fixed a condition that allows reset_password if a reset link is sent before a user is blocked

2015-12-18 03:40:12 -06:00
parent 22c89d8dcc
commit c6550f0adc
1 changed files with 4 additions and 0 deletions
@@ -3451,6 +3451,10 @@ class Auth(object):
            session.flash = self.messages.invalid_reset_password
            redirect(next, client_side=self.settings.client_side)

+        if user.registration_key in ('pending', 'disabled', 'blocked'):
+            session.flash = self.messages.registration_pending
+            redirect(next, client_side=self.settings.client_side)
+
        if onvalidation is DEFAULT:
            onvalidation = self.settings.reset_password_onvalidation
        if onaccept is DEFAULT: