Fix the token verification and remove support for legacy tokens (#273)

Author: JAicewizard

website/members/tokens.py

@@ -16,33 +16,17 @@ def check_token(self, user, token):
         # Parse the token
         try:
             ts_b36, _ = token.split("-")
-            # RemovedInDjango40Warning.
-            legacy_token = len(ts_b36) < 4
-        except ValueError:
-            return False
-
-        try:
             ts = base36_to_int(ts_b36)
         except ValueError:
             return False
 
         # Check that the timestamp/uid has not been tampered with
-        if not constant_time_compare(self._make_token_with_timestamp(user, ts), token):
-            # RemovedInDjango40Warning: when the deprecation ends, replace
-            # with:
-            #   return False
-            if not constant_time_compare(
-                self._make_token_with_timestamp(user, ts, legacy=True),
-                token,
-            ):
-                return False
-
-        # RemovedInDjango40Warning: convert days to seconds and round to
-        # midnight (server time) for pre-Django 3.1 tokens.
+        if not constant_time_compare(
+            self._make_token_with_timestamp(user, ts, secret), token
+        ):
+            return False
+
         now = self._now()
-        if legacy_token:
-            ts *= 24 * 60 * 60
-            ts += int((now - datetime.combine(now.date(), time.min)).total_seconds())
         # Check the timestamp is within limit.
         if (self._num_seconds(now) - ts) > settings.ACCOUNT_ACTIVATION_TIMEOUT:
             return False