From 5e1937d245c66b62aee4cc1c2a83991ecc7c5c6c Mon Sep 17 00:00:00 2001
From: adevopg <133045315+adevopg@users.noreply.github.com>
Date: Mon, 18 Nov 2024 09:44:02 +0100
Subject: [PATCH] Se arreglado un peque;o Fallo que al usar el hash se podria
 usar de nuevoy eso daba un fallo seguridad

---
 home/__pycache__/models.cpython-313.pyc      | Bin 13372 -> 13745 bytes
 home/__pycache__/views.cpython-313.pyc       | Bin 62430 -> 62746 bytes
 home/models.py                               |  16 ++++++++++++++--
 home/views.py                                |  17 ++++++++++++-----
 novawow/__pycache__/settings.cpython-313.pyc | Bin 4569 -> 4593 bytes
 novawow/settings.py                          |   4 ++--
 6 files changed, 28 insertions(+), 9 deletions(-)

diff --git a/home/__pycache__/models.cpython-313.pyc b/home/__pycache__/models.cpython-313.pyc
index eaebdf1e23e8fcdd631f6c8e8a2082feec03afcc..37632d778d3cdf2cbbbf1365aa4c256a62bb7f0a 100644
GIT binary patch
delta 948
zcmZvaYe<t(7{}jd&P`tD=5pG*&FQ<j<t{om^-FdkyBH`~_!1OK%XH~zI(?@}5@HZS
zRFpp11;h&o8WAcZ5DJr`4?`#~pfU{UVo)GxYJCbiXCf7K;QaXWKhHVO^PF>@*N$CO
zZX_hI3>i0n7SuQlok|YAk7Z6lfxrk*!W4rDJVUg!L{=;p<x%}#pJPmnpw%&gt_#vb
zddXwGWD;;X#Tr^OWPw6ph4{T7CRIqw%;?r>b_@+M?8Hbuno{PZb^JY|n>azCV??cx
zK&TUxqP|9DON^)stEvLc^-YCUO}<N&O};?=mj*0PKM+$Sw&FRL7DMSDpbhWw`Ds<~
z$EgycW60d#3A#y_Sjcg@Jc*gHNlIH)zmMZD1Vr8j_&!5_MEg%Nr^gd)5<Q-)<dk3%
zK|8ak=KD26h5<vrYFg!*j&q4d;)^DNQd=sH%F}V37Y{`ghXVn>x3a#-=k-@d<i4P%
zIq0p9sEMfews^dCl|Fye5^Z$9jG~vKk759q?FLmhl@twR1|!&S>@8Ai7L>+WrE%CY
zqja?&U*ysjIL9pK7(F(_6--N$7uCBL)RtMbWw>_4|Hwb1-q&9IO$xE4uqA_7_ja}2
z*l5*ai|H$L;Q5SExP?jP(=d*Hb2%HLNhvyT##{rTXlR+m51shJvJ7{zZ%;Ga$K=eB
z*w-ZLK87>(5XO~Ed;CkfHH{*S18$C;ppv2!_gnK}BGhPA0Q6v+?Xql=u3g7F>Owqd
zcfugn*>AH`)THP^nd1sf(cGaPhYaF}c2>lv_#|r{M(|p8EzIL;wjov=A&ba4^Vm5W
zMKOe@oNX|N>#P=6or9!{uAH-^!S$RIe3%9;6O5A?loNC?i%I4iaocwjCjaU!JVTee
zBJmRqU7`3)5vH%gE>TGl!dLE-u!Nf2H_6dki}oAsAzH{1{>U}3Yb26>&7cX>^2YeB
h6b20M7~=|)O1LTA1?~s3KE*@DCPU<A7Jke-^9zM55ljF8

delta 625
zcmY+AUuaTs6vyuwn_E}Cb=l@$)a%`J>P%<aLyZUvdMI#}P^(5YY^X~Vu5Of6v<F+^
zLu=<{V^9x8>(B5HMlkxr9&SPek`X0~+S=P-4^h@j6y2ZELkG@>!#UsY;rBbmvri+;
zH>HxMq*(vDGkjNngV8{_*z*c#4aHMIt&R%nromJ?(DYE>l!j@wt;89fuzRTeu#LF>
zk08ARgwCK`M+vH+LQsd5c4nFNheC<5c*-A2MaPFz(L{WG6sx9PxS9I}<ES+I+5}$O
z6R>M=wbg_SFW>`ShZbuGe&jdFMx|Nu5pM7|wXFI*Yk9+3?nUyk`>`t9e|i7+W@rgO
z>17uUkjA&&1(?8$We`gE$#R0uNnU{<jeD(O$l>cQEsE9{WYE*I0#}i>jX@SCZTXfZ
zNtMNZyB<V5YIn$=5v!3vM6*>xFOrfVgE_ko78|R6s~pG~o6+HT0aN(JabEU>$gbfM
z>&HT`3ubVo_c~oBO@b*r=ez)A;w>>-WgwsXHxUYGa=nAw_`?-}DxPv1m}SMDL?Sja
z9N!lmiJid-x0kLEIl&x0cVB`En&nzN(su{u@n_#jSis|+0Zt^M4-yunOtwn6Le<*4
zvu%QzOhjZkEv|VULmp?h4Q*K^&CdjDf5(TM2D(N{f_Zd$4?+zudMllcYc}rC_)z09
nH9YMz&>NBxq)e)C(pT)LtCSFc8QCqxtfEely3XO?_G5nl@bJ9n

