We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
Add confirmation for login with login key
External users can login by clicking on the login URL sent to them via email. Before users are actually authenticated on the platform after clicking on this link, they should have to confirm the login by, e.g., clicking a confirmation button in a modal or on a designated page.

This prevents cases in which the URL is already requested for, e.g., a preview of the page and thus invalidates the login key which results in a new link being sent when users actively click on the link (which is then already the second GET request).

--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `evap/evaluation/views.py`
Content:
```
1 import logging
2 from datetime import date, timedelta
3 
4 from django.conf import settings
5 from django.contrib import messages, auth
6 from django.contrib.auth.decorators import login_required
7 from django.core.mail import EmailMessage
8 from django.http import HttpResponse, HttpResponseBadRequest
9 from django.shortcuts import redirect, render
10 from django.utils.translation import ugettext as _
11 from django.views.decorators.http import require_POST
12 from django.views.decorators.debug import sensitive_post_parameters
13 from django.views.i18n import set_language
14 
15 from evap.evaluation.forms import NewKeyForm, LoginUsernameForm
16 from evap.evaluation.models import UserProfile, FaqSection, EmailTemplate, Semester
17 
18 logger = logging.getLogger(__name__)
19 
20 
21 @sensitive_post_parameters("password")
22 def index(request):
23     """Main entry page into EvaP providing all the login options available. The username/password
24        login is thought to be used for internal users, e.g. by connecting to a LDAP directory.
25        The login key mechanism is meant to be used to include external participants, e.g. visiting
26        students or visiting contributors.
27     """
28 
29     # parse the form data into the respective form
30     submit_type = request.POST.get("submit_type", "no_submit")
31     new_key_form = NewKeyForm(request.POST if submit_type == "new_key" else None)
32     login_username_form = LoginUsernameForm(request, request.POST if submit_type == "login_username" else None)
33 
34     # process form data
35     if request.method == 'POST':
36         if new_key_form.is_valid():
37             # user wants a new login key
38             profile = new_key_form.get_user()
39             profile.ensure_valid_login_key()
40             profile.save()
41 
42             EmailTemplate.send_login_url_to_user(new_key_form.get_user())
43 
44             messages.success(request, _("We sent you an email with a one-time login URL. Please check your inbox."))
45             return redirect('evaluation:index')
46         elif login_username_form.is_valid():
47             # user would like to login with username and password and passed password test
48             auth.login(request, login_username_form.get_user())
49 
50             # clean up our test cookie
51             if request.session.test_cookie_worked():
52                 request.session.delete_test_cookie()
53 
54     # if not logged in by now, render form
55     if not request.user.is_authenticated:
56         # set test cookie to verify whether they work in the next step
57         request.session.set_test_cookie()
58 
59         template_data = dict(
60             new_key_form=new_key_form,
61             login_username_form=login_username_form,
62             openid_active=settings.ACTIVATE_OPEN_ID_LOGIN,
63         )
64         return render(request, "index.html", template_data)
65     else:
66         user, __ = UserProfile.objects.get_or_create(username=request.user.username)
67 
68         # check for redirect variable
69         redirect_to = request.GET.get("next", None)
70         if redirect_to is not None:
71             return redirect(redirect_to)
72 
73         # redirect user to appropriate start page
74         if request.user.is_reviewer:
75             return redirect('staff:semester_view', Semester.active_semester().id)
76         if request.user.is_manager:
77             return redirect('staff:index')
78         elif request.user.is_grade_publisher:
79             return redirect('grades:semester_view', Semester.active_semester().id)
80         elif user.is_student:
81             return redirect('student:index')
82         elif user.is_responsible_or_contributor_or_delegate:
83             return redirect('contributor:index')
84         else:
85             return redirect('results:index')
86 
87 
88 def login_key_authentication(request, key):
89     user = auth.authenticate(request, key=key)
90 
91     if user and not user.is_active:
92         messages.error(request, _("Inactive users are not allowed to login."))
93         return redirect('evaluation:index')
94 
95     # If we already have an authenticated user don't try to login a new user. Show an error message if another user
96     # tries to login with a URL in this situation.
