Check invalid username from lists in login

freedomofpress · Jun 6, 2020 · 997fed7 · 997fed7
1 parent 413971d
commit 997fed7
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/securedrop/models.py b/securedrop/models.py
@@ -663,13 +663,15 @@ def throttle_login(cls, user):
     @classmethod
     def login(cls, username, password, token):
         # type: (str, str, str) -> Journalist
+        invalid_usernames = ['deleted']
+
         try:
             user = Journalist.query.filter_by(username=username).one()
         except NoResultFound:
             raise InvalidUsernameException(
                 "invalid username '{}'".format(username))
 
-        if user.username == 'deleted' and user.uuid == 'deleted':
+        if user.username in invalid_usernames and user.uuid in invalid_usernames:
             raise InvalidUsernameException(
                 "Invalid username '{}'".format(username))