don't allow redeeming if token is no longer valid
@@ -62,6 +62,10 @@ class AccessPermissionToken(models.Model):
def redeem(self, user=None):
if self.redeemed_by_id or (user is None and self.redeemed):
raise TypeError('Already redeemed.')
+
+ if timezone.now()+timedelta(minutes=300 if self.redeemed else 0) < self.valid_until:
+ raise TypeError('No longer valid.')
+
self.redeemed = True
if user:
for pk, expire_date in self.restrictions:
