.\r\n\r\n![resend-confirmation-notification](https://cloud.githubusercontent.com/assets/3750414/16128282/162395d8-33ce-11e6-95d1-834e0414056a.png)\r\n\r\n\r\n### OSF Back-end\r\n\r\n- Refactor CAS `get_login_url()`:\r\n\r\n![cas-verification-key](https://cloud.githubusercontent.com/assets/3750414/16129040/2ff2521c-33d1-11e6-913c-1728b1751189.png)\r\n\r\n- Claimed contributor will be redirected to the project page instead of profile page.\r\n\r\n- Hide security implementation by using new helper function `generate_verification_key()` and increase key length.\r\n\r\n- Refactor auth and contributor views + related views, routes, forms and tests.\r\n    - Divide `auth_login` into `auth_login` and `auth_register`\r\n    - Combine `forgot_password_get` and `forgot_password_put` into `forgot_password`\r\n    - Write comprehensive unit test + security for forgot and reset password\r\n    - Improve comments and TODO list\r\n    - Remove obsolete views, routes, tests, forms and fix broken routes\r\n\r\n\r\n### CAS Front-end\r\n\r\n- CAS login page serves as the only place where user submits username and password to sign in.\r\n    - Stayed Signed In (Persistent CAS TGC option: https://openscience.atlassian.net/browse/SEC-10)\r\n    - Forgot Password\r\n    - Institution Login\r\n    - Back to OSF\r\n    - Create Account\r\n\r\n![cas-login-page](https://cloud.githubusercontent.com/assets/3750414/15897398/4ddd0530-2d62-11e6-83d7-134ea4b5c944.png)\r\n\r\n### CAS Back-end\r\n\r\n- Disable explicit auto login in `casLoginView.jsp` that previously causes CSRF vulnerability.\r\n\r\n- Handle `(username, verification_key)` authentication internally, including:\r\n    - forgot password reset\r\n    - unregistered contributor set password\r\n    - create account\r\n    - merge user or add email\r\n    - send and resend confirmation\r\n\r\n### Other\r\n\r\n- Forgot Password, Create Account, Set Password (Unregistered Contributor) are still handled by OSF. It is safe since we use a one-time verification key as our CSRF token.\r\n\r\n- Institution Login & Prereg unchanged.\r\n\r\n- Compatible with two-factor login\r\n\r\n\r\n## Side effects\r\n\r\n- This breaks current fakeCAS for local development. Here is the [fakeCAS-#4](https://github.com/CenterForOpenScience/fakecas/pull/4).\r\n\r\n- This works with current CAS, but it is recommend to deploy this PR with [CAS-#18](https://github.com/CenterForOpenScience/cas-overlay/pull/18) together.\r\n\r\n- For deployment of new CAS: add new OSF `/register` url to CAS\r\n![cas-verification-key](https://cloud.githubusercontent.com/assets/3750414/15898489/879c3c38-2d66-11e6-97c0-7f8bd2002046.png)","created_at":"2016-06-07T20:09:11Z","updated_at":"2016-06-26T17:39:25Z","closed_at":null,"merged_at":null,"merge_commit_sha":"c5a7d7cb1cf03b2af2149234c4d22bec593f146d","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/pulls/5804/commits","review_comments_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/pulls/5804/comments","review_comment_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/pulls/comments{/number}","comments_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/issues/5804/comments","statuses_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/statuses/a1d53083ae95a949efba560453b44cc5a4646b9b","head":{"label":"cslzchen:fix/cas-for-all","ref":"fix/cas-for-all","sha":"a1d53083ae95a949efba560453b44cc5a4646b9b","user":{"login":"cslzchen","id":3750414,"avatar_url":"https://avatars.githubusercontent.com/u/3750414?v=3","gravatar_id":"","url":"https://api.github.com/users/cslzchen","html_url":"https://github.com/cslzchen","followers_url":"https://api.github.com/users/cslzchen/followers","following_url":"https://api.github.com/users/cslzchen/following{/other_user}","gists_url":"https://api.github.com/users/cslzchen/gists{/gist_id}","starred_url":"https://api.github.com/users/cslzchen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cslzchen/subscriptions","organizations_url":"https://api.github.com/users/cslzchen/orgs","repos_url":"https://api.github.com/users/cslzchen/repos","events_url":"https://api.github.com/users/cslzchen/events{/privacy}","received_events_url":"https://api.github.com/users/cslzchen/received_events","type":"User","site_admin":false},"repo":{"id":46802921,"name":"osf.io","full_name":"cslzchen/osf.io","owner":{"login":"cslzchen","id":3750414,"avatar_url":"https://avatars.githubusercontent.com/u/3750414?v=3","gravatar_id":"","url":"https://api.github.com/users/cslzchen","html_url":"https://github.com/cslzchen","followers_url":"https://api.github.com/users/cslzchen/followers","following_url":"https://api.github.com/users/cslzchen/following{/other_user}","gists_url":"https://api.github.com/users/cslzchen/gists{/gist_id}","starred_url":"https://api.github.com/users/cslzchen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cslzchen/subscriptions","organizations_url":"https://api.github.com/users/cslzchen/orgs","repos_url":"https://api.github.com/users/cslzchen/repos","events_url":"https://api.github.com/users/cslzchen/events{/privacy}","received_events_url":"https://api.github.com/users/cslzchen/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/cslzchen/osf.io","description":"Facilitating