Tivix/django-rest-auth
1
1
Fork 0
mirror of https://github.com/Tivix/django-rest-auth.git synced 2024-09-21 11:18:49 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #145 from mdentremont/topic/131

Browse Source 
#131: Do not raise 400 when resetting password for non-existing account
This commit is contained in:
mariodev 2016-01-14 23:53:31 +01:00
commit 00415301d6
2 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
rest_auth/serializers.py
View File

@ -151,9 +151,6 @@ class PasswordResetSerializer(serializers.Serializer):
if not self.reset_form.is_valid():
raise serializers.ValidationError(_('Error'))
if not UserModel.objects.filter(email__iexact=value).exists():
raise serializers.ValidationError(_('Invalid e-mail address'))
return value
def save(self):

5
rest_auth/tests/test_api.py
View File

@ -280,12 +280,15 @@ class APITestCase1(TestCase, BaseAPITestCase):
self.assertEqual(len(mail.outbox), mail_count + 1)
def test_password_reset_with_invalid_email(self):
"""
Invalid email should not raise error, as this would leak users
"""
get_user_model().objects.create_user(self.USERNAME, self.EMAIL, self.PASS)
# call password reset
mail_count = len(mail.outbox)
payload = {'email': 'nonexisting@email.com'}
self.post(self.password_reset_url, data=payload, status_code=400)
self.post(self.password_reset_url, data=payload, status_code=200)
self.assertEqual(len(mail.outbox), mail_count)
def test_user_details(self):