Ticket #14918: password-reset-with-username.patch

django/contrib/admin/templates/registration/password_reset_form.html

@@ -9 +9 @@
 
 <h1>{% trans "Password reset" %}</h1>
 
-<p>{% trans "Forgotten your password? Enter your e-mail address below, and we'll e-mail instructions for setting a new one." %}</p>
+<p>{% trans "Forgotten your password? Enter your username or e-mail address below, and we'll e-mail instructions for setting a new one." %}</p>
 
 <form action="" method="post">{% csrf_token %}
 {{ form.email.errors }}
-<p><label for="id_email">{% trans 'E-mail address:' %}</label> {{ form.email }} <input type="submit" value="{% trans 'Reset my password' %}" /></p>
+<p><label for="id_email_or_username">{% trans 'E-mail address:' %}</label> {{ form.email }} <input type="submit" value="{% trans 'Reset my password' %}" /></p>
 </form>
 
 {% endblock %}

django/contrib/auth/forms.py

@@ +1 @@
+import re
+from django.core.validators import validate_email
 from django.contrib.auth.models import User
 from django.contrib.auth import authenticate
 from django.contrib.auth.tokens import default_token_generator
@@ -7 +9 @@
 from django.utils.translation import ugettext_lazy as _
 from django.utils.http import int_to_base36
 
+USERNAME_RE = re.compile(r'^[\w.@+-]+$')
+
+def guess_is_email(string):
+    if not USERNAME_RE.match(string):
+        # can't be a username
+        return True
+    try:
+        validate_email(string)
+        return True
+    except forms.ValidationError:
+        return False
+
 class UserCreationForm(forms.ModelForm):
     """
     A form that creates a user, with no privileges, from the given username and password.
     """
-    username = forms.RegexField(label=_("Username"), max_length=30, regex=r'^[\w.@+-]+$',
+    username = forms.RegexField(label=_("Username"), max_length=30, regex=USERNAME_RE,
         help_text = _("Required. 30 characters or fewer. Letters, digits and @/./+/-/_ only."),
         error_messages = {'invalid': _("This value may contain only letters, numbers and @/./+/-/_ characters.")})
     password1 = forms.CharField(label=_("Password"), widget=forms.PasswordInput)
@@ -105 +119 @@
         return self.user_cache
 
 class PasswordResetForm(forms.Form):
-    email = forms.EmailField(label=_("E-mail"), max_length=75)
+    email_or_username = forms.CharField(label=_("E-mail or username"), max_length=75)
 
-    def clean_email(self):
+    def clean_email_or_username(self):
         """
-        Validates that a user exists with the given e-mail address.
+        Validates that a user exists with the given e-mail address or username.
         """
-        email = self.cleaned_data["email"]
-        self.users_cache = User.objects.filter(email__iexact=email)
+        identifier = self.cleaned_data["email_or_username"]
+        if guess_is_email(identifier):
+            self.users_cache = User.objects.filter(email__iexact=identifier)
+        else:
+            self.users_cache = User.objects.filter(username=identifier)
         if len(self.users_cache) == 0:
-            raise forms.ValidationError(_("That e-mail address doesn't have an associated user account. Are you sure you've registered?"))
-        return email
+            raise forms.ValidationError(_("Unknown username or e-mail. Are you sure you've registered?"))
+        return identifier
 
     def save(self, domain_override=None, email_template_name='registration/password_reset_email.html',
              use_https=False, token_generator=default_token_generator, from_email=None, request=None):

django/contrib/auth/tests/forms.py

@@ -219 +219 @@
 
     fixtures = ['authtestdata.json']
 
-    def test_invalid_email(self):
-        data = {'email':'not valid'}
-        form = PasswordResetForm(data)
-        self.assertFalse(form.is_valid())
-        self.assertEqual(form['email'].errors,
-                         [u'Enter a valid e-mail address.'])
-
     def test_nonexistant_email(self):
         # Test nonexistant email address
-        data = {'email':'foo@bar.com'}
+        data = {'email_or_username':'foo@bar.com'}
         form = PasswordResetForm(data)
         self.assertFalse(form.is_valid())
         self.assertEqual(form.errors,
-                         {'email': [u"That e-mail address doesn't have an associated user account. Are you sure you've registered?"]})
+                         {'email_or_username': [u"Unknown username or e-mail. Are you sure you've registered?"]})
 
     def test_cleaned_data(self):
         # Regression test
         user = User.objects.create_user("jsmith3", "jsmith3@example.com", "test123")
-        data = {'email':'jsmith3@example.com'}
+        data = {'email_or_username':'jsmith3@example.com'}
         form = PasswordResetForm(data)
         self.assertTrue(form.is_valid())
-        self.assertEqual(form.cleaned_data['email'], u'jsmith3@example.com')
+        self.assertEqual(form.cleaned_data['email_or_username'], u'jsmith3@example.com')
 
 
     def test_bug_5605(self):

django/contrib/auth/tests/views.py

@@ -47 +47 @@
 class PasswordResetTest(AuthViewsTestCase):
 
     def test_email_not_found(self):
-        "Error is raised if the provided email address isn't currently registered"
+        "Error is raised if the provided username/email address isn't currently registered"
         response = self.client.get('/password_reset/')
         self.assertEquals(response.status_code, 200)
-        response = self.client.post('/password_reset/', {'email': 'not_a_real_email@email.com'})
-        self.assertContains(response, "That e-mail address doesn't have an associated user account")
-        self.assertEquals(len(mail.outbox), 0)
+        for identifier in ['not_a_real_username', 'not_a_real_email@email.com']:
+            response = self.client.post('/password_reset/', {'email_or_username': identifier})
+            self.assertContains(response, "Unknown username or e-mail.")
+            self.assertEquals(len(mail.outbox), 0)
 
     def test_email_found(self):
-        "Email is sent if a valid email address is provided for password reset"
-        response = self.client.post('/password_reset/', {'email': 'staffmember@example.com'})
-        self.assertEquals(response.status_code, 302)
-        self.assertEquals(len(mail.outbox), 1)
-        self.assert_("http://" in mail.outbox[0].body)
-        self.assertEquals(settings.DEFAULT_FROM_EMAIL, mail.outbox[0].from_email)
+        "Email is sent if a valid username/email address is provided for password reset"
+        for i, identifier in enumerate(['staff', 'staffmember@example.com'], 1):
+            response = self.client.post('/password_reset/', {'email_or_username' : identifier})
+            self.assertEquals(response.status_code, 302)
+            self.assertEquals(len(mail.outbox), i)
+            self.assert_("http://" in mail.outbox[0].body)
+            self.assertEquals(settings.DEFAULT_FROM_EMAIL, mail.outbox[0].from_email)
 
     def test_email_found_custom_from(self):
-        "Email is sent if a valid email address is provided for password reset when a custom from_email is provided."
-        response = self.client.post('/password_reset_from_email/', {'email': 'staffmember@example.com'})
-        self.assertEquals(response.status_code, 302)
-        self.assertEquals(len(mail.outbox), 1)
-        self.assertEquals("staffmember@example.com", mail.outbox[0].from_email)
+        "Email is sent if a valid username/email address is provided for password reset when a custom from_email is provided."
+        for i, identifier in enumerate(['staff', 'staffmember@example.com'], 1):
+            response = self.client.post('/password_reset_from_email/', {'email_or_username': identifier})
+            self.assertEquals(response.status_code, 302)
+            self.assertEquals(len(mail.outbox), i)
+            self.assertEquals("staffmember@example.com", mail.outbox[0].from_email)
 
     def _test_confirm_start(self):
         # Start by creating the email
-        response = self.client.post('/password_reset/', {'email': 'staffmember@example.com'})
+        response = self.client.post('/password_reset/', {'email_or_username': 'staffmember@example.com'})
         self.assertEquals(response.status_code, 302)
         self.assertEquals(len(mail.outbox), 1)
         return self._read_signup_email(mail.outbox[0])