vbatts/quay
Archived
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Recover by email needs to allow anon access to its endpoints

Browse source
This commit is contained in:
Joseph Schorr 2015-11-10 15:41:19 -05:00
parent ca8e9d89c8
commit 888ec17538
2 changed files with 5 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
endpoints/api/user.py
View file

@ -643,6 +643,7 @@ class Recovery(ApiResource):
} }
@nickname('requestRecoveryEmail') @nickname('requestRecoveryEmail')
@anon_allowed
@validate_json_request('RequestRecovery') @validate_json_request('RequestRecovery')
def post(self): def post(self):
""" Request a password recovery email.""" """ Request a password recovery email."""

5
endpoints/web.py
View file

@ -19,7 +19,7 @@ from util.invoice import renderInvoiceToPdf
from util.seo import render_snapshot from util.seo import render_snapshot
from util.cache import no_cache from util.cache import no_cache
from endpoints.common import common_login, render_page_template, route_show_if, param_required from endpoints.common import common_login, render_page_template, route_show_if, param_required
from endpoints.decorators import anon_protect from endpoints.decorators import anon_protect, anon_allowed
from endpoints.csrf import csrf_protect, generate_csrf_token, verify_csrf from endpoints.csrf import csrf_protect, generate_csrf_token, verify_csrf
from buildtrigger.customhandler import CustomBuildTrigger from buildtrigger.customhandler import CustomBuildTrigger
@ -366,6 +366,7 @@ def confirm_repo_email():
@web.route('/confirm', methods=['GET']) @web.route('/confirm', methods=['GET'])
@route_show_if(features.MAILING) @route_show_if(features.MAILING)
@anon_allowed
def confirm_email(): def confirm_email():
code = request.values['code'] code = request.values['code']
user = None user = None
@ -386,6 +387,8 @@ def confirm_email():
@web.route('/recovery', methods=['GET']) @web.route('/recovery', methods=['GET'])
@route_show_if(features.MAILING)
@anon_allowed
def confirm_recovery(): def confirm_recovery():
code = request.values['code'] code = request.values['code']
user = model.user.validate_reset_code(code) user = model.user.validate_reset_code(code)