Fixing wrong reset password procedure

jm2l/auth.py

@@ -6,6 +6,9 @@ from .models import User, DBSession
 from mako.template import Template
 from pyramid_mailer import get_mailer
 from pyramid_mailer.message import Attachment, Message
+from .forms import UserPasswordForm
+from passlib.hash import argon2
+from security import check_logged
 import datetime
 import re
 
@@ -52,13 +55,18 @@ def forgot(request):
 @view_config(route_name='bymail', renderer="string")    
 def bymail(request):
     myhash = request.matchdict.get('hash', "")
+    reset = request.GET.get('reset', False)
     user = User.by_hash(myhash)
     if user:
         user.last_logged=datetime.datetime.now()
         DBSession.merge(user)
         headers = remember(request, user.uid)
-        return HTTPFound(location=request.route_url('jm2l'),
-                            headers=headers)
+        if reset:
+            return HTTPFound(location=request.route_url('auth', action='reset'),
+                                headers=headers)
+        else:
+            return HTTPFound(location=request.route_url('jm2l'),
+                                headers=headers)
     else:
         headers = forget(request)
     return HTTPFound(location=request.route_url('auth', action='login'),
@@ -92,3 +100,14 @@ def sign_in_out(request):
                      headers=headers)
 
 
+@view_config(route_name='auth', match_param="action=reset", renderer="jm2l:templates/reset_password.mako")
+def reset_password(request):
+    check_logged(request)
+    form = UserPasswordForm(request.POST, request.user, meta={'csrf_context': request.session})
+    if request.method == 'POST' and form.validate():
+        request.user.password = argon2.using(rounds=4).hash(form.password.data)
+        DBSession.merge(request.user)
+        headers = remember(request, request.user.uid)
+        return HTTPFound(location=request.route_url('jm2l'),
+                         headers=headers)
+    return { 'password_form': form }