From 63ed4110fe4dcfb230b127378a95434bd334b951 Mon Sep 17 00:00:00 2001
From: Vishnu Ks <yo@vishnuks.com>
Date: Wed, 11 Oct 2017 15:30:04 +0000
Subject: [PATCH] auth: Submit dev login form to the correct subdomain.

---
 templates/zerver/dev_login.html | 14 +++++++-------
 zerver/views/auth.py            |  5 +++--
 2 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/templates/zerver/dev_login.html b/templates/zerver/dev_login.html
index 76d4433d13..9580d3eca8 100644
--- a/templates/zerver/dev_login.html
+++ b/templates/zerver/dev_login.html
@@ -10,16 +10,15 @@
         <h4 class="login-page-header">Click on a user to log in!</h4>
         {% endif %}
         <p class="devlogin_subheader">{{ _('(Or visit the <a href="/login">normal login page</a>)') }}</p>
-        <form name="direct_login_form" id="direct_login_form" method="post" class="login-form"
-            action="{{ url('zerver.views.auth.dev_direct_login') }}">
-            {{ csrf_input }}
+        <form name="direct_login_form" id="direct_login_form" method="post" class="login-form">
             <div class="control-group">
                 <div class="controls">
                     <div class="group">
                         <h2>{{ _('Administrators') }}</h2>
                         {% if direct_admins %}
-                            {% for user_email in direct_admins %}
-                            <p><input type="submit" name="direct_email" class="btn-direct btn-admin" value="{{ user_email }}" /></p>
+                            {% for direct_admin in direct_admins %}
+                            <p><input type="submit" formaction="{{ direct_admin.realm.uri }}{{ url('zerver.views.auth.dev_direct_login') }}"
+                                      name="direct_email" class="btn-direct btn-admin" value="{{ direct_admin.email }}" /></p>
                             {% endfor %}
                         {% else %}
                             <p>No administrators found in this realm</p>
@@ -29,8 +28,9 @@
                     <div class="group">
                         <h2>{{ _('Normal users') }}</h2>
                         {% if direct_users %}
-                            {% for user_email in direct_users %}
-                            <p><input type="submit" name="direct_email" class="btn-direct btn-admin" value="{{ user_email }}" /></p>
+                            {% for direct_user in direct_users %}
+                            <p><input type="submit" formaction="{{ direct_user.realm.uri }}{{ url('zerver.views.auth.dev_direct_login') }}"
+                                      name="direct_email" class="btn-direct btn-admin" value="{{ direct_user.email }}" /></p>
                             {% endfor %}
                         {% else %}
                             <p>No normal users found in this realm</p>
diff --git a/zerver/views/auth.py b/zerver/views/auth.py
index f95e76ced7..22d0b2056b 100644
--- a/zerver/views/auth.py
+++ b/zerver/views/auth.py
@@ -505,8 +505,8 @@ def login_page(request, **kwargs):
         extra_context['current_realm'] = realm
         extra_context['all_realms'] = Realm.objects.all()
 
-        extra_context['direct_admins'] = [u.email for u in users if u.is_realm_admin]
-        extra_context['direct_users'] = [u.email for u in users if not u.is_realm_admin]
+        extra_context['direct_admins'] = [u for u in users if u.is_realm_admin]
+        extra_context['direct_users'] = [u for u in users if not u.is_realm_admin]
 
         if 'new_realm' in request.POST:
             # If we're switching realms, redirect to that realm
@@ -539,6 +539,7 @@ def login_page(request, **kwargs):
 
     return template_response
 
+@csrf_exempt
 def dev_direct_login(request, **kwargs):
     # type: (HttpRequest, **Any) -> HttpResponse
     # This function allows logging in without a password and should only be called in development environments.