from compat import patterns, url
from django.conf import settings

urlpatterns = patterns('hijack.views',
    url(r'^release-hijack/$', 'release_hijack', name='release_hijack'),
)

if getattr(settings, "HIJACK_NOTIFY_ADMIN", False):
    urlpatterns += patterns('hijack.views',
        url(r'^disable-hijack-warning/$', 'disable_hijack_warning', name='disable_hijack_warning'),
)

hijacking_user_attributes = getattr(settings, "ALLOWED_HIJACKING_USER_ATTRIBUTES", False)

if not hijacking_user_attributes or 'email' in hijacking_user_attributes:
    urlpatterns += patterns('hijack.views',
        url(r'^email/(?P<email>[\w.%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,4})/$', 'login_with_email', name='login_with_email')
    )
if not hijacking_user_attributes or 'username' in hijacking_user_attributes:
    urlpatterns += patterns('hijack.views',
        url(r'^username/(?P<username>\w+)/$', 'login_with_username', name='login_with_username'),
    )
if not hijacking_user_attributes or 'user_id' in hijacking_user_attributes:
    urlpatterns += patterns('hijack.views',
        url(r'^(?P<user_id>\w+)/$', 'login_with_id', name='login_with_id')
    )

from compat import patterns, url
from django.conf import settings

urlpatterns = patterns('hijack.views',
    url(r'^release-hijack/$', 'release_hijack', name='release_hijack'),
)

if getattr(settings, "HIJACK_NOTIFY_ADMIN", False):
    urlpatterns += patterns('hijack.views',
        url(r'^disable-hijack-warning/$', 'disable_hijack_warning', name='disable_hijack_warning'),
)

hijacking_user_attributes = getattr(settings, "ALLOWED_HIJACKING_USER_ATTRIBUTES", False)

if not hijacking_user_attributes or 'email' in hijacking_user_attributes:
    urlpatterns += patterns('hijack.views',
        url(r'^email/(?P<email>[^@]+@[^@]+\.[^@]+)/$', 'login_with_email', name='login_with_email')
    )
if not hijacking_user_attributes or 'username' in hijacking_user_attributes:
    urlpatterns += patterns('hijack.views',
        url(r'^username/(?P<username>\w+)/$', 'login_with_username', name='login_with_username'),
    )
if not hijacking_user_attributes or 'user_id' in hijacking_user_attributes:
    urlpatterns += patterns('hijack.views',
        url(r'^(?P<user_id>\w+)/$', 'login_with_id', name='login_with_id')
    )

Use a more liberal/naive approach to regex checking for an email
Use a more liberal/naive approach to regex checking for an email

The problem with the old method is that it does not support
- Internationalized TLDs, domains or users, such as .xn--4gbrim domains
- Geographic TLDs, such as .europe
- ICANN-era TLDs, such as .audio and .clothing

The new regex still matches <anything>@<anything>.<anything> so we still have some mail
characteristics in the URL.

  from compat import patterns, url
  from django.conf import settings
  
  urlpatterns = patterns('hijack.views',
      url(r'^release-hijack/$', 'release_hijack', name='release_hijack'),
  )
  
  if getattr(settings, "HIJACK_NOTIFY_ADMIN", False):
      urlpatterns += patterns('hijack.views',
          url(r'^disable-hijack-warning/$', 'disable_hijack_warning', name='disable_hijack_warning'),
  )
  
  hijacking_user_attributes = getattr(settings, "ALLOWED_HIJACKING_USER_ATTRIBUTES", False)
  
  if not hijacking_user_attributes or 'email' in hijacking_user_attributes:
      urlpatterns += patterns('hijack.views',
-         url(r'^email/(?P<email>[\w.%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,4})/$', 'login_with_email', name='login_with_email')
+         url(r'^email/(?P<email>[^@]+@[^@]+\.[^@]+)/$', 'login_with_email', name='login_with_email')
      )
  if not hijacking_user_attributes or 'username' in hijacking_user_attributes:
      urlpatterns += patterns('hijack.views',
          url(r'^username/(?P<username>\w+)/$', 'login_with_username', name='login_with_username'),
      )
  if not hijacking_user_attributes or 'user_id' in hijacking_user_attributes:
      urlpatterns += patterns('hijack.views',
          url(r'^(?P<user_id>\w+)/$', 'login_with_id', name='login_with_id')
      )
  
Use a more liberal/naive approach to regex checking for an email
## Code Before:
from compat import patterns, url
from django.conf import settings

urlpatterns = patterns('hijack.views',
    url(r'^release-hijack/$', 'release_hijack', name='release_hijack'),
)

if getattr(settings, "HIJACK_NOTIFY_ADMIN", False):
    urlpatterns += patterns('hijack.views',
        url(r'^disable-hijack-warning/$', 'disable_hijack_warning', name='disable_hijack_warning'),
)

hijacking_user_attributes = getattr(settings, "ALLOWED_HIJACKING_USER_ATTRIBUTES", False)

if not hijacking_user_attributes or 'email' in hijacking_user_attributes:
    urlpatterns += patterns('hijack.views',
        url(r'^email/(?P<email>[\w.%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,4})/$', 'login_with_email', name='login_with_email')
    )
if not hijacking_user_attributes or 'username' in hijacking_user_attributes:
    urlpatterns += patterns('hijack.views',
        url(r'^username/(?P<username>\w+)/$', 'login_with_username', name='login_with_username'),
    )
if not hijacking_user_attributes or 'user_id' in hijacking_user_attributes:
    urlpatterns += patterns('hijack.views',
        url(r'^(?P<user_id>\w+)/$', 'login_with_id', name='login_with_id')
    )

## Instruction:
Use a more liberal/naive approach to regex checking for an email
## Code After:
from compat import patterns, url
from django.conf import settings

urlpatterns = patterns('hijack.views',
    url(r'^release-hijack/$', 'release_hijack', name='release_hijack'),
)

if getattr(settings, "HIJACK_NOTIFY_ADMIN", False):
    urlpatterns += patterns('hijack.views',
        url(r'^disable-hijack-warning/$', 'disable_hijack_warning', name='disable_hijack_warning'),
)

hijacking_user_attributes = getattr(settings, "ALLOWED_HIJACKING_USER_ATTRIBUTES", False)

if not hijacking_user_attributes or 'email' in hijacking_user_attributes:
    urlpatterns += patterns('hijack.views',
        url(r'^email/(?P<email>[^@]+@[^@]+\.[^@]+)/$', 'login_with_email', name='login_with_email')
    )
if not hijacking_user_attributes or 'username' in hijacking_user_attributes:
    urlpatterns += patterns('hijack.views',
        url(r'^username/(?P<username>\w+)/$', 'login_with_username', name='login_with_username'),
    )
if not hijacking_user_attributes or 'user_id' in hijacking_user_attributes:
    urlpatterns += patterns('hijack.views',
        url(r'^(?P<user_id>\w+)/$', 'login_with_id', name='login_with_id')
    )