Open Science","fork":true,"url":"https://api.github.com/repos/cslzchen/osf.io","forks_url":"https://api.github.com/repos/cslzchen/osf.io/forks","keys_url":"https://api.github.com/repos/cslzchen/osf.io/keys{/key_id}","collaborators_url":"https://api.github.com/repos/cslzchen/osf.io/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/cslzchen/osf.io/teams","hooks_url":"https://api.github.com/repos/cslzchen/osf.io/hooks","issue_events_url":"https://api.github.com/repos/cslzchen/osf.io/issues/events{/number}","events_url":"https://api.github.com/repos/cslzchen/osf.io/events","assignees_url":"https://api.github.com/repos/cslzchen/osf.io/assignees{/user}","branches_url":"https://api.github.com/repos/cslzchen/osf.io/branches{/branch}","tags_url":"https://api.github.com/repos/cslzchen/osf.io/tags","blobs_url":"https://api.github.com/repos/cslzchen/osf.io/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/cslzchen/osf.io/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/cslzchen/osf.io/git/refs{/sha}","trees_url":"https://api.github.com/repos/cslzchen/osf.io/git/trees{/sha}","statuses_url":"https://api.github.com/repos/cslzchen/osf.io/statuses/{sha}","languages_url":"https://api.github.com/repos/cslzchen/osf.io/languages","stargazers_url":"https://api.github.com/repos/cslzchen/osf.io/stargazers","contributors_url":"https://api.github.com/repos/cslzchen/osf.io/contributors","subscribers_url":"https://api.github.com/repos/cslzchen/osf.io/subscribers","subscription_url":"https://api.github.com/repos/cslzchen/osf.io/subscription","commits_url":"https://api.github.com/repos/cslzchen/osf.io/commits{/sha}","git_commits_url":"https://api.github.com/repos/cslzchen/osf.io/git/commits{/sha}","comments_url":"https://api.github.com/repos/cslzchen/osf.io/comments{/number}","issue_comment_url":"https://api.github.com/repos/cslzchen/osf.io/issues/comments{/number}","contents_url":"https://api.github.com/repos/cslzchen/osf.io/contents/{+path}","compare_url":"https://api.github.com/repos/cslzchen/osf.io/compare/{base}...{head}","merges_url":"https://api.github.com/repos/cslzchen/osf.io/merges","archive_url":"https://api.github.com/repos/cslzchen/osf.io/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/cslzchen/osf.io/downloads","issues_url":"https://api.github.com/repos/cslzchen/osf.io/issues{/number}","pulls_url":"https://api.github.com/repos/cslzchen/osf.io/pulls{/number}","milestones_url":"https://api.github.com/repos/cslzchen/osf.io/milestones{/number}","notifications_url":"https://api.github.com/repos/cslzchen/osf.io/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/cslzchen/osf.io/labels{/name}","releases_url":"https://api.github.com/repos/cslzchen/osf.io/releases{/id}","deployments_url":"https://api.github.com/repos/cslzchen/osf.io/deployments","created_at":"2015-11-24T16:08:53Z","updated_at":"2016-01-27T14:55:54Z","pushed_at":"2016-06-26T17:28:43Z","git_url":"git://github.com/cslzchen/osf.io.git","ssh_url":"git@github.com:cslzchen/osf.io.git","clone_url":"https://github.com/cslzchen/osf.io.git","svn_url":"https://github.com/cslzchen/osf.io","homepage":"http://osf.io","size":134216,"stargazers_count":0,"watchers_count":0,"language":"Python","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"develop"}},"base":{"label":"CenterForOpenScience:develop","ref":"develop","sha":"116303290830f9d426f4db348c889b7972487b0b","user":{"login":"CenterForOpenScience","id":3344584,"avatar_url":"https://avatars.githubusercontent.com/u/3344584?v=3","gravatar_id":"","url":"https://api.github.com/users/CenterForOpenScience","html_url":"https://github.com/CenterForOpenScience","followers_url":"https://api.github.com/users/CenterForOpenScience/followers","following_url":"https://api.github.com/users/CenterForOpenScience/following{/other_user}","gists_url":"https://api.github.com/users/CenterForOpenScience/gists{/gist_id}","starred_url":"https://api.github.com/users/CenterForOpenScience/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/CenterForOpenScience/subscriptions","organizations_url":"https://api.github.com/users/CenterForOpenScience/orgs","repos_url":"https://api.github.com/users/CenterForOpenScience/repos","events_url":"https://api.github.com/users/CenterForOpenScience/events{/privacy}","received_events_url":"https://api.github.com/users/CenterForOpenScience/received_events","type":"Organization","site_admin":false},"repo":{"id":10199599,"name":"osf.io","full_name":"CenterForOpenScience/osf.io","owner":{"login":"CenterForOpenScience","id":3344584,"avatar_url":"https://avatars.githubusercontent.com/u/3344584?v=3","gravatar_id":"","url":"https