ResetPasswordForm doesn't consider unusable_password setting

[Ivan Gromov]

For example, users, who been logged in by LDAP, can change their password with django.contrib.auth.forms.PasswordResetForm and become independent from LDAP server.

[Ivan Gromov]

Excluded users with unusable password from ResetPasswordForm

[Natalia Bidart]

The patch needs to also provide unit tests.

[Thejaswi Puthraya]

Test and patch

[Thejaswi Puthraya]

Patch is more or less the same as nessita's with the exception that it shows an error that the password cannot be changed for this account. Adds a test as an addition.

Doesn't have the docs of nessita's patch.

[Thejaswi Puthraya]

updated the code, add docs and tests

[Łukasz Rekucki]

The current patch changes a single query that populates self.user_cache into to 2 queries that don't. I would suggest something in lines of:

if len(self.users_cache) == 0:
    raise forms.ValidationError(_("That e-mail address doesn't have an associated user account. Are you sure you've registered?"))
if any((user.password == UNUSABLE_PASSWORD) for user in self.users_cache):
    raise forms.ValidationError(_("The user account associated with this email address cannot reset it's password.")) 

[Thejaswi Puthraya]

lrekucki,
I like your patch but the 'any' function is part of python 2.5 and later.

I am not sure if 2 'count' queries or evaluating the queryset is recommended.

[Łukasz Rekucki]

Here's a patch. Lack of "any" isn't a problem, 'cause you can just turn in into 3 line loop... or add it to django.utils.itercompat like I did (we have all(), so I don't see a reason why we shouldn't have any()). Anyway, after giving this more thought, this can cause trouble if someone used the PasswordResetForm as part of his registration process. I know at least one application that would be affected, but this may just be a misuse of this form.

[Ramiro Morales]

Replying to lrekucki:

Lack of "any" isn't a problem, 'cause you can just turn in into 3 line loop... or add it to django.utils.itercompat like I did

FYI, I already added any() in r14563/r14565 with a simple and uncontroversial modification, feel free to pursue proposal of the bigger changes mods to itercompat you had implemented in your patch.

[Jannis Leidel]

In [16455]:

Fixed #14674 -- Prevent user accounts with an unusable password from resetting passwords. Thanks, summerisgone, thejaswi_puthraya and lrekucki.