yul
/
bookwyrm-mastodon
1
1
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #1459 from bookwyrm-social/password-reset 

Prevent password reset for inactive users
This commit is contained in:
Mouse Reeve 2021-09-27 12:55:05 -07:00 committed by GitHub
parent eb34bb2d93 8b0a8e2611
commit 6d2403bbc7
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
bookwyrm/tests/views/test_password.py
View File

@ -43,12 +43,14 @@ class PasswordViews(TestCase):
def test_password_reset_request_post(self): def test_password_reset_request_post(self):
"""send 'em an email""" """send 'em an email"""
request = self.factory.post("", {"email": "aa@bb.ccc"}) request = self.factory.post("", {"email": "aa@bb.ccc"})
request.user = self.anonymous_user
view = views.PasswordResetRequest.as_view() view = views.PasswordResetRequest.as_view()
resp = view(request) resp = view(request)
self.assertEqual(resp.status_code, 200) self.assertEqual(resp.status_code, 200)
resp.render() resp.render()
request = self.factory.post("", {"email": "mouse@mouse.com"}) request = self.factory.post("", {"email": "mouse@mouse.com"})
request.user = self.anonymous_user
with patch("bookwyrm.emailing.send_email.delay"): with patch("bookwyrm.emailing.send_email.delay"):
resp = view(request) resp = view(request)
resp.render() resp.render()

4
bookwyrm/views/password.py
View File

@ -27,7 +27,9 @@ class PasswordResetRequest(View):
"""create a password reset token""" """create a password reset token"""
email = request.POST.get("email") email = request.POST.get("email")
try: try:
user = models.User.objects.get(email=email, email__isnull=False) user = models.User.viewer_aware_objects(request.user).get(
email=email, email__isnull=False
)
except models.User.DoesNotExist: except models.User.DoesNotExist:
data = {"error": _("No user with that email address was found.")} data = {"error": _("No user with that email address was found.")}
return TemplateResponse(request, "password_reset_request.html", data) return TemplateResponse(request, "password_reset_request.html", data)