diff --git a/home/__pycache__/views.cpython-313.pyc b/home/__pycache__/views.cpython-313.pyc
index ee78eb0d1aab0d8ba0166034f3bc49bf8a38ff44..ab5a13463a51ceff059fff7e035768d56016a60e 100644
GIT binary patch
delta 3182
zcmb_eeNa<Z7SB!c9wC9yKmsIui=)I3<U?H0MW9GT7i%?AtWnZ{sRl`cHvy{HiYtq=
zGvWtlZQW{7WYHEsDDy_Q)qko>9h7Z_t~+R^)mnG3y4$VR?rc}r?%s0~haLag+1WRf
z-~8_H+;h*#IrrWBZroA4eNUl%7#XRSv8V6J+;y672DD2{h*_#GIZH@_WGwxJkYu>C
zz)zB3n?(-|WqNfQk;!(mA5DQ>WiN*e|18sybkJHTA5Ya!VH5V@q{#?HZ2ek!XSyCn
zEOXe5u!S?pG{{@n!uY_#S!4#>TKF_XUAaM>$(*{-5knNirE*g!%n#*yk_C~A+@bOA
zMOu>E)3r!N@}xt{Zjfj_^D>Jx51qHLsC16B+nO!k8pniyhB})abgkXva673HrzqGI
zvyT22XY%RAsForuK<HtHK!l^V*4yau+t)h$4!(3CtkLJBc2@%}!CB8U2#CSO=}%CZ
zhl-9mYiXm)?_6t#qL-GCl~Tt`4v|>l+tt&>B{*$~l)9!~h_)f`#T-^KW{#kF&{dO0
zR>Ma%@tSHhVjk2Aw`(k71&%AES+(zpv1N=0!h^YZUiH#o_V8DiZQ4RKDQmpmdTK!r
zBd#!pP>#dv$o$9}!B>~J3|9(9S&od?kC(xRLtHnY;c*(gE|1?Aaz$C|bJjLemw%Jp
z@7>_^&?a<fCUAL2Vx-!=$sQ^meO;Qgp-E-%p!oqt_abXR*a#<m>0~a9`bt;wTF6nw
zTF}i1uOTEbpFrfR)a&-U+)kh0;chT%gNgF$VBP^$jl&ac(`xkDhERi03-x{@q0sKn
zAZ^g^PZW7oEYhfdpGa)5t|dvs|1@8#6n3|m#13@a1^q3Cluo2S!>swv--E-w2!QY_
zxZN@xhW+7E+?KCIQXoD0xs?!?^g`QqIVp$F+Sijhn78AnWDC5uqmA@QPj<8_NddgE
zbEbF*7dRvh?5tLr3Xt>K;5Mc%1UEuGnD-89>X05rD1;yOHj!rVcBV1h+iA$>%it!b
z2F&uAMsGp`FQtUm6oeO1I|(;Br;vCMAkWl|0*}E{D8ykeLNlxYv&aLVg6&X2&PXHh
zM|n^wgyU~|pVHK~;>7`U8Ib0`)hlWaAV0#QZLWio(|VA1RS_4g>PjF7p{Z*Ic}ME$
zQecUW9nO7@2RMnT^`qPSaPM%w$aiBMWOOHsTliv7(LFmD?i{ptyU9iA`|el;`4Z9+
z65vpU0a`mWVCkKsv?>bZuqQnU8r&L%!yp64{uJ;Qg->Otoh^!m;g3~m6|7=`e6q|M
zRw=JnJ=H7a@a22@PP<B;DuX}AB&)PCtEy7IJRVBU>y^0*j{>TX#wsfnHa+y`B<ii<
znF^26hLz=yRn1n|^F=I-^a&&t95Z6_HI+(hM1eB(Kch$Dp2KId%&dKZK4Q#bmeX@g
z4TQOTcJ|7xg`T4sLIzV-z?Gx#&(=``7Gf@&O7#fO^g0%;0vd*J6{XM7<b<AMS;Pca
zkCm!FVPcw6CiC5dw0AQsLyaT4>=9k%n9eq;v;9H0rgibS#<1TsX3QKlW{w%NMvYmY
zM<t9T&iklzG^%_=ReoQTnUY%<Usc9lQ)+iC-L~|q(f}LY-7RmI!?KRK|Iga%S*`Fd
z^2e&eKeap#(rifzMWq6=TlI2lIJN;66~_@dIEwX<-<JY4#W75Yg$J$4(N;C@OL}M#
znN@=_eA*WV-3MY~tr4s#k<T<m3qSVF%!!(42eu`kW9{%bo9#}w!&T24LoZ>eFCzro
zV>!N+oQI3Y-^`BrubXrQ-G>RhabkMPS;oym@HWDj)PzQUB7Mvle0$7jnn<C^<!q)S
zOfSTCCJ=ahVru#S)X&Ko*w567ets{)`JE<s<>ap;E+o!gkfRvPQJ2ZWU~hRo6rM7M
zF5eBObn4Go{8w0fI+@?p7f+>zjE_&n3s;%3R*LV}iy}V>3Z$IV+eyShCewEqSZJ4Y
z{>))Ai=SSx_>cK!#>*+7to8c*!CN{EExZiBL1u$JA7rLX99NT2ypD_VIb+DK!51GC
zh)0lafy56Bg`147ld3=LQ;`D@exZ)!f&apZ<aJCoE9iQh*oc64A`|#sa2w|Tt}mq=
zWqx1AW1wpY6DQ~<2pdd^N7sNDx*LblAsnFtiUw1r@G}e-45*sCey6>W*0a}=eHR46
z>m5G79Yy*gv<;?CX+y7ZoElDXqj}akDZPVZVy7)=yvG0@v?Rj#V2toLHt3Un9L!aO
zs%{yI68_G_Td->A=?B&AA%pM_rrm`nLmNZ$wqMc<kD2xj9K7TWX{nc^)lZmqAKRJD
z+BqLKUtSY3{^fF<@GoY32&&;@Tr<GO!_fkf%Vdw>^Wkfvf-xdUXMews2w{w?r4^sb
z2@#;`N|6x5gakNnWn7G7Y`OsJ#c9&Oh=LFUoF1Jjq%n1#bZc~xAY?JRSeiAa)sPNp
z{#PDCa;1~E^NEIE$2rVObEW%#+E2uKmJdybUE>vSb9^S53936?!Am<DPTc9ux1k+B
z8|W{P@%s-mqnHE5kaQAS)o8^G={{sx@XN0!iA6Z>fPt@He$Ie&HbNdkF_`XFk>`Ql
zohHsjp#+ZH%}y$1G@x<Ru6H?`oNlMbPczZTKN{x4{kwXx5XaG=zPD7UV$>;B--{MW
zKWx0;zBK_OCnKaGq$A)rG@XVp0|7sZX%<2*!b*fC2>grib!7aT2EY7h9|C`^&LHEL
z@<n8L{_|6V;;T#X6{R;x8AIGm6gLmW-9mADP}~m``%baZ6njj033<6D>WEFFRdDV>
b5~-7}KX{u&7)cfRE<csn$afal`q2Jw(uHrz