://api.github.com/users/CenterForOpenScience","html_url":"https://github.com/CenterForOpenScience","followers_url":"https://api.github.com/users/CenterForOpenScience/followers","following_url":"https://api.github.com/users/CenterForOpenScience/following{/other_user}","gists_url":"https://api.github.com/users/CenterForOpenScience/gists{/gist_id}","starred_url":"https://api.github.com/users/CenterForOpenScience/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/CenterForOpenScience/subscriptions","organizations_url":"https://api.github.com/users/CenterForOpenScience/orgs","repos_url":"https://api.github.com/users/CenterForOpenScience/repos","events_url":"https://api.github.com/users/CenterForOpenScience/events{/privacy}","received_events_url":"https://api.github.com/users/CenterForOpenScience/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/CenterForOpenScience/osf.io","description":"Facilitating Open Science","fork":false,"url":"https://api.github.com/repos/CenterForOpenScience/osf.io","forks_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/forks","keys_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/keys{/key_id}","collaborators_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/teams","hooks_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/hooks","issue_events_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/issues/events{/number}","events_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/events","assignees_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/assignees{/user}","branches_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/branches{/branch}","tags_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/tags","blobs_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/git/refs{/sha}","trees_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/git/trees{/sha}","statuses_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/statuses/{sha}","languages_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/languages","stargazers_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/stargazers","contributors_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/contributors","subscribers_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/subscribers","subscription_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/subscription","commits_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/commits{/sha}","git_commits_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/git/commits{/sha}","comments_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/comments{/number}","issue_comment_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/issues/comments{/number}","contents_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/contents/{+path}","compare_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/compare/{base}...{head}","merges_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/merges","archive_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/downloads","issues_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/issues{/number}","pulls_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/pulls{/number}","milestones_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/milestones{/number}","notifications_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/labels{/name}","releases_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/releases{/id}","deployments_url":"https://api.github.com/repos/CenterForOpenScience/osf.io/deployments","created_at":"2013-05-21T15:53:37Z","updated_at":"2016-06-25T23:07:12Z","pushed_at":"2016-06-26T17:28:45Z","git_url":"git://github.com/CenterForOpenScience/osf.io.git","ssh_url":"git@github.com:CenterForOpenScience/osf.io.git","clone_url":"https://github.com/CenterForOpenScience/osf.io.git","svn_url":"https://github.com/CenterForOpenScience/osf.io","homepage":"http://osf.io","size":284155,"stargazers_count":225,"watchers_count":225,"language":"Python","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":191,"mirror_url":null,"open_issues_count":210,"forks":191,"open_issues":210,"watchers":225,"default_branch":"develop"}},"_links":{"self":{"href":"https://api.github.com/repos/CenterForOpenScience/osf.io/pulls/5804"},"html":{"href":"https://github.com/CenterForOpenScience/osf.io/pull/5804"},"issue":{"href":"https://api.github.com/repos/CenterForOpenScience/osf.io/issues/5804"},"comments":{"href":"https://api.github.com/repos/CenterForOpenScience/osf.io/issues/5804/comments"},"review_comments":{"href":"https://api.github.com/repos/CenterForOpenScience/osf.io/pulls/5804/comments"},"review_comment":{"href":"https://api.github.com/repos/CenterForOpenScience/osf.io/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/CenterForOpenScience/osf.io/pulls/5804/commits"},"statuses":{"href":"https://api.github.com/repos/CenterForOpenScience/osf.io/statuses/a1d53083ae95a949efba560453b44cc5a4646b9b"}}}}
{"actor":{"display_login":"icereval"}}