Encrypt the session data by default

Before we just encrypted the password, now we encrypt the whole session
information by default.

1 files changed, 3 insertions, 1 deletions

diff --git a/accounts/__init__.py b/accounts/__init__.py
index afa348b..d8abf32 100644
--- a/accounts/__init__.py
+++ b/accounts/__init__.py
@@ -6,6 +6,7 @@ import os
 from flask import Flask, g, session
 from utils import *
 
+from utils.sessions import EncryptedSessionInterface
 from views import default, admin
 
 
@@ -15,6 +16,7 @@ app.register_blueprint(admin.bp, url_prefix='/admin')
 app.config.from_object('accounts.default_settings')
 if 'SPLINE_ACCOUNT_WEB_SETTINGS' in os.environ:
     app.config.from_envvar('SPLINE_ACCOUNT_WEB_SETTINGS')
+app.session_interface = EncryptedSessionInterface()
 
 app.all_services = account.SERVICES #TODO: take that from our json file or so
 app.user_backend = get_backend(app.config['USER_BACKEND'], app)
@@ -38,7 +40,7 @@ def initialize_user():
 
     if 'username' in session and 'password' in session:
         username = ensure_utf8(session['username'])
-        password = ensure_utf8(decrypt_password(session['password']))
+        password = ensure_utf8(session['password'])
         try:
             g.user = current_app.user_backend.auth(username, password)
         except ldap.INVALID_CREDENTIALS: