Serve a user's profile picture. New uploads are stored plaintext. If an older encrypted blob exists, we decrypt it on the fly for backwards compatibility.
(username: str)
| 11447 | """Request admin approval to trust this device for auto-login. |
| 11448 | Works only for accounts without 2FA enabled. |
| 11449 | """ |
| 11450 | # If already logged in, nothing to do. |
| 11451 | if is_logged_in(): |
| 11452 | return redirect(url_for("index")) |
| 11453 | admins = _admins_list() |
| 11454 | status = None |
| 11455 | |
| 11456 | fp = (request.cookies.get(DEVICE_FP_COOKIE) or "").strip() |
| 11457 | |
| 11458 | if request.method == "POST": |
| 11459 | username = (request.form.get("username") or "").strip() |
| 11460 | if not username: |
| 11461 | flash(_("Username is required.")) |
| 11462 | resp = redirect(url_for("device_access")) |
| 11463 | _ensure_device_fp_cookie(resp) |
| 11464 | return resp |
| 11465 | |
| 11466 | # 2FA users must use normal login. |
| 11467 | if user_2fa_enabled(username): |
| 11468 | flash(_("Auto‑login is disabled because 2FA is enabled on this account. Please sign in normally.")) |
| 11469 | resp = redirect(url_for("login")) |
| 11470 | _ensure_device_fp_cookie(resp) |
| 11471 | return resp |
| 11472 | |
| 11473 | # Ensure device fp exists. |
| 11474 | resp = redirect(url_for("device_access")) |
| 11475 | if not fp: |
| 11476 | fp = secrets.token_urlsafe(24) |
| 11477 | resp.set_cookie(DEVICE_FP_COOKIE, fp, max_age=180*24*3600, httponly=True, samesite="Lax", secure=False) |
| 11478 | |
| 11479 | # If this device is already trusted for that user, do nothing. |
nothing calls this directly
no test coverage detected