From 80144c85a1fa634973f9d0e47ad4daa4a5ab4a4b Mon Sep 17 00:00:00 2001
From: Matt Wright <mdw1980@gmail.com>
Date: Wed, 15 Aug 2012 17:06:07 -0400
Subject: [PATCH] Fix bug with an invalid remember_token cookie value

---
 flask_security/core.py    | 12 ++++++++----
 tests/functional_tests.py |  7 +++++++
 2 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/flask_security/core.py b/flask_security/core.py
index b6d83e5..a3554ce 100644
--- a/flask_security/core.py
+++ b/flask_security/core.py
@@ -9,7 +9,7 @@
     :license: MIT, see LICENSE for more details.
 """
 
-from itsdangerous import URLSafeTimedSerializer
+from itsdangerous import URLSafeTimedSerializer, BadSignature
 from flask import current_app
 from flask.ext.login import AnonymousUser as AnonymousUserBase, \
      UserMixin as BaseUserMixin, LoginManager, current_user
@@ -97,9 +97,13 @@ def _user_loader(user_id):
 
 
 def _token_loader(token):
-    data = _security.remember_token_serializer.loads(token)
-    user = _security.datastore.find_user(id=data[0])
-    return user if md5(user.password) == data[1] else None
+    try:
+        data = _security.remember_token_serializer.loads(token)
+        user = _security.datastore.find_user(id=data[0])
+        return user if md5(user.password) == data[1] else None
+    except:
+        print 'word'
+        return None
 
 
 def _identity_loader():
diff --git a/tests/functional_tests.py b/tests/functional_tests.py
index a4fd1fb..d96b847 100644
--- a/tests/functional_tests.py
+++ b/tests/functional_tests.py
@@ -5,6 +5,8 @@ from __future__ import with_statement
 import base64
 import time
 
+from cookielib import Cookie
+
 try:
     import simplejson as json
 except ImportError:
@@ -190,6 +192,11 @@ class DefaultSecurityTests(SecurityTest):
         r = self._get('/profile')
         self.assertIn('profile', r.data)
 
+    def test_token_loader_does_not_fail_with_invalid_token(self):
+        self.client.cookie_jar.set_cookie(Cookie(version=0, name='remember_token', value='None', port=None, port_specified=False, domain='www.example.com', domain_specified=False, domain_initial_dot=False, path='/', path_specified=True, secure=False, expires=None, discard=True, comment=None, comment_url=None, rest={'HttpOnly': None}, rfc2109=False))
+        r = self._get('/')
+        self.assertNotIn('BadSignature', r.data)
+
 
 class ConfiguredSecurityTests(SecurityTest):