Prevent password reset for inactive users

2021-09-27 09:29:13 -07:00 · 2021-09-27 09:29:13 -07:00 · c399d6edfb
commit c399d6edfb
parent cfca806af8
1 changed files with 3 additions and 1 deletions
--- a/bookwyrm/views/password.py
+++ b/bookwyrm/views/password.py
@ -27,7 +27,9 @@ class PasswordResetRequest(View):
        """create a password reset token"""
        email = request.POST.get("email")
        try:
-            user = models.User.objects.get(email=email, email__isnull=False)
+            user = models.User.viewer_aware_objects(request.user).get(
+                email=email, email__isnull=False
+            )
        except models.User.DoesNotExist:
            data = {"error": _("No user with that email address was found.")}
            return TemplateResponse(request, "password_reset_request.html", data)