Prevent duplicate instances of source /generate page

securedrop/source_app/main.py

@@ -36,6 +36,14 @@ def generate():
                   "notification")
             return redirect(url_for('.lookup'))
 
+        if request.method == 'GET' and 'codename' in session:
+            flash(gettext(
+                "A browser window or tab is already on the \"Get Started\" page. "
+                "Please continue using this window or tab or close all browser windows and "
+                "start over."),
+                  "notification")
+            return redirect(url_for('.index'))
+
         codename = generate_unique_codename(config)
         session['codename'] = codename
         session['new_user'] = True

securedrop/tests/functional/source_navigation_steps.py

@@ -213,3 +213,15 @@ def _source_sees_session_timeout_message(self):
         if not hasattr(self, "accept_languages"):
             expected_text = "Your session timed out due to inactivity."
             assert expected_text in notification.text
+
+    def _source_clicks_submit_documents_on_homepage_duplicate_window(self):
+        # Similar to self._source_clicks_submit_documents_on_homepage except we do not check
+        # that the source is directed to the page showing the generated codename, ref. #4458.
+        self.safe_click_by_id("submit-documents-button")
+
+    def _source_sees_get_started_page_already_open_message(self):
+        notification = self.driver.find_element_by_css_selector(".notification")
+
+        if not hasattr(self, "accepted_languages"):
+            expected_text = "A browser window or tab is already on the \"Get Started\" page. "
+            assert expected_text in notification.text

securedrop/tests/functional/test_source_warnings.py

@@ -76,3 +76,21 @@ def test_warning_high_security(self):
 
         banner = self.driver.find_element_by_id("js-warning")
         assert "Security Slider to Safest", banner.text
+
+
+class TestSourceInterfaceFlashWarnings(
+    functional_test.FunctionalTest, source_navigation_steps.SourceNavigationStepsMixin
+):
+
+    def test_duplicate_get_started_windows(self):
+
+        assert len(self.driver.window_handles) == 1
+        main_window = self.driver.current_window_handle  # noqa F841
+        self._source_visits_source_homepage()
+        self._source_clicks_submit_documents_on_homepage()
+
+        self.driver.execute_script("window.open()")
+        new_window = self.driver.window_handles[1]  # noqa F841
+        self._source_visits_source_homepage()
+        self._source_clicks_submit_documents_on_homepage_duplicate_window()
+        self._source_sees_get_started_page_already_open_message()