Rebecca Law bb1db0c345 When the user request a reset password link, the user.state is set to request_password_reset. ...

Which means the user will only be able to reset their password, and not sign-in.
Once the user resets the password the user state is set to active once more.
If the link is used a second time they will be redirected to the index page with a message
that the link in the email is not longer valid.

2016-01-11 12:23:08 +00:00

..

app

When the user request a reset password link, the user.state is set to request_password_reset.

2016-01-11 12:23:08 +00:00

__init__.py

…

conftest.py

Fix for security hole with setting session['user_id'] before second factor of authentication has been authorised.

2016-01-07 12:43:10 +00:00