Misago/misago/users/views/forgottenpassword.py

from django.contrib.auth import get_user_model
from django.shortcuts import get_object_or_404, render
from django.urls import reverse
from django.utils.translation import ugettext as _

from misago.core.exceptions import Banned
from misago.users.bans import get_user_ban
from misago.users.decorators import deny_banned_ips
from misago.users.tokens import is_password_change_token_valid


def reset_view(f):
    @deny_banned_ips
    def decorator(*args, **kwargs):
        return f(*args, **kwargs)

    return decorator


@reset_view
def request_reset(request):
    return render(request, 'misago/forgottenpassword/request.html')


class ResetError(Exception):
    pass


@reset_view
def reset_password_form(request, pk, token):
    requesting_user = get_object_or_404(get_user_model(), pk=pk, is_active=True)

    try:
        if (request.user.is_authenticated and request.user.id != requesting_user.id):
            message = _("%(user)s, your link has expired. Please request new link and try again.")
            raise ResetError(message % {'user': requesting_user.username})

        if not is_password_change_token_valid(requesting_user, token):
            message = _("%(user)s, your link is invalid. Please try again or request new link.")
            raise ResetError(message % {'user': requesting_user.username})

        ban = get_user_ban(requesting_user)
        if ban:
            raise Banned(ban)
    except ResetError as e:
        return render(
            request, 'misago/forgottenpassword/error.html', {
                'message': e.args[0],
            }, status=400
        )

    request.frontend_context['url'].update({
        'change_forgotten_password': reverse(
            'misago:api:change-forgotten-password',
            kwargs={
                'pk': pk,
                'token': token,
            },
        ),
    })

    return render(request, 'misago/forgottenpassword/form.html')