# HG changeset patch # User Marcin Kuzminski # Date 2017-02-28 10:30:29 # Node ID 1307b88c408e4e85c207a6395437b6d0dc93fd98 # Parent 336b26f2e0f885de3d0b2d5783ed20338f219c37 password-reset: improved error reporting for captch and empty email diff --git a/rhodecode/login/views.py b/rhodecode/login/views.py --- a/rhodecode/login/views.py +++ b/rhodecode/login/views.py @@ -321,6 +321,7 @@ class LoginView(object): error_dict = {'recaptcha_field': _msg} raise formencode.Invalid( _msg, _value, None, error_dict=error_dict) + # Generate reset URL and send mail. user = User.get_by_email(user_email) @@ -346,7 +347,16 @@ class LoginView(object): except formencode.Invalid as errors: render_ctx.update({ 'defaults': errors.value, + 'errors': errors.error_dict, }) + if not self.request.params.get('email'): + # case of empty email, we want to report that + return render_ctx + + if 'recaptcha_field' in errors.error_dict: + # case of failed captcha + return render_ctx + log.debug('faking response on invalid password reset') # make this take 2s, to prevent brute forcing. time.sleep(2)