Mercurial > p > roundup > code
view website/issues/extensions/timestamp.py @ 5093:9954a358da18
- allow user to recover account password using an entry in the
Alternate E-mail addresses list. See:
http://psf.upfronthosting.co.za/roundup/meta/issue564
for description. Merge request at:
https://sourceforge.net/p/roundup/code/merge-requests/1/
Patch supplied by kinggreedy. Applied/tested by John Rouillard
It makes this work:
Click "Lost your login?" link
Enter an alternate address in the email address block.
Submit.
Get an email sent to alternate address with a one time reset
url.
Go to that url.
Before patch, email with new password was sent to the
address "E-mail address" for the user and not to the
alternate address.
After the patch, the email with new password is sent
to the "validated" (against the alternate address list)
alternate address supplied by the user.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Mon, 20 Jun 2016 22:04:32 -0400 |
| parents | c2d0d3e9099d |
| children | 35ea9b1efc14 |
line wrap: on
line source
import time, struct, base64 from roundup.cgi.actions import RegisterAction from roundup.cgi.exceptions import * def timestamp(): return base64.encodestring(struct.pack("i", time.time())).strip() def unpack_timestamp(s): return struct.unpack("i",base64.decodestring(s))[0] class Timestamped: def check(self): try: created = unpack_timestamp(self.form['opaque'].value) except KeyError: raise FormError, "somebody tampered with the form" if time.time() - created < 4: raise FormError, "responding to the form too quickly" return True class TimestampedRegister(Timestamped, RegisterAction): def permission(self): self.check() RegisterAction.permission(self) def init(instance): instance.registerUtil('timestamp', timestamp) instance.registerAction('register', TimestampedRegister)
