password-reset: improved error reporting for captch and empty email

This commit is contained in:
Marcin Kuzminski 2017-02-28 11:30:29 +01:00
parent 0ab5270199
commit 64e7b08b8c

View file

@ -321,6 +321,7 @@ class LoginView(object):
error_dict = {'recaptcha_field': _msg}
raise formencode.Invalid(
_msg, _value, None, error_dict=error_dict)
# Generate reset URL and send mail.
user = User.get_by_email(user_email)
@ -346,7 +347,16 @@ class LoginView(object):
except formencode.Invalid as errors:
render_ctx.update({
'defaults': errors.value,
'errors': errors.error_dict,
})
if not self.request.params.get('email'):
# case of empty email, we want to report that
return render_ctx
if 'recaptcha_field' in errors.error_dict:
# case of failed captcha
return render_ctx
log.debug('faking response on invalid password reset')
# make this take 2s, to prevent brute forcing.
time.sleep(2)