search

macropin / django-registration

Django-registration (redux) provides user registration functionality for Django websites.
http://django-registration-redux.readthedocs.org
Other
975 stars 347 forks source link

Password reset does not work when no password exists #288

Closed brumiser1550 closed 7 years ago

brumiser1550 commented 7 years ago

I am not sure if this is an issue with redux or the underlying Django code.

I have been bashing my head trying to get a password reset email to send with no luck and I was thinking that it was my email backend that was having issues but it was not.

I was trying to reset a password for a user that never had a password set because the user was created programmatically without one. I figured this out by going through the whole auth process from start to finish and then trying the password reset and it worked. When I looked at the difference of the two records I noticed the test record had no prior password. Seeing this I manually set a password and then tried the password reset and it worked.

I have tried digging through source code but I cannot find any where in the password reset process where it checks if an old password exists.

I think returning an error, or at least some notification, would be nice so people like me do not spend hours debugging a bizarre issue. I would be happy to help if someone can point me in the right direction to do so.

joshblum commented 7 years ago

hey @brumiser1550 really sorry that you ran into this! In the latest version of Django (1.11.5) before sending mail, there is a check if each user has a usable password. Unfortunately I wasn't able to find any explicit documentation on this behavior. However, if you override the get_users function on the PasswordResetForm and use your version of the form in the PasswordResetView you should be able to change the functionality to fit your needs.

I think the best way to fix the issue long term would be to provide documentation within the Django project since we use the password reset logic from Django itself in this library. Hope this helps! I'm going to close the issue for now, but let me know if you run into any other problems.

brumiser1550 commented 7 years ago

Thanks for the response. I am glad that I was not the only one having a hard time finding any docs on this! I think that is kind of a silly check considering the flow of wanting to not set/generate passwords and letting the user just use the password reset to "Finish account setup" or something. I went ahead and added a generate password anywhere I a user was being created programmatically to fix this issue.

I might go bother the people over at Django project and see what they think.

Thanks again!

P.S. Love the work you all are doing, keep it up!

joshblum commented 7 years ago

Happy to help!