Repository: liqd/a4-opin

Issue:
No warning/help text when password entered incorrectly
When I try to log in with the wrong log in details, I don't get a message informing me what didn't work - i.e. wrong password/log in (Firefox, 47 on Mac).



Discussion:
The login code is supposed to work that way, so that no hint is given whether the username or password is the issue. I would support a change that behaviour.

I would recommend to support those error messages:
- user name not known
- user not activated
- password wrong 


Resolving patch:
diff --git a/euth/user_management/forms.py b/euth/user_management/forms.py
--- a/euth/user_management/forms.py
+++ b/euth/user_management/forms.py
@@ -15,6 +15,12 @@ class LoginForm(forms.Form):
 
     def clean(self):
         email = self.cleaned_data.get('email')
+        if email and not User.objects.filter(email=email):
+            if Registration.objects.filter(email=email):
+                raise ValidationError(_('account not activated'))
+            else:
+                raise ValidationError(_('account doesn\'t exist'))
+
         password = self.cleaned_data.get('password')
         user = authenticate(username=email, password=password)
         if not user or not user.is_active:
@@ -42,7 +48,7 @@ def clean_password_repeat(self):
         password1 = self.cleaned_data.get('password')
         password2 = self.cleaned_data.get('password_repeat')
         if password1 != password2:
-            raise ValidationError(_('passwords dont match'))
+            raise ValidationError(_('passwords don\'t match'))
         return password2
 
     def clean_username(self):
@@ -134,8 +140,8 @@ def clean_token(self):
     def clean_password_repeat(self):
         password1 = self.cleaned_data.get('password')
         password2 = self.cleaned_data.get('password_repeat')
-        if password1 != password2:
-            raise ValidationError(_('passwords dont match'))
+        if password1 and password1 != password2:
+            raise ValidationError(_('passwords don\'t match'))
         return password2
 
     def reset_password(self, request):


Test patch:
diff --git a/tests/user_management/test_views.py b/tests/user_management/test_views.py
--- a/tests/user_management/test_views.py
+++ b/tests/user_management/test_views.py
@@ -48,12 +48,30 @@ def test_form_valid_login(rf, user):
 @pytest.mark.django_db
 def test_form_invalid_login(rf, user):
     request = rf.post(
-        '', {'username': user.username, 'password': 'wrong_password'})
+        '', {'email': user.email, 'password': 'wrong_password'})
     form = forms.LoginForm(request.POST)
     assert form.is_valid() is False
     assert form.errors['__all__'] == ['password mismatch']
 
 
+@pytest.mark.django_db
+def test_form_invalid_user_login(rf, user):
+    request = rf.post(
+        '', {'email': 'i_dont_exist@liqd.de', 'password': 'password'})
+    form = forms.LoginForm(request.POST)
+    assert form.is_valid() is False
+    assert form.errors['__all__'] == ['account doesn\'t exist']
+
+
+@pytest.mark.django_db
+def test_form_not_active_login(rf, registration):
+    request = rf.post(
+        '', {'email': registration.email, 'password': 'password'})
+    form = forms.LoginForm(request.POST)
+    assert form.is_valid() is False
+    assert form.errors['__all__'] == ['account not activated']
+
+
 @pytest.mark.django_db
 def test_logout(user, client):
     logged_in = client.login(email=user.email, password='password')