Added validation to stop exploiting the multi-character hole

sso/forms.py

@@ -37,6 +37,12 @@ def UserServiceAccountForm(user):
         character = forms.ChoiceField(chars)
         service = forms.ChoiceField(services)
 
+        def clean(self):
+            if not self.cleaned_data['character'].corporation.group in self.cleaned_data['service'].groups.all():
+                raise form.ValidationError("%s is not in a corporation allowed to access %s" % (self.cleaned_data['character'].name, self.cleaned_data['service'])
+
+            return self.cleaned_data
+
     return ServiceAccountForm
 
 class RedditAccountForm(forms.Form):