nngo/LT_Janitorial_Quality_Control
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

July 7 - Fix reset link hasn't been sent

Browse Source
This commit is contained in:
nngo
2026-07-07 11:25:43 -04:00
parent f84dc3d020
commit 8c23af3b80
2 changed files with 16 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/routes/auth.py
+15 -5
View File
@@ -67,7 +67,7 @@ def profile():
if form.validate_on_submit(): if form.validate_on_submit():
current_user.full_name = form.full_name.data.strip() or None current_user.full_name = form.full_name.data.strip() or None
current_user.email = form.email.data current_user.email = form.email.data.strip().lower()
if form.new_password.data: if form.new_password.data:
current_user.set_password(form.new_password.data) current_user.set_password(form.new_password.data)
@@ -156,7 +156,7 @@ def create_user():
user = User( user = User(
username=form.username.data, username=form.username.data,
full_name=form.full_name.data.strip() or None, full_name=form.full_name.data.strip() or None,
email=form.email.data, email=form.email.data.strip().lower(),
role=role role=role
) )
user.set_password(form.password.data) user.set_password(form.password.data)
@@ -190,7 +190,7 @@ def edit_user(user_id):
if form.validate_on_submit(): if form.validate_on_submit():
user.username = form.username.data user.username = form.username.data
user.full_name = form.full_name.data.strip() or None user.full_name = form.full_name.data.strip() or None
user.email = form.email.data user.email = form.email.data.strip().lower()
if not director_editing: if not director_editing:
user.role = form.role.data user.role = form.role.data
@@ -479,12 +479,22 @@ def forgot_password():
form = ForgotPasswordForm() form = ForgotPasswordForm()
if form.validate_on_submit(): if form.validate_on_submit():
user = User.query.filter_by(email=form.email.data.strip().lower()).first() # Case-insensitive lookup: emails are stored with inconsistent casing
# across create/edit/import paths, so a plain lowercased == match can
# silently miss a mixed-case stored address and send nothing.
email_input = form.email.data.strip().lower()
user = User.query.filter(
db.func.lower(User.email) == email_input
).first()
if user and user.active: if user and user.active:
token = user.generate_set_password_token(expires_hours=1) token = user.generate_set_password_token(expires_hours=1)
db.session.commit() db.session.commit()
_send_password_reset_email(user, token, base_url=request.host_url) _send_password_reset_email(user, token, base_url=request.host_url)
logger.info('AUTH | forgot_password | user=%s | email=%s', user.username, user.email) logger.info('AUTH | forgot_password | reset link dispatched | user=%s | email=%s',
user.username, user.email)
else:
# No leak to the user (generic message below), but log for diagnosis.
logger.info('AUTH | forgot_password | no active account for email=%s', email_input)
# Always show the same message — never reveal whether the email exists # Always show the same message — never reveal whether the email exists
flash( flash(
'If an account with that email address exists, a password reset link ' 'If an account with that email address exists, a password reset link '
app/routes/customers.py
+1 -1
View File
@@ -328,7 +328,7 @@ def edit(customer_id):
if form.validate_on_submit(): if form.validate_on_submit():
customer.username = form.username.data customer.username = form.username.data
customer.full_name = form.full_name.data.strip() or None customer.full_name = form.full_name.data.strip() or None
customer.email = form.email.data customer.email = form.email.data.strip().lower()
if form.password.data: if form.password.data:
customer.set_password(form.password.data) customer.set_password(form.password.data)
db.session.commit() db.session.commit()