delta 2962
zcmai0dr*|u73c2b19oBK!Y=YySwNyJh=?EoG$8VBkw{jt6m+w&o4DZa;@t%`Xf!dw
ze<DOqBpn+OLX03HkZ&3%n3>o_%t*9?)?#-WI;lnxYdaVwahx>mJ$JFDPCNZ(_BX$K
z&OMJk_i^swY3bx`sp{LnK!p$c9?WLGbnWht>bV@!D{jsiCPXKO<z6C054ZE&BobaN
z&_I2@MiE1Nd|KI$MnOw{#hl`Yd^L#$RRQJW#hS%z!XcdWG(tA>Un6N-sDZJ9G&aMx
zFp(s{iozzwhYFKOB79x=C`4_MR*}SvI?xb9tcD9k;d5ag6lq8@1Qy%p#;wIFlG@!-
z>_^hXqh*sMNXx7Y0!>5XT`VenMr<`EOZJ2^fk#QL+s)Ksa+vK_8je$>Y>GimPvcBJ
zJqM+E2>A%zOyLPI*VH&09Bz}v>^5`P9^VF+m6~kzbPdkRW#AFK&S^SIR-r^qtu?g4
z=C)c)kX^o(REP)4%>r2uf3HdqN^x4L7`17uJg5r!G0dToF+%`NgO2KGvI)*shbm2|
z#60MFxKUjoti|zKF{!3k2q|FP<L}MI@uHJ@vxmRgD&vb#C98Hix6(qi2tyAO2*o)3
zBeDi$jo_+XQHGwpQH;oV{dgJNI7Gi5C680@v^m_aIa3s?T-KTfYIE;2xt(=Z2i=Ya
zI|z*K*UeYhcbevkM_*y`0*Q~0tCK+2aHyD9x86_d#K|+5OFgn}2o(BV3&~0tcjf+q
zS4M(TtPE{J*ohFqY&?N4Qm5T*vs+zmv%TJ+@}|veh5y3iS8aB97i|;TyoOMNV1cdf
zFyew{cN}>G2HZMO?eZ6Y?`{)F6};56K*|3<ca#UMP2oZdTD8JJlU5H%e~u}?h3p_g
z8^YTNhu}t2f`G-RMWSZcHv-8NAHHTJq*g3_eV>FB!<FVOqz+c@UqyDqj{UEbKJg#>
z_sU2nyz*wE(20hf;?SF$W#O5~d2Mi0(^>=vf*lM8&nfGWb|GZJgM*D^2RPfJ86IrY
zrgJyA<*61EePY>PMg=dWh*~{D8Olz<WZNPV269*t{vHZ=44y(34nIKH0qema@W2DG
z4@$^saSX0Wypk;FYj-}PQSXEbAEL>JV%9sy1oAH2JkmgF;g=l|<Ono&EFm3YcZU><
za=bHT9(UP~$qb^=5KMQb3w$@$L0ng)up6b_P|}s^4e$vxciG7o;%rxllr%$hL<GDb
zYGLmIC0y=JlVlLsdn|6gg<Woyfy^uaj8db_D9@0@wk^{ODj%b;K?3t)HL&gjf0)hI
zNTro3xEHJoGWsr+I%Ji2XuNiQFq0i3Q~9Jw;GZW#l8pWvWJX1XEb6Del`B|=_{Fj_
zTuL7@W+3zvCIsK(aWVsv)Z>G(DjI@+C6no?2H}bIkuw>D_ADb2P~4NNxX30)%h<s=
z1MNL=F=OiFF?GR&x@25ka#dZr_h+}1+CM!NF{WF2Hh27~qA|ZBkoC4omPnxNK;};>
z5%)hT;Zvz%@%U#Hc<AI%9ekSYOM-!<1QTEO&%;=843N;LCm|5MTFXYk@Y!T!kkOBq
zX~Dl8_(Rm6ql6U62Fdf0XsuPSIw_y1Qvl5LB}N2#D?~L|iwg*&2)s(`PVOO}!Pv?6
z=z0IIR*+m9488qfx--n$AopJ7Sb7?P?)Vu#50m`~ir=wu2G;R=R>wuLgKl2QRTJtp
z<LWh6)p`G|lCPfnjq<lisd;kgIk_S)7;*-lpX)q518T(>^H{+=(x-Wwk`6}ADboi-
z<yV-pO58B05rlU!lT6Y1(LNGz1UdG$0(w;Z@pLC4opAKyFfDIKzL+;p`F&(naOvZv
z`o||R289#ofX}&x><<t=oFQ~0-3=AP&&t1I^ab(P!zcXMfh+jDmZZVZ=O-h#FtI^O
zZ8)(J0WW_h;5XgZ&~)y^#$pun#t@2ut|L6Y9QduFV=|9mu{GMA7LPBx`JE1n%iCMf
zsYmd(2an8UZnRQ=bl3t-BYN*SPJ_-7Jt>2;BT<XqK;2EW@uyb1+2*iVDg6e=#6)+Y
za*6@WH0dDbe6V7c4Z3mhwn67`yl6WwlX`2d3AC8JK~0S|>vsAbx`6fzkDe3yQLX#|
zll=uUMz_r^&!?jr`9mhV1=mNNbF!*0gA_k7*&STZ<!n8(;G-`$%_-w9&X@nllz)Z1
zi^sW4t8r7a#rhwieI$@`F$5AWjR+Ff=pM?%?=Br8a)EKF_||0!k;o*l?y?4Y#^U8c
zOsav2v0Fk2W3h7BBE*aL#-)U4VCKqVc@&eTiVLn5%jHRo=8ARKRZ7w#zI?+$$a3+{
z&2*yVT`8Gq>2h(&tzQwr&T^zNFnYU0wvdTIJGB&wrVe}Cml~#~j-^-O6zra~85wT_
zm?6b9C`P3*s8ygAlcep)l3?UcjF5%n7Pxn(Vx9(R3PLJEHk40qBsp+uI$p>?!D^VC
zPJU($qaLNXW{b_*Xti4%ZkmWn-aem2or=9$>}EH<k=X0XN>`y;4Fz|flb18PSv-6<
zNFamIKhwNNhl%JBVh~~x@SRB$5E2pa;YgDaQV}W;N)h<037;U|*AQ>eeK_Q;@-#Bu
zs=h#mH!j8Ng5n9Mc#`Q?B%dK}L%zi*?kS3!h~loHxI3s1CXY)`c}02k9+wrDk(R^v
d_ZJYGsQvaZ3DA;_<o+@psU-JT!<kvrzW}N&FG&CZ

