Repository: zulip/zulip

Issue:
Too many redirects for a account during login of deactivated account
I deactivated my Zulip account and then signed up again and tried to sign in. For wrong password, it showed wrong password, when i entered correct credentials, chrome showed
```
chat.zulip.org redirected you too many times.
Try clearing your cookies.
ERR_TOO_MANY_REDIRECTS
```
Clearing cookies did not work as a solution for it.


Discussion:
Hello @zulip/server-authentication members, this issue was labeled with the **area: authentication** label, so you may want to check it out!
@AyushyaChitransh thanks for the bug report!  It's not clear we want to always allow re-activating a deactivated account without administrator approval, but we certainly shouldn't just have this sort of redirect loop happen.

For your specific situation, I've reactivated your accounts on chat.zulip.org (you can re-deactivate whichever of the two you don't want).
At the very least, we need to provide a good error message for trying to login to a deactivated account, since this failure mode is really confusing.  I think we want to the error message to say something like "Your Zulip account has been deactivated.  If you'd like your account to be reactivated, please contact the administrators for your Zulip organization."

@umairwaheed can you take a look at doing that?


Sure. @zulipbot claim.
@AyushyaChitransh, so I have been trying to reproduce this issue. This is my procedure:

0. Enable EmailAuth authentication method.
1. Signup with an email, e.g. 'umair@zulip.com'.
2. Deactivate 'umair@zulip.com'.
3. Register again with 'umair@zulip.com'.
4. Click the link in the email. At this stage I get this error:
```
You've already registered with this email address. Please sign in below. 
```

Is there anything I am missing?
For the time being, I am just changing the error message for the deactivated accounts.
@umairwaheed I tried to recreate the issue again and am getting the same thing. The steps were:
1. Visit https://chat.zulip.org/login/
2. I did have account so I tried to log in with the same, ayushyachitransh@gmail.com.
3. Deactivated the account ayushyachitransh@gmail.com
4. Zulip redirected me to step 1, and there I tried to login with the same email id (here ayushyachitransh@gmail.com) and password.

Results:
1. After step 2, I got 403, probably this needs to have a separate issue of its own. Message displayed was:
```
CSRF verification failed. Request aborted.
More information is available with DEBUG=True
```
2. After step 4, I received the same error as mentioned while opening the issue.
```
The chat.zulip.org page isn’t working

chat.zulip.org redirected you too many times.
Try clearing your cookies.
ERR_TOO_MANY_REDIRECTS
```

Note:
I did not follow step 3, which says to register again. Maybe that may have been the reason for difference.

Resolving patch:
diff --git a/zerver/forms.py b/zerver/forms.py
--- a/zerver/forms.py
+++ b/zerver/forms.py
@@ -257,6 +257,12 @@ def clean_username(self):
                 settings.ZULIP_ADMINISTRATOR)
             raise ValidationError(mark_safe(error_msg))
 
+        if not user_profile.is_active:
+            error_msg = (u"Sorry for the trouble, but your account has been "
+                         u"deactivated. Please contact %s to reactivate "
+                         u"it.") % (settings.ZULIP_ADMINISTRATOR,)
+            raise ValidationError(mark_safe(error_msg))
+
         if not check_subdomain(get_subdomain(self.request), user_profile.realm.subdomain):
             logging.warning("User %s attempted to password login to wrong subdomain %s" %
                             (user_profile.email, get_subdomain(self.request)))


Test patch:
diff --git a/zerver/tests/test_decorators.py b/zerver/tests/test_decorators.py
--- a/zerver/tests/test_decorators.py
+++ b/zerver/tests/test_decorators.py
@@ -755,7 +755,9 @@ def test_login_deactivated_user(self):
         do_deactivate_user(user_profile)
 
         result = self.login_with_return(self.example_email("hamlet"))
-        self.assert_in_response("Please enter a correct email and password", result)
+        self.assert_in_response(
+            "Sorry for the trouble, but your account has been deactivated",
+            result)
 
     def test_webhook_deactivated_user(self):
         # type: () -> None