vbatts/quay
Archived
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Only allow users matching the team invite to accept, if the invite was specified for a user (rather than an email)

Browse source
This commit is contained in:
Joseph Schorr 2014-09-12 14:29:01 -04:00
parent c5ca46a14b
commit 10faa7de84
7 changed files with 24 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

6
data/model/legacy.py
View file

@ -1988,6 +1988,12 @@ def delete_team_invite(code, user=None):
def confirm_team_invite(code, user):
found = lookup_team_invite(code)
# If the invite is for a specific user, we have to confirm that here.
if found.user is not None and found.user != user:
message = """This invite is intended for user "%s".
Please login to that account and try again.""" % found.user.username
raise DataModelException(message)
# Add the user to the team.
try:
add_user_to_team(user, found.team)