dinislage/web2py
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fixed a condition that allows reset_password if a reset link is sent before a user is blocked

Browse Source
This commit is contained in:
mdipierro
2015-12-18 03:40:12 -06:00
parent 22c89d8dcc
commit c6550f0adc
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
gluon/tools.py
+4
View File
@@ -3451,6 +3451,10 @@ class Auth(object):
session.flash = self.messages.invalid_reset_password session.flash = self.messages.invalid_reset_password
redirect(next, client_side=self.settings.client_side) redirect(next, client_side=self.settings.client_side)
if user.registration_key in ('pending', 'disabled', 'blocked'):
session.flash = self.messages.registration_pending
redirect(next, client_side=self.settings.client_side)
if onvalidation is DEFAULT: if onvalidation is DEFAULT:
onvalidation = self.settings.reset_password_onvalidation onvalidation = self.settings.reset_password_onvalidation
if onaccept is DEFAULT: if onaccept is DEFAULT: