Rollback 19962.

 - Legacy-Id: 19964

Author: rjsparks

ietf/ietfauth/tests.py

@@ -373,11 +373,9 @@ def test_nomcom_dressing_on_profile(self):
 
     def test_reset_password(self):
         url = urlreverse(ietf.ietfauth.views.password_reset)
-        email = 'someone@example.com'
-        password = 'foobar'
 
-        user = User.objects.create(username=email, email=email)
-        user.set_password(password)
+        user = User.objects.create(username="someone@example.com", email="someone@example.com")
+        user.set_password("forgotten")
         user.save()
         p = Person.objects.create(name="Some One", ascii="Some One", user=user)
         Email.objects.create(address=user.username, person=p, origin=user.username)
@@ -416,39 +414,6 @@ def test_reset_password(self):
         self.assertEqual(len(q("form .has-error")), 0)
         self.assertTrue(self.username_in_htpasswd_file(user.username))
 
-        # reuse reset url
-        r = self.client.get(confirm_url)
-        self.assertEqual(r.status_code, 404)
-
-        # login after reset request
-        empty_outbox()
-        user.set_password(password)
-        user.save()
-
-        r = self.client.post(url, { 'username': user.username })
-        self.assertEqual(r.status_code, 200)
-        self.assertEqual(len(outbox), 1)
-        confirm_url = self.extract_confirm_url(outbox[-1])
-
-        r = self.client.post(urlreverse(ietf.ietfauth.views.login), {'username': email, 'password': password})
-
-        r = self.client.get(confirm_url)
-        self.assertEqual(r.status_code, 404)
-
-        # change password after reset request
-        empty_outbox()
-
-        r = self.client.post(url, { 'username': user.username })
-        self.assertEqual(r.status_code, 200)
-        self.assertEqual(len(outbox), 1)
-        confirm_url = self.extract_confirm_url(outbox[-1])
-
-        user.set_password('newpassword')
-        user.save()
-
-        r = self.client.get(confirm_url)
-        self.assertEqual(r.status_code, 404)
-
     def test_review_overview(self):
         review_req = ReviewRequestFactory()
         assignment = ReviewAssignmentFactory(review_request=review_req,reviewer=EmailFactory(person__user__username='reviewer'))

ietf/ietfauth/views.py

@@ -36,7 +36,7 @@
 
 import importlib
 
-from datetime import date as Date, datetime as DateTime
+from datetime import date as Date
 # needed if we revert to higher barrier for account creation
 #from datetime import datetime as DateTime, timedelta as TimeDelta, date as Date
 from collections import defaultdict
@@ -418,16 +418,7 @@ def password_reset(request):
         if form.is_valid():
             username = form.cleaned_data['username']
 
-            data = { 'username': username }
-            if User.objects.filter(username=username).exists():
-                user = User.objects.get(username=username)
-                data['password'] = user.password
-                if user.last_login:
-                    data['last_login'] = user.last_login.timestamp()
-                else:
-                    data['last_login'] = None
-
-            auth = django.core.signing.dumps(data, salt="password_reset")
+            auth = django.core.signing.dumps(username, salt="password_reset")
 
             domain = Site.objects.get_current().domain
             subject = 'Confirm password reset at %s' % domain
@@ -438,7 +429,7 @@ def password_reset(request):
                 'domain': domain,
                 'auth': auth,
                 'username': username,
-                'expire': settings.MINUTES_TO_EXPIRE_RESET_PASSWORD_LINK,
+                'expire': settings.DAYS_TO_EXPIRE_REGISTRATION_LINK,
             })
 
             success = True
@@ -452,16 +443,11 @@ def password_reset(request):
 
 def confirm_password_reset(request, auth):
     try:
-        data = django.core.signing.loads(auth, salt="password_reset", max_age=settings.MINUTES_TO_EXPIRE_RESET_PASSWORD_LINK * 60)
-        username = data['username']
-        password = data['password']
-        last_login = None
-        if data['last_login']:
-            last_login = DateTime.fromtimestamp(data['last_login'])
+        username = django.core.signing.loads(auth, salt="password_reset", max_age=settings.DAYS_TO_EXPIRE_REGISTRATION_LINK * 24 * 60 * 60)
     except django.core.signing.BadSignature:
         raise Http404("Invalid or expired auth")
 
-    user = get_object_or_404(User, username=username, password=password, last_login=last_login)
+    user = get_object_or_404(User, username=username)
 
     success = False
     if request.method == 'POST':

ietf/settings.py

@@ -1007,7 +1007,6 @@ def skip_unreadable_post(record):
 
 # Account settings
 DAYS_TO_EXPIRE_REGISTRATION_LINK = 3
-MINUTES_TO_EXPIRE_RESET_PASSWORD_LINK = 60
 HTPASSWD_COMMAND = "/usr/bin/htpasswd"
 HTPASSWD_FILE = "/www/htpasswd"
 

ietf/submit/management/commands/purge_yang_checks.py

@@ -3,6 +3,7 @@
 from tqdm import tqdm
 
 from django.core.management.base import BaseCommand
+from django.db import migrations
 
 from ietf.submit.models import Submission, SubmissionCheck
 

ietf/templates/registration/password_reset_email.txt

@@ -5,7 +5,7 @@ Hello,
 
    https://{{ domain }}{% url "ietf.ietfauth.views.confirm_password_reset" auth %}
 
-This link will expire in {{ expire }} minutes.
+This link will expire in {{ expire }} days.
 
 If you have not requested a password reset you can ignore this email, your
 credentials have been left untouched.

ietf/utils/management/commands/run_yang_model_checks.py

@@ -11,7 +11,7 @@
 import debug                            # pyflakes:ignore
 
 from ietf.doc.models import Document, State, DocAlias
-from ietf.submit.models import Submission
+from ietf.submit.models import Submission, SubmissionCheck
 from ietf.submit.checkers import DraftYangChecker