97     if request.user.is_authenticated:
98         if user != request.user:
99             messages.error(request, _("Another user is currently logged in. Please logout first and then use the login URL again."))
100         return redirect('evaluation:index')
101 
102     if user and user.login_key_valid_until >= date.today():
103         # User is valid. Set request.user and persist user in the session by logging the user in.
104         request.user = user
105         auth.login(request, user)
106         messages.success(request, _("Logged in as %s.") % user.full_name)
107         # Invalidate the login key, but keep it stored so we can later identify the user that is trying to login and send a new link
108         user.login_key_valid_until = date.today() - timedelta(1)
109         user.save()
110     elif user:
111         # A user exists, but the login key is not valid anymore. Send the user a new one.
112         user.ensure_valid_login_key()
113         EmailTemplate.send_login_url_to_user(user)
114         messages.warning(request, _("The login URL is not valid anymore. We sent you a new one to your email address."))
115     else:
116         messages.warning(request, _("Invalid login URL. Please request a new one below."))
117 
118     return redirect('evaluation:index')
119 
120 
121 def faq(request):
122     return render(request, "faq.html", dict(sections=FaqSection.objects.all()))
123 
124 
125 def legal_notice(request):
126     return render(request, "legal_notice.html", dict())
127 
128 
129 @require_POST
130 @login_required
131 def contact(request):
132     message = request.POST.get("message")
133     title = request.POST.get("title")
134     subject = "[EvaP] Message from {}".format(request.user.username)
135 
136     if message:
137         mail = EmailMessage(
138             subject=subject,
139             body="{}\n{} ({})\n\n{}".format(title, request.user.username, request.user.email, message),
140             to=[settings.CONTACT_EMAIL])
141         try:
142             mail.send()
143             logger.info('Sent contact email: \n{}\n'.format(mail.message()))
144             return HttpResponse()
145         except Exception:
146             logger.exception('An exception occurred when sending the following contact email:\n{}\n'.format(mail.message()))
147             raise
148 
149     return HttpResponseBadRequest()
150 
151 
152 @require_POST
153 def set_lang(request):
154     if request.user.is_authenticated:
155         user = request.user
156         user.language = request.POST['language']
157         user.save()
158 
159     return set_language(request)
160
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/evap/evaluation/views.py b/evap/evaluation/views.py
--- a/evap/evaluation/views.py
+++ b/evap/evaluation/views.py
@@ -100,6 +100,12 @@
         return redirect('evaluation:index')
 
     if user and user.login_key_valid_until >= date.today():
+        if request.method != "POST":
+            template_data = {
+                'username': user.full_name
+            }
+            return render(request, "external_user_confirm_login.html", template_data)
+
         # User is valid. Set request.user and persist user in the session by logging the user in.
         request.user = user
         auth.login(request, user)

{"golden_diff": "diff --git a/evap/evaluation/views.py b/evap/evaluation/views.py\n--- a/evap/evaluation/views.py\n+++ b/evap/evaluation/views.py\n@@ -100,6 +100,12 @@\n         return redirect('evaluation:index')\n \n     if user and user.login_key_valid_until >= date.today():\n+        if request.method != \"POST\":\n+            template_data = {\n+                'username': user.full_name\n+            }\n+            return render(request, \"external_user_confirm_login.html\", template_data)\n+\n         # User is valid. Set request.user and persist user in the session by logging the user in.\n         request.user = user\n         auth.login(request, user)\n", "issue": "Add confirmation for login with login key\nExternal users can login by clicking on the login URL sent to them via email. Before users are actually authenticated on the platform after clicking on this link, they should have to confirm the login by, e.g., clicking a confirmation button in a modal or on a designated page.\r\n\r\nThis prevents cases in which the URL is already requested for, e.g., a preview of the page and thus invalidates the login key which results in a new link being sent when users actively click on the link (which is then already the second GET request).