app: delete session['logged_in'] when we delete session['codename']

Ref: freedomofpress#4361
rmol · Apr 27, 2019 · 105e021 · 105e021
1 parent 2c8fa3c
commit 105e021
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/securedrop/source_app/main.py b/securedrop/source_app/main.py
@@ -67,6 +67,13 @@ def create():
 
             # Issue 2386: don't log in on duplicates
             del session['codename']
+
+            # Issue 4361: Delete 'logged_in' if it's in the session
+            try:
+                del session['logged_in']
+            except KeyError:
+                pass
+
             abort(500)
         else:
             os.mkdir(current_app.storage.path(filesystem_id))