mirror of
https://github.com/GSA/notifications-admin.git
synced 2026-07-24 09:58:43 -04:00
bb1db0c345
Which means the user will only be able to reset their password, and not sign-in. Once the user resets the password the user state is set to active once more. If the link is used a second time they will be redirected to the index page with a message that the link in the email is not longer valid.
29 lines
1.1 KiB
Python
29 lines
1.1 KiB
Python
from flask import (render_template, url_for, redirect, flash)
|
|
|
|
from app.main import main
|
|
from app.main.dao import users_dao
|
|
from app.main.forms import NewPasswordForm
|
|
from app.main.views import send_sms_code, check_token
|
|
|
|
|
|
@main.route('/new-password/<path:token>', methods=['GET', 'POST'])
|
|
def new_password(token):
|
|
email_address = check_token(token)
|
|
if not email_address:
|
|
flash('The link in the email we sent you has expired. Enter your email address to resend.')
|
|
return redirect(url_for('.forgot_password'))
|
|
|
|
user = users_dao.get_user_by_email(email_address=email_address.decode('utf-8'))
|
|
if user and user.state != 'request_password_reset':
|
|
flash('The link in the email we sent you has already been used.')
|
|
return redirect(url_for('.index'))
|
|
|
|
form = NewPasswordForm()
|
|
|
|
if form.validate_on_submit():
|
|
users_dao.update_password(user, form.new_password.data)
|
|
send_sms_code(user.id, user.mobile_number)
|
|
return redirect(url_for('main.two_factor'))
|
|
else:
|
|
return render_template('views/new-password.html', token=token, form=form, user=user)
|