Updated the @require_api_key decorator to not check for recent login dates for staff (which would include robots)

- Legacy-Id: 17937
This commit is contained in:
Henrik Levkowetz 2020-06-08 19:24:42 +00:00
parent c3b05d41b8
commit 49bf6090d0

View file

@ -63,9 +63,10 @@ def require_api_key(f, request, *args, **kwargs):
# Check time since regular login
person = key.person
last_login = person.user.last_login
time_limit = (datetime.datetime.now() - datetime.timedelta(days=settings.UTILS_APIKEY_GUI_LOGIN_LIMIT_DAYS))
if last_login == None or last_login < time_limit:
return err(400, "Too long since last regular login")
if not person.user.is_staff:
time_limit = (datetime.datetime.now() - datetime.timedelta(days=settings.UTILS_APIKEY_GUI_LOGIN_LIMIT_DAYS))
if last_login == None or last_login < time_limit:
return err(400, "Too long since last regular login")
# Log in
login(request, person.user)
# restore the user.last_login field, so it reflects only gui logins