Allow login by username OR email

[spaetz]

There is no reason we cannot offer the login form offering to either enter ones user name OR email address (which can be helpful if I don't remember the username I've been using).

This is very low-priority, of course.

[Jessica Tallon]

There could be two ways of doing this:

1. After the check of username, if it returns None (i.e. it couldn't find a user with that username) we go on to check this username against emails i.e.

   user = User.query.filter_by(username=login_form.data['username']).first()
   
   if not user:
       user = User.query.filter_by(email=login_form.data['username']).first()
   
   # code to handle logins here.
   

2. We could detect if it's an email because usernames can't have "@" signs e.g.

   username = login_form.data['username']
   if "@" in username:
       user = User.query.filter_by(email=login_form.data['username']).first()
   else:
       user = User.query.filter_by(username=login_form.data['username']).first()
   
   # code to handle login
   

I'm not sure which is best, currently I have implemented number one (though it would only take a section to implement 2) I have tested it and it works. There is one extra change in the login form which is to allow emails (just changing a boolean parameter passed in).

[Jessica Tallon]

The working code is on:
​https://gitorious.org/~tsyesika/mediagoblin/tsyesikas-mediagoblin/commits/599-allow-email-login

I have done the following real world tests:

• Enter invalid username => failed login
• Enter invalid email => failed login
• Enter valid username and password => successful login
• Enter valid email and password => successful login

[Christopher Allan Webber]

I merged this. However: I have some slight concern in that we have no uniqueness database constraint on emails. Additionally, there's no way to change your email presently, but if we allowed it later we'd have to be very careful to not allow duplicate email addresses or that could introduce a security bug where you change an email address to someone else's and login by that. I don't know if that matters, and I might be over-worrying; I probably am.