innov
/
django1
1
0
Fork 0
Code Issues Pull Requests 1 Projects Releases Wiki Activity

Fixed #27840 -- Fixed KeyError in PasswordResetConfirmView.form_valid(). 

When a user is already logged in when submitting the password and
password confirmation to reset a password, a KeyError occurred while
removing the reset session token from the session.

Refs #17209

Thanks Quentin Marlats for the report and Florian Apolloner and Tim
Graham for the review.
This commit is contained in:
Markus Holtermann 2017-02-14 23:35:42 +01:00
parent 103e6cf26c
commit b9b35f9efa
No known key found for this signature in database
GPG Key ID: AFE79D68D41C7E39
2 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
django/contrib/auth/views.py
View File

@ -460,9 +460,9 @@ class PasswordResetConfirmView(PasswordContextMixin, FormView):
def form_valid(self, form): def form_valid(self, form):
user = form.save() user = form.save()
del self.request.session[INTERNAL_RESET_SESSION_TOKEN]
if self.post_reset_login: if self.post_reset_login:
auth_login(self.request, user) auth_login(self.request, user)
del self.request.session[INTERNAL_RESET_SESSION_TOKEN]
return super().form_valid(form) return super().form_valid(form)
def get_context_data(self, **kwargs): def get_context_data(self, **kwargs):

8
tests/auth_tests/test_views.py
View File

@ -327,6 +327,14 @@ class PasswordResetTest(AuthViewsTestCase):
self.assertRedirects(response, '/reset/done/', fetch_redirect_response=False) self.assertRedirects(response, '/reset/done/', fetch_redirect_response=False)
self.assertIn(SESSION_KEY, self.client.session) self.assertIn(SESSION_KEY, self.client.session)
def test_confirm_login_post_reset_already_logged_in(self):
url, path = self._test_confirm_start()
path = path.replace('/reset/', '/reset/post_reset_login/')
self.login()
response = self.client.post(path, {'new_password1': 'anewpassword', 'new_password2': 'anewpassword'})
self.assertRedirects(response, '/reset/done/', fetch_redirect_response=False)
self.assertIn(SESSION_KEY, self.client.session)
def test_confirm_display_user_from_form(self): def test_confirm_display_user_from_form(self):
url, path = self._test_confirm_start() url, path = self._test_confirm_start()
response = self.client.get(path) response = self.client.get(path)