From 9694ba61c4317a019a3fb3f2834dbb7ba3cb5774 Mon Sep 17 00:00:00 2001
From: Emmanuel Viennet <emmanuel.viennet@gmail.com>
Date: Wed, 13 Oct 2021 21:00:03 +0200
Subject: [PATCH] =?UTF-8?q?Evite=20les=20erreurs=20de=20formulaires=20POST?=
 =?UTF-8?q?=20quand=20l'utilisateur=20s'est=20d=C3=A9connect=C3=A9=20dans?=
 =?UTF-8?q?=20un=20autre=20onglet?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 app/auth/routes.py            |  5 ++++-
 app/decorators.py             | 17 ++++++++++++-----
 app/templates/auth/login.html |  5 +++++
 3 files changed, 21 insertions(+), 6 deletions(-)

diff --git a/app/auth/routes.py b/app/auth/routes.py
index 8f01a0c19..bf7272a75 100644
--- a/app/auth/routes.py
+++ b/app/auth/routes.py
@@ -46,7 +46,10 @@ def login():
         if not next_page or url_parse(next_page).netloc != "":
             next_page = url_for("scodoc.index")
         return redirect(next_page)
-    return render_template("auth/login.html", title=_("Sign In"), form=form)
+    message = request.args.get("message", "")
+    return render_template(
+        "auth/login.html", title=_("Sign In"), form=form, message=message
+    )
 
 
 @bp.route("/logout")
diff --git a/app/decorators.py b/app/decorators.py
index 65b89905b..df67751ae 100644
--- a/app/decorators.py
+++ b/app/decorators.py
@@ -10,12 +10,10 @@ import logging
 import werkzeug
 from werkzeug.exceptions import BadRequest
 import flask
-from flask import g
-from flask import abort, current_app
-from flask import request
+from flask import g, current_app, request
+from flask import abort, url_for, redirect
 from flask_login import current_user
 from flask_login import login_required
-from flask import current_app
 import flask_login
 
 import app
@@ -52,6 +50,15 @@ def scodoc(func):
 
     @wraps(func)
     def scodoc_function(*args, **kwargs):
+        # interdit les POST si pas loggué
+        if request.method == "POST" and not current_user.is_authenticated:
+            current_app.logger.info("POST by non authenticated user")
+            return redirect(
+                url_for(
+                    "auth.login",
+                    message="La page a expiré. Identifiez-vous et recommencez l'opération",
+                )
+            )
         if "scodoc_dept" in kwargs:
             dept_acronym = kwargs["scodoc_dept"]
             # current_app.logger.info("setting dept to " + dept_acronym)
@@ -81,7 +88,7 @@ def permission_required(permission):
 
 
 def permission_required_compat_scodoc7(permission):
-    """Décorateur pour les fonctions utilisée comme API dans ScoDoc 7
+    """Décorateur pour les fonctions utilisées comme API dans ScoDoc 7
     Comme @permission_required mais autorise de passer directement
     les informations d'auth en paramètres:
         __ac_name, __ac_password
diff --git a/app/templates/auth/login.html b/app/templates/auth/login.html
index 2685383db..d636e053e 100644
--- a/app/templates/auth/login.html
+++ b/app/templates/auth/login.html
@@ -2,6 +2,11 @@
 {% import 'bootstrap/wtf.html' as wtf %}
 
 {% block app_content %}
+
+{% if message %}
+<div class="alert alert-danger" role="alert">{{ message }}</div>
+{% endif %}
+
 <h1>Connexion</h1>
 <div class="row">
     <div class="col-md-4">