\n", "before_files": [{"content": "import logging\nfrom datetime import date, timedelta\n\nfrom django.conf import settings\nfrom django.contrib import messages, auth\nfrom django.contrib.auth.decorators import login_required\nfrom django.core.mail import EmailMessage\nfrom django.http import HttpResponse, HttpResponseBadRequest\nfrom django.shortcuts import redirect, render\nfrom django.utils.translation import ugettext as _\nfrom django.views.decorators.http import require_POST\nfrom django.views.decorators.debug import sensitive_post_parameters\nfrom django.views.i18n import set_language\n\nfrom evap.evaluation.forms import NewKeyForm, LoginUsernameForm\nfrom evap.evaluation.models import UserProfile, FaqSection, EmailTemplate, Semester\n\nlogger = logging.getLogger(__name__)\n\n\n@sensitive_post_parameters(\"password\")\ndef index(request):\n    \"\"\"Main entry page into EvaP providing all the login options available. The username/password\n       login is thought to be used for internal users, e.g. by connecting to a LDAP directory.\n       The login key mechanism is meant to be used to include external participants, e.g. visiting\n       students or visiting contributors.\n    \"\"\"\n\n    # parse the form data into the respective form\n    submit_type = request.POST.get(\"submit_type\", \"no_submit\")\n    new_key_form = NewKeyForm(request.POST if submit_type == \"new_key\" else None)\n    login_username_form = LoginUsernameForm(request, request.POST if submit_type == \"login_username\" else None)\n\n    # process form data\n    if request.method == 'POST':\n        if new_key_form.is_valid():\n            # user wants a new login key\n            profile = new_key_form.get_user()\n            profile.ensure_valid_login_key()\n            profile.save()\n\n            EmailTemplate.send_login_url_to_user(new_key_form.get_user())\n\n            messages.success(request, _(\"We sent you an email with a one-time login URL. Please check your inbox.\"))\n            return redirect('evaluation:index')\n        elif login_username_form.is_valid():\n            # user would like to login with username and password and passed password test\n            auth.login(request, login_username_form.get_user())\n\n            # clean up our test cookie\n            if request.session.test_cookie_worked():\n                request.session.delete_test_cookie()\n\n    # if not logged in by now, render form\n    if not request.user.is_authenticated:\n        # set test cookie to verify whether they work in the next step\n        request.session.set_test_cookie()\n\n        template_data = dict(\n            new_key_form=new_key_form,\n            login_username_form=login_username_form,\n            openid_active=settings.ACTIVATE_OPEN_ID_LOGIN,\n        )\n        return render(request, \"index.html\", template_data)\n    else:\n        user, __ = UserProfile.objects.get_or_create(username=request.user.username)\n\n        # check for redirect variable\n        redirect_to = request.GET.get(\"next\", None)\n        if redirect_to is not None:\n            return redirect(redirect_to)\n\n        # redirect user to appropriate start page\n        if request.user.is_reviewer:\n            return redirect('staff:semester_view', Semester.active_semester().id)\n        if request.user.is_manager:\n            return redirect('staff:index')\n        elif request.user.is_grade_publisher:\n            return redirect('grades:semester_view', Semester.active_semester().id)\n        elif user.is_student:\n            return redirect('student:index')\n        elif user.is_responsible_or_contributor_or_delegate:\n            return redirect('contributor:index')\n        else:\n            return redirect('results:index')\n\n\ndef login_key_authentication(request, key):\n    user = auth.authenticate(request, key=key)\n\n    if user and not user.is_active:\n        messages.error(request, _(\"Inactive users are not allowed to login.\"))\n        return redirect('evaluation:index')\n\n    # If we already have an authenticated user don't try to login a new user. Show an error message if another user\n    # tries to login with a URL in this situation.\n    if request.user.is_authenticated:\n        if user != request.user:\n            messages.error(request, _(\"Another user is currently logged in. Please logout first and then use the login URL again.\"))\n        return redirect('evaluation:index')\n\n    if user and user.login_key_valid_until >= date.today():\n        # User is valid. Set request.user and persist user in the session by logging the user in.