From c6550f0adcec089b8801948d39d95e68b3aa2818 Mon Sep 17 00:00:00 2001 From: mdipierro Date: Fri, 18 Dec 2015 03:40:12 -0600 Subject: [PATCH] fixed a condition that allows reset_password if a reset link is sent before a user is blocked --- gluon/tools.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/gluon/tools.py b/gluon/tools.py index 1f02c859..c27c7b0d 100644 --- a/gluon/tools.py +++ b/gluon/tools.py @@ -3451,6 +3451,10 @@ class Auth(object): session.flash = self.messages.invalid_reset_password redirect(next, client_side=self.settings.client_side) + if user.registration_key in ('pending', 'disabled', 'blocked'): + session.flash = self.messages.registration_pending + redirect(next, client_side=self.settings.client_side) + if onvalidation is DEFAULT: onvalidation = self.settings.reset_password_onvalidation if onaccept is DEFAULT: