fix Restore password for archived users

also refuse to activate archived users automatically

Author: elelay

mygpo/users/views/registration.py

@@ -1,3 +1,4 @@
+import logging
 import re
 
 from django import forms
@@ -18,6 +19,9 @@
 from mygpo.users.models import UserProxy
 
 
+logger = logging.getLogger(__name__)
+
+
 USERNAME_MAXLEN = get_user_model()._meta.get_field("username").max_length
 
 
@@ -144,14 +148,21 @@ def get(self, request, activation_key):
             user = UserProxy.objects.get(
                 profile__activation_key=activation_key,
                 is_active=False,
-                profile__archived_date__isnull=True,
             )
         except UserProxy.DoesNotExist:
             messages.error(
                 request,
-                _("The activation link is either not " "valid or has already expired."),
+                _("The activation link is either not valid or has already expired."),
             )
             return super(ActivationView, self).get(request, activation_key)
+        if user.profile.archived_date:
+            logger.warning("Strange attempt to activate from archived user %s", user.id)
+            messages.error(
+                request,
+                _("Your account has been archived. It can't be re-activated automatically. Please see https://github.com/gpodder/mygpo/issues/866"),
+            )
+            return super(ActivationView, self).get(request, activation_key)
+
 
         user.activate()
         messages.success(

mygpo/users/views/user.py

@@ -139,7 +139,14 @@ def restore_password(request):
         messages.error(request, _("User does not exist."))
         return render(request, "password_reset_failed.html")
 
-    if not user.is_active:
+    # Archived users don't have an activation key. Indeed we don't want them to
+    # reactivate unintentionally.
+    if not user.is_active and not user.profile.archived_date:
+        # reset activation key, or we send links to /activate/None !
+        if not user.profile.activation_key:
+            logger.warning("user %s had an empty activation key", user.id)
+            user.profile.activation_key = random_token()
+            user.profile.save()
         send_activation_email(user, request)
         messages.error(
             request,