From c87bf553f639c57d68b1e585002ba42daefa8c9c Mon Sep 17 00:00:00 2001
From: mdipierro <massimo.dipierro@gmail.com>
Date: Fri, 22 Nov 2013 10:50:29 -0600
Subject: [PATCH] fixed issue  1783:Forgot password and forgot username
 functionality breaks when multiple usernames are created against the same
 email address

---
 VERSION        |  2 +-
 gluon/tools.py | 46 +++++++++++++++++++++++-----------------------
 2 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/VERSION b/VERSION
index 118837e4..c0f63a7a 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-Version 2.7.4-stable+timestamp.2013.11.22.10.24.23
+Version 2.7.4-stable+timestamp.2013.11.22.10.49.40
diff --git a/gluon/tools.py b/gluon/tools.py
index ed3340e8..874ad220 100644
--- a/gluon/tools.py
+++ b/gluon/tools.py
@@ -1998,12 +1998,8 @@ class Auth(object):
 
     def _get_login_settings(self):
         table_user = self.table_user()
-        if self.settings.login_userfield:
-            userfield = self.settings.login_userfield
-        elif 'username' in table_user.fields:
-            userfield = 'username'
-        else:
-            userfield = 'email'
+        userfield = self.settings.login_userfield or 'username' \
+            if 'username' in table_user.fields else 'email'
         passfield = self.settings.password_field
         return Storage({"table_user": table_user,
                         "userfield": userfield,
@@ -2115,12 +2111,8 @@ class Auth(object):
         row = table(ticket=ticket)
         success = False
         if row:
-            if self.settings.login_userfield:
-                userfield = self.settings.login_userfield
-            elif 'username' in table.fields:
-                userfield = 'username'
-            else:
-                userfield = 'email'
+            userfield = self.settings.login_userfield or 'username' \
+                if 'username' in table_user.fields else 'email'
             # If ticket is a service Ticket and RENEW flag respected
             if ticket[0:3] == 'ST-' and \
                     not ((row.renew and renew) ^ renew):
@@ -2691,18 +2683,19 @@ class Auth(object):
         if form.accepts(request, session if self.csrf_prevention else None,
                         formname='retrieve_username', dbio=False,
                         onvalidation=onvalidation, hideerror=self.settings.hideerror):
-            user = table_user(email=form.vars.email)
-            if not user:
+            users = table_user._db(table_user.email==form.vars.email).select()
+            if not users:
                 current.session.flash = \
                     self.messages.invalid_email
                 redirect(self.url(args=request.args))
-            username = user.username
+            username = ', '.join(u.username for u in users)
             self.settings.mailer.send(to=form.vars.email,
                     subject=self.messages.retrieve_username_subject,
                     message=self.messages.retrieve_username
                      % dict(username=username))
             session.flash = self.messages.email_sent
-            self.log_event(log, user)
+            for user in users:
+                self.log_event(log, user)
             callback(onaccept, form)
             if not next:
                 next = self.url(args=request.args)
@@ -2895,12 +2888,19 @@ class Auth(object):
             onaccept = self.settings.reset_password_onaccept
         if log is DEFAULT:
             log = self.messages['reset_password_log']
-        table_user.email.requires = [
-            IS_EMAIL(error_message=self.messages.invalid_email),
-            IS_IN_DB(self.db, table_user.email,
-                     error_message=self.messages.invalid_email)]
+        userfield = self.settings.login_userfield or 'username' \
+            if 'username' in table_user.fields else 'email'        
+        if userfield=='email':
+            table_user.email.requires = [
+                IS_EMAIL(error_message=self.messages.invalid_email),
+                IS_IN_DB(self.db, table_user.email,
+                         error_message=self.messages.invalid_email)]
+        else:
+            table_user.username.requires = [
+                IS_IN_DB(self.db, table_user.username,
+                         error_message=self.messages.invalid_username)]
         form = SQLFORM(table_user,
-                       fields=['email'],
+                       fields=[userfield],
                        hidden=dict(_next=next),
                        showid=self.settings.showid,
                        submit_button=self.messages.password_reset_button,
@@ -2915,9 +2915,9 @@ class Auth(object):
                         formname='reset_password', dbio=False,
                         onvalidation=onvalidation,
                         hideerror=self.settings.hideerror):
-            user = table_user(email=form.vars.email)
+            user = table_user(**{userfield:form.vars.email})
             if not user:
-                session.flash = self.messages.invalid_email
+                session.flash = self.messages['invalid_%s' % userfield]
                 redirect(self.url(args=request.args),
                          client_side=self.settings.client_side)
             elif user.registration_key in ('pending', 'disabled', 'blocked'):