Prevent account enumeration when creating a project

Fixes #9

src/app/models/project.py

@@ -127,6 +127,8 @@ def get_user_permissions(userid, projectid):
     try:
         cursor.execute(query, (projectid, userid))
         permissions = cursor.fetchall()
+        if len(permissions):
+            return permissions[0]
     except mysql.connector.Error as err:
         logger.error("Failed executing query: %s", err)
         cursor.fetchall()
@@ -135,9 +137,6 @@ def get_user_permissions(userid, projectid):
         cursor.close()
         db.close()
 
-    if len(permissions):
-        return permissions[0]
-
     return [0, 0, 0]
 
 

src/app/views/new_project.py

@@ -70,44 +70,42 @@ class New_project:
             if len(data.user_name_0):
                 status = "in progress"
 
-            # Validate the input user names
-            for i in range(0, user_count):
-                if len(data["user_name_"+str(i)]) and not models.user.get_user_id_by_name(data["user_name_"+str(i)]):
-                    return render.new_project(nav, project_form, project_buttons,  "Invalid user: " + data["user_name_"+str(i)])
-
             # Save the project to the database
             projectid = models.project.set_project(data.category_name, str(session.userid),
-            data.project_title, data.project_description, status)
+                                                   data.project_title, data.project_description, status)
 
             # Save the tasks in the database
             for i in range(0, task_count):
-                models.project.set_task(str(projectid), (data["task_title_" + str(i)]),
-                (data["task_description_" + str(i)]), (data["budget_" + str(i)]))
+                models.project.set_task(str(projectid),
+                                        (data["task_title_" + str(i)]),
+                                        (data["task_description_" + str(i)]),
+                                        (data["budget_" + str(i)]))
 
-            # Save the users in the database given that the input field is not empty
+            # Validate the input user names. If the user doesn't exist we silently ignore it
             for i in range(0, user_count):
-                if len(data["user_name_"+str(i)]):
-                    userid = models.user.get_user_id_by_name(data["user_name_"+str(i)])
-                    read, write, modify = "FALSE", "FALSE", "FALSE"
-                    try:
-                        data["read_permission_"+str(i)]
-                        read = "TRUE"
-                    except Exception as e:
-                        read = "FALSE"
-                        pass
-                    try:
-                        data["write_permission_"+str(i)]
-                        write = "TRUE"
-                    except Exception as e:
-                        write = "FALSE"
-                        pass
-                    try:
-                        data["modify_permission_"+str(i)]
-                        modify = "TRUE"
-                    except Exception as e:
-                        modify = "FALSE"
-                        pass
-                    models.project.set_projects_user(str(projectid), str(userid), read, write, modify)
+                username = data["user_name_"+str(i)]
+                if len(username):
+                    userid = models.user.get_user_id_by_name(username)
+                    if userid:
+                        # Save the users in the database given that the input field is not empty
+                        read, write, modify = 0, 0, 0
+                        try:
+                            data["read_permission_"+str(i)]
+                            read = 1
+                        except Exception as e:
+                            pass
+                        try:
+                            data["write_permission_"+str(i)]
+                            write = 1
+                        except Exception as e:
+                            pass
+                        try:
+                            data["modify_permission_"+str(i)]
+                            modify = 1
+                        except Exception as e:
+                            pass
+                        models.project.set_projects_user(projectid, userid, read, write, modify)
+
             raise web.seeother('/?projects=my')
 
     def compose_form(self, data, operation):