always return 200 in /forgot_password
This commit is contained in:
parent
a1fad2216f
commit
b0f2d7b85a
|
@ -802,9 +802,7 @@ Output:
|
||||||
Input:
|
Input:
|
||||||
- email
|
- email
|
||||||
|
|
||||||
Output:
|
Output: always return 200, even if email doesn't exist. User need to enter correctly their email.
|
||||||
- 200: user is going to receive an email to reset the password
|
|
||||||
- 400 if error (email not found)
|
|
||||||
|
|
||||||
#### GET /api/aliases
|
#### GET /api/aliases
|
||||||
|
|
||||||
|
|
|
@ -332,16 +332,14 @@ def forgot_password():
|
||||||
|
|
||||||
"""
|
"""
|
||||||
data = request.get_json()
|
data = request.get_json()
|
||||||
if not data:
|
if not data or not data.get("email"):
|
||||||
return jsonify(error="request body cannot be empty"), 400
|
return jsonify(error="request body must contain email"), 400
|
||||||
|
|
||||||
email = data.get("email")
|
email = data.get("email").lower()
|
||||||
|
|
||||||
user = User.get_by(email=email)
|
user = User.get_by(email=email)
|
||||||
|
|
||||||
if not user:
|
if user:
|
||||||
return jsonify(error="Email not found"), 400
|
send_reset_password_email(user)
|
||||||
|
|
||||||
send_reset_password_email(user)
|
return jsonify(ok=True)
|
||||||
|
|
||||||
return jsonify(reset_sent=True)
|
|
||||||
|
|
|
@ -210,9 +210,9 @@ def test_auth_login_forgot_password(flask_client):
|
||||||
|
|
||||||
assert r.status_code == 200
|
assert r.status_code == 200
|
||||||
|
|
||||||
# No such email
|
# No such email, still return 200
|
||||||
r = flask_client.post(
|
r = flask_client.post(
|
||||||
url_for("api.forgot_password"), json={"email": "not-exist@b.c"},
|
url_for("api.forgot_password"), json={"email": "not-exist@b.c"},
|
||||||
)
|
)
|
||||||
|
|
||||||
assert r.status_code == 400
|
assert r.status_code == 200
|
||||||
|
|
Loading…
Reference in a new issue