dinislage/web2py
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fixed issue 1783:Forgot password and forgot username functionality breaks when multiple usernames are created against the same email address

Browse Source
This commit is contained in:
mdipierro
2013-11-22 10:50:29 -06:00
parent 2361eb4a84
commit c87bf553f6
2 changed files with 24 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
VERSION
+1 -1
View File
@@ -1 +1 @@
Version 2.7.4-stable+timestamp.2013.11.22.10.24.23 Version 2.7.4-stable+timestamp.2013.11.22.10.49.40
gluon/tools.py
+23 -23
View File
@@ -1998,12 +1998,8 @@ class Auth(object):
def _get_login_settings(self): def _get_login_settings(self):
table_user = self.table_user() table_user = self.table_user()
if self.settings.login_userfield: userfield = self.settings.login_userfield or 'username' \
userfield = self.settings.login_userfield if 'username' in table_user.fields else 'email'
elif 'username' in table_user.fields:
userfield = 'username'
else:
userfield = 'email'
passfield = self.settings.password_field passfield = self.settings.password_field
return Storage({"table_user": table_user, return Storage({"table_user": table_user,
"userfield": userfield, "userfield": userfield,
@@ -2115,12 +2111,8 @@ class Auth(object):
row = table(ticket=ticket) row = table(ticket=ticket)
success = False success = False
if row: if row:
if self.settings.login_userfield: userfield = self.settings.login_userfield or 'username' \
userfield = self.settings.login_userfield if 'username' in table_user.fields else 'email'
elif 'username' in table.fields:
userfield = 'username'
else:
userfield = 'email'
# If ticket is a service Ticket and RENEW flag respected # If ticket is a service Ticket and RENEW flag respected
if ticket[0:3] == 'ST-' and \ if ticket[0:3] == 'ST-' and \
not ((row.renew and renew) ^ renew): not ((row.renew and renew) ^ renew):
@@ -2691,18 +2683,19 @@ class Auth(object):
if form.accepts(request, session if self.csrf_prevention else None, if form.accepts(request, session if self.csrf_prevention else None,
formname='retrieve_username', dbio=False, formname='retrieve_username', dbio=False,
onvalidation=onvalidation, hideerror=self.settings.hideerror): onvalidation=onvalidation, hideerror=self.settings.hideerror):
user = table_user(email=form.vars.email) users = table_user._db(table_user.email==form.vars.email).select()
if not user: if not users:
current.session.flash = \ current.session.flash = \
self.messages.invalid_email self.messages.invalid_email
redirect(self.url(args=request.args)) redirect(self.url(args=request.args))
username = user.username username = ', '.join(u.username for u in users)
self.settings.mailer.send(to=form.vars.email, self.settings.mailer.send(to=form.vars.email,
subject=self.messages.retrieve_username_subject, subject=self.messages.retrieve_username_subject,
message=self.messages.retrieve_username message=self.messages.retrieve_username
% dict(username=username)) % dict(username=username))
session.flash = self.messages.email_sent session.flash = self.messages.email_sent
self.log_event(log, user) for user in users:
self.log_event(log, user)
callback(onaccept, form) callback(onaccept, form)
if not next: if not next:
next = self.url(args=request.args) next = self.url(args=request.args)
@@ -2895,12 +2888,19 @@ class Auth(object):
onaccept = self.settings.reset_password_onaccept onaccept = self.settings.reset_password_onaccept
if log is DEFAULT: if log is DEFAULT:
log = self.messages['reset_password_log'] log = self.messages['reset_password_log']
table_user.email.requires = [ userfield = self.settings.login_userfield or 'username' \
IS_EMAIL(error_message=self.messages.invalid_email), if 'username' in table_user.fields else 'email'
IS_IN_DB(self.db, table_user.email, if userfield=='email':
error_message=self.messages.invalid_email)] table_user.email.requires = [
IS_EMAIL(error_message=self.messages.invalid_email),
IS_IN_DB(self.db, table_user.email,
error_message=self.messages.invalid_email)]
else:
table_user.username.requires = [
IS_IN_DB(self.db, table_user.username,
error_message=self.messages.invalid_username)]
form = SQLFORM(table_user, form = SQLFORM(table_user,
fields=['email'], fields=[userfield],
hidden=dict(_next=next), hidden=dict(_next=next),
showid=self.settings.showid, showid=self.settings.showid,
submit_button=self.messages.password_reset_button, submit_button=self.messages.password_reset_button,
@@ -2915,9 +2915,9 @@ class Auth(object):
formname='reset_password', dbio=False, formname='reset_password', dbio=False,
onvalidation=onvalidation, onvalidation=onvalidation,
hideerror=self.settings.hideerror): hideerror=self.settings.hideerror):
user = table_user(email=form.vars.email) user = table_user(**{userfield:form.vars.email})
if not user: if not user:
session.flash = self.messages.invalid_email session.flash = self.messages['invalid_%s' % userfield]
redirect(self.url(args=request.args), redirect(self.url(args=request.args),
client_side=self.settings.client_side) client_side=self.settings.client_side)
elif user.registration_key in ('pending', 'disabled', 'blocked'): elif user.registration_key in ('pending', 'disabled', 'blocked'):