July 7 - Fix reset link hasn't been sent 2

2026-07-07 13:04:07 -04:00
parent 9b1f57769e
commit a10e314854
4 changed files with 15 additions and 80 deletions
@@ -1,5 +1,4 @@
 from flask import Blueprint, render_template, redirect, url_for, flash, request, abort
-from urllib.parse import urlparse
 from flask_login import login_user, logout_user, login_required, current_user
 from app import db, limiter
 from app.models.user import User
@@ -403,7 +402,6 @@ def _send_password_reset_email(user, token, base_url=None):
    from flask import current_app, render_template_string, url_for as _url_for
    from flask_mail import Message
    from app import mail
-    from urllib.parse import urlparse
    import threading

    if not current_app.config.get('MAIL_SERVER'):
@@ -412,8 +410,14 @@ def _send_password_reset_email(user, token, base_url=None):

    effective_base = (base_url or current_app.config.get('APP_BASE_URL', '')).rstrip('/')
    reset_link     = f'{effective_base}{_url_for("auth.reset_password", token=token)}'
-    host           = urlparse(effective_base).netloc or 'janitorialqc.local'
-    sender         = f'noreply@{host}'
+    # From MUST be the authenticated SMTP identity, otherwise the mail server
+    # accepts the message but it is dropped downstream by SPF/DMARC/relay policy
+    # (a per-host noreply@<domain> is NOT an authorized sender). The per-domain
+    # host is still reflected in the reset LINK above, preserving rule 64's
+    # multi-domain intent without breaking deliverability.
+    sender         = (current_app.config.get('MAIL_DEFAULT_SENDER')
+                      or current_app.config.get('MAIL_USERNAME')
+                      or 'noreply@janitorialqc.local')

    html_body = render_template_string("""<!DOCTYPE html>
 <html>