\n        request.user = user\n        auth.login(request, user)\n        messages.success(request, _(\"Logged in as %s.\") % user.full_name)\n        # Invalidate the login key, but keep it stored so we can later identify the user that is trying to login and send a new link\n        user.login_key_valid_until = date.today() - timedelta(1)\n        user.save()\n    elif user:\n        # A user exists, but the login key is not valid anymore. Send the user a new one.\n        user.ensure_valid_login_key()\n        EmailTemplate.send_login_url_to_user(user)\n        messages.warning(request, _(\"The login URL is not valid anymore. We sent you a new one to your email address.\"))\n    else:\n        messages.warning(request, _(\"Invalid login URL. Please request a new one below.\"))\n\n    return redirect('evaluation:index')\n\n\ndef faq(request):\n    return render(request, \"faq.html\", dict(sections=FaqSection.objects.all()))\n\n\ndef legal_notice(request):\n    return render(request, \"legal_notice.html\", dict())\n\n\n@require_POST\n@login_required\ndef contact(request):\n    message = request.POST.get(\"message\")\n    title = request.POST.get(\"title\")\n    subject = \"[EvaP] Message from {}\".format(request.user.username)\n\n    if message:\n        mail = EmailMessage(\n            subject=subject,\n            body=\"{}\\n{} ({})\\n\\n{}\".format(title, request.user.username, request.user.email, message),\n            to=[settings.CONTACT_EMAIL])\n        try:\n            mail.send()\n            logger.info('Sent contact email: \\n{}\\n'.format(mail.message()))\n            return HttpResponse()\n        except Exception:\n            logger.exception('An exception occurred when sending the following contact email:\\n{}\\n'.format(mail.message()))\n            raise\n\n    return HttpResponseBadRequest()\n\n\n@require_POST\ndef set_lang(request):\n    if request.user.is_authenticated:\n        user = request.user\n        user.language = request.POST['language']\n        user.save()\n\n    return set_language(request)\n", "path": "evap/evaluation/views.py"}], "after_files": [{"content": "import logging\nfrom datetime import date, timedelta\n\nfrom django.conf import settings\nfrom django.contrib import messages, auth\nfrom django.contrib.auth.decorators import login_required\nfrom django.core.mail import EmailMessage\nfrom django.http import HttpResponse, HttpResponseBadRequest\nfrom django.shortcuts import redirect, render\nfrom django.utils.translation import ugettext as _\nfrom django.views.decorators.http import require_POST\nfrom django.views.decorators.debug import sensitive_post_parameters\nfrom django.views.i18n import set_language\n\nfrom evap.evaluation.forms import NewKeyForm, LoginUsernameForm\nfrom evap.evaluation.models import UserProfile, FaqSection, EmailTemplate, Semester\n\nlogger = logging.getLogger(__name__)\n\n\n@sensitive_post_parameters(\"password\")\ndef index(request):\n    \"\"\"Main entry page into EvaP providing all the login options available. The username/password\n       login is thought to be used for internal users, e.g. by connecting to a LDAP directory.\n       The login key mechanism is meant to be used to include external participants, e.g. visiting\n       students or visiting contributors.\n    \"\"\"\n\n    # parse the form data into the respective form\n    submit_type = request.POST.get(\"submit_type\", \"no_submit\")\n    new_key_form = NewKeyForm(request.POST if submit_type == \"new_key\" else None)\n    login_username_form = LoginUsernameForm(request, request.POST if submit_type == \"login_username\" else None)\n\n    # process form data\n    if request.method == 'POST':\n        if new_key_form.is_valid():\n            # user wants a new login key\n            profile = new_key_form.get_user()\n            profile.ensure_valid_login_key()\n            profile.save()\n\n            EmailTemplate.send_login_url_to_user(new_key_form.get_user())\n\n            messages.success(request, _(\"We sent you an email with a one-time login URL. Please check your inbox.