diff --git a/home/models.py b/home/models.py
index c636101..1ed077f 100644
--- a/home/models.py
+++ b/home/models.py
@@ -103,21 +103,33 @@ class ClaimedReward(models.Model):
     def __str__(self):
         return f"{self.username} - {self.recruit_reward.reward_name} - {self.claimed_at}"
 
+from django.db import models
+from django.utils import timezone
+
+from django.db import models
+from django.utils import timezone
+
 class AccountActivation(models.Model):
     username = models.CharField(max_length=17)
     email = models.EmailField()
     old_email = models.EmailField(null=True, blank=True)
-    password = models.CharField(max_length=64)  # Hash de la contraseña
+    password = models.CharField(max_length=64)
     salt = models.BinaryField(max_length=32)
     verifier = models.BinaryField(max_length=32)
     recruiter_id = models.IntegerField(null=True, blank=True)
     hash = models.CharField(max_length=32, unique=True)
     old_email_hash = models.CharField(max_length=32, null=True, blank=True)
+    is_used = models.BooleanField(default=False)  # Indica si el old_email_hash ha sido usado
+    is_new_email_used = models.BooleanField(default=False)  # Indica si el hash del nuevo correo ha sido usado
     created_at = models.DateTimeField(default=timezone.now)
-    
+
     def is_expired(self):
         return timezone.now() > self.created_at + timezone.timedelta(hours=1)
 
+    def __str__(self):
+        return f"Activation for {self.username}"
+
+
 
 class SecurityToken(models.Model):
     user = models.ForeignKey(User, on_delete=models.CASCADE)
diff --git a/home/views.py b/home/views.py
index b4f7d90..aee4310 100644
--- a/home/views.py
+++ b/home/views.py
@@ -1056,11 +1056,15 @@ def change_email_view(request):
 
 def confirm_old_email_view(request):
     hash = request.GET.get('hash')
-    activation = AccountActivation.objects.filter(old_email_hash=hash).first()
+    activation = AccountActivation.objects.filter(old_email_hash=hash, is_used=False).first()
 
-    if not activation:
+    if not activation or activation.is_expired():
         return HttpResponse('Enlace no válido o expirado.', status=400)
 
+    # Marcar solo el old_email_hash como usado
+    activation.is_used = True
+    activation.save()
+
     # Enviar correo al nuevo correo para confirmar el cambio
     activation_link = f"{settings.URL_PRINCIPAL}/es/confirm-new-email?hash={activation.hash}"
     context_new_email = {
@@ -1080,11 +1084,15 @@ def confirm_old_email_view(request):
 
 def confirm_new_email_view(request):
     hash = request.GET.get('hash')
-    activation = AccountActivation.objects.filter(hash=hash).first()
+    activation = AccountActivation.objects.filter(hash=hash, is_new_email_used=False).first()
 
-    if not activation:
+    if not activation or activation.is_expired():
         return HttpResponse('Enlace no válido o expirado.', status=400)
 
+    # Marcar solo el new_email_hash como usado
+    activation.is_new_email_used = True
+    activation.save()
+
     # Actualizar el correo en la base de datos
     with connections['acore_auth'].cursor() as cursor:
         cursor.execute("""
@@ -1108,7 +1116,6 @@ def confirm_new_email_view(request):
 
     return HttpResponse('El cambio de correo ha sido confirmado y completado con éxito.')
 
-
    
 def promo_code_view(request):
     return render(request, 'account/promo_code.html')
diff --git a/novawow/__pycache__/settings.cpython-313.pyc b/novawow/__pycache__/settings.cpython-313.pyc
index 3fcba2307484510a552f17e5b31338544c08cb0c..93e06ad8cc88c3bff902eddea1bbefe44394ca63 100644
GIT binary patch
delta 117
zcmcbq{85?rGcPX}0}y!ru}WXMkvE-%^A@|Kb9}JBW5DDpmaB~1lLJ^4fMg-736NaI
zI*n0cvn^W}qj;5QMoCG5mA-yXesW??Mt*ULm4$(U<>r&@tjvs@o6mD8Gcw9-{>=T1
SnNec$E&kPv>YLjHf*AoJ5hHm3

delta 120
zcmeyUd{deCGcPX}0}xDCuuAXU$eYf>R>h(K1e0r7t}20KZgD2&WTxlkrskF0V$Uxv
zNdYm~GV?%m5!d7rRue|9$tzi>F^X??VC!OJy2Y^hAv-HGBgf|FT*{1$(wn(?o-s3u
QPX5Hdno(%;Jb_?F0Ht{(x&QzG

diff --git a/novawow/settings.py b/novawow/settings.py
index 1764d33..29a3463 100644
--- a/novawow/settings.py
+++ b/novawow/settings.py
@@ -43,7 +43,7 @@ INSTALLED_APPS = [
 
 # Configuración para AC SOAP
 AC_SOAP_URL = "http://127.0.0.1:2079"
-AC_SOAP_USER = "    "
+AC_SOAP_USER = "AC_SOAP"
 AC_SOAP_PASSWORD = "Ladyamy89"
 AC_SOAP_URN = "urn:AC"
 
@@ -102,7 +102,7 @@ MIDDLEWARE = [
 
 ROOT_URLCONF = 'novawow.urls'
 
-URL_PRINCIPAL = ''
+URL_PRINCIPAL = 'http://localhost:8009'
 
 # Nombre del servidor
 NOMBRE_SERVIDOR = "Nova WoW"