mirror of
https://github.com/GSA/notifications-admin.git
synced 2026-09-11 02:23:19 -04:00
Fix wording
Changed forgot-password so that it does not expose to the user that the email address does not exist.
This commit is contained in:
@@ -124,14 +124,6 @@ class AddServiceForm(Form):
|
|||||||
class ForgotPasswordForm(Form):
|
class ForgotPasswordForm(Form):
|
||||||
email_address = email_address()
|
email_address = email_address()
|
||||||
|
|
||||||
def __init__(self, q, *args, **kwargs):
|
|
||||||
self.query_function = q
|
|
||||||
super(ForgotPasswordForm, self).__init__(*args, **kwargs)
|
|
||||||
|
|
||||||
def validate_email_address(self, a):
|
|
||||||
if not self.query_function(a.data):
|
|
||||||
raise ValidationError('The email address is not recognised. Enter the email address you registered with.')
|
|
||||||
|
|
||||||
|
|
||||||
class NewPasswordForm(Form):
|
class NewPasswordForm(Form):
|
||||||
new_password = password()
|
new_password = password()
|
||||||
|
|||||||
@@ -1,4 +1,4 @@
|
|||||||
from flask import render_template, flash
|
from flask import render_template, flash, current_app
|
||||||
from app.main import main
|
from app.main import main
|
||||||
from app.main.dao import users_dao
|
from app.main.dao import users_dao
|
||||||
from app.main.forms import ForgotPasswordForm
|
from app.main.forms import ForgotPasswordForm
|
||||||
@@ -7,9 +7,12 @@ from app.main.views import send_change_password_email
|
|||||||
|
|
||||||
@main.route('/forgot-password', methods=['GET', 'POST'])
|
@main.route('/forgot-password', methods=['GET', 'POST'])
|
||||||
def forgot_password():
|
def forgot_password():
|
||||||
form = ForgotPasswordForm(users_dao.get_user_by_email)
|
form = ForgotPasswordForm()
|
||||||
if form.validate_on_submit():
|
if form.validate_on_submit():
|
||||||
send_change_password_email(form.email_address.data)
|
if users_dao.get_user_by_email(form.email_address.data):
|
||||||
return render_template('views/password-reset-sent.html')
|
send_change_password_email(form.email_address.data)
|
||||||
|
return render_template('views/password-reset-sent.html')
|
||||||
|
else:
|
||||||
|
current_app.logger.info('The email address used does not exist.')
|
||||||
else:
|
else:
|
||||||
return render_template('views/forgot-password.html', form=form)
|
return render_template('views/forgot-password.html', form=form)
|
||||||
|
|||||||
@@ -10,7 +10,7 @@ from app.main.views import send_sms_code, check_token
|
|||||||
def new_password(token):
|
def new_password(token):
|
||||||
email_address = check_token(token)
|
email_address = check_token(token)
|
||||||
if not email_address:
|
if not email_address:
|
||||||
flash('The token we sent you has expired. Enter your email address to try again.')
|
flash('The link in the email we sent you has expired. Enter your email address to resend.')
|
||||||
return redirect(url_for('.forgot_password'))
|
return redirect(url_for('.forgot_password'))
|
||||||
|
|
||||||
user = users_dao.get_user_by_email(email_address=email_address.decode('utf-8'))
|
user = users_dao.get_user_by_email(email_address=email_address.decode('utf-8'))
|
||||||
|
|||||||
@@ -10,7 +10,7 @@ GOV.UK Notify |
|
|||||||
<div class="column-two-thirds">
|
<div class="column-two-thirds">
|
||||||
<h1 class="heading-xlarge">GOV.UK Notify</h1>
|
<h1 class="heading-xlarge">GOV.UK Notify</h1>
|
||||||
|
|
||||||
<p>You have been sent an email containing a url to reset your password.</p>
|
<p>You have been sent an email containing a link to reset your password.</p>
|
||||||
|
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
|
|||||||
@@ -15,13 +15,13 @@ def test_should_redirect_to_password_reset_sent(notifications_admin,
|
|||||||
notifications_admin_db,
|
notifications_admin_db,
|
||||||
mocker,
|
mocker,
|
||||||
notify_db_session):
|
notify_db_session):
|
||||||
_set_up_mocker(mocker)
|
mocker.patch("app.admin_api_client.send_email")
|
||||||
create_test_user('active')
|
user = create_test_user('active')
|
||||||
response = notifications_admin.test_client().post('/forgot-password',
|
response = notifications_admin.test_client().post('/forgot-password',
|
||||||
data={'email_address': 'test@user.gov.uk'})
|
data={'email_address': user.email_address})
|
||||||
|
|
||||||
assert response.status_code == 200
|
assert response.status_code == 200
|
||||||
assert 'You have been sent an email containing a url to reset your password.' in response.get_data(as_text=True)
|
assert 'You have been sent an email containing a link to reset your password.' in response.get_data(
|
||||||
|
as_text=True)
|
||||||
|
|
||||||
|
|
||||||
def test_should_redirect_to_forgot_password_with_flash_message_when_token_is_expired(notifications_admin,
|
def test_should_redirect_to_forgot_password_with_flash_message_when_token_is_expired(notifications_admin,
|
||||||
@@ -37,7 +37,3 @@ def test_should_redirect_to_forgot_password_with_flash_message_when_token_is_exp
|
|||||||
assert response.status_code == 302
|
assert response.status_code == 302
|
||||||
assert response.location == url_for('.forgot_password', _external=True)
|
assert response.location == url_for('.forgot_password', _external=True)
|
||||||
notifications_admin.config['TOKEN_MAX_AGE_SECONDS'] = 86400
|
notifications_admin.config['TOKEN_MAX_AGE_SECONDS'] = 86400
|
||||||
|
|
||||||
|
|
||||||
def _set_up_mocker(mocker):
|
|
||||||
mocker.patch("app.admin_api_client.send_email")
|
|
||||||
|
|||||||
Reference in New Issue
Block a user