\"))\n            return redirect('evaluation:index')\n        elif login_username_form.is_valid():\n            # user would like to login with username and password and passed password test\n            auth.login(request, login_username_form.get_user())\n\n            # clean up our test cookie\n            if request.session.test_cookie_worked():\n                request.session.delete_test_cookie()\n\n    # if not logged in by now, render form\n    if not request.user.is_authenticated:\n        # set test cookie to verify whether they work in the next step\n        request.session.set_test_cookie()\n\n        template_data = dict(\n            new_key_form=new_key_form,\n            login_username_form=login_username_form,\n            openid_active=settings.ACTIVATE_OPEN_ID_LOGIN,\n        )\n        return render(request, \"index.html\", template_data)\n    else:\n        user, __ = UserProfile.objects.get_or_create(username=request.user.username)\n\n        # check for redirect variable\n        redirect_to = request.GET.get(\"next\", None)\n        if redirect_to is not None:\n            return redirect(redirect_to)\n\n        # redirect user to appropriate start page\n        if request.user.is_reviewer:\n            return redirect('staff:semester_view', Semester.active_semester().id)\n        if request.user.is_manager:\n            return redirect('staff:index')\n        elif request.user.is_grade_publisher:\n            return redirect('grades:semester_view', Semester.active_semester().id)\n        elif user.is_student:\n            return redirect('student:index')\n        elif user.is_responsible_or_contributor_or_delegate:\n            return redirect('contributor:index')\n        else:\n            return redirect('results:index')\n\n\ndef login_key_authentication(request, key):\n    user = auth.authenticate(request, key=key)\n\n    if user and not user.is_active:\n        messages.error(request, _(\"Inactive users are not allowed to login.\"))\n        return redirect('evaluation:index')\n\n    # If we already have an authenticated user don't try to login a new user. Show an error message if another user\n    # tries to login with a URL in this situation.\n    if request.user.is_authenticated:\n        if user != request.user:\n            messages.error(request, _(\"Another user is currently logged in. Please logout first and then use the login URL again.\"))\n        return redirect('evaluation:index')\n\n    if user and user.login_key_valid_until >= date.today():\n        if request.method != \"POST\":\n            template_data = {\n                'username': user.full_name\n            }\n            return render(request, \"external_user_confirm_login.html\", template_data)\n\n        # User is valid. Set request.user and persist user in the session by logging the user in.\n        request.user = user\n        auth.login(request, user)\n        messages.success(request, _(\"Logged in as %s.\") % user.full_name)\n        # Invalidate the login key, but keep it stored so we can later identify the user that is trying to login and send a new link\n        user.login_key_valid_until = date.today() - timedelta(1)\n        user.save()\n    elif user:\n        # A user exists, but the login key is not valid anymore. Send the user a new one.\n        user.ensure_valid_login_key()\n        EmailTemplate.send_login_url_to_user(user)\n        messages.warning(request, _(\"The login URL is not valid anymore. We sent you a new one to your email address.\"))\n    else:\n        messages.warning(request, _(\"Invalid login URL. Please request a new one below.\"))\n\n    return redirect('evaluation:index')\n\n\ndef faq(request):\n    return render(request, \"faq.html\", dict(sections=FaqSection.objects.all()))\n\n\ndef legal_notice(request):\n    return render(request, \"legal_notice.html\", dict())\n\n\n@require_POST\n@login_required\ndef contact(request):\n    message = request.POST.get(\"message\")\n    title = request.POST.get(\"title\")\n    subject = \"[EvaP] Message from {}\".format(request.user.username)\n\n    if message:\n        mail = EmailMessage(\n            subject=subject,\n            body=\"{}\\n{} ({})\\n\\n{}\".format(title, request.user.username, request.user.email, message),\n            to=[settings.CONTACT_EMAIL])\n        try:\n            mail.send()\n            logger.info('Sent contact email: \\n{}\\n'.format(mail.message()))\n            return HttpResponse()\n        except Exception:\n            logger.exception('An exception occurred when sending the following contact email:\\n{}\\n'.format(mail.message()))\n            raise\n\n    return HttpResponseBadRequest()\n\n\n@require_POST\ndef set_lang(request):\n    if request.user.is_authenticated:\n        user = request.user\n        user.language = request.POST['language']\n        user.save()\n\n    return set_language(request)\n", "path": "evap/evaluation/views.py"}]}