的POST部分要重置密码,用户应该去链接包含令牌:验证令牌GET和Django的观点
example.com/password-change/?token=8125b6da86694a19b5d76f30a04c9db8
鉴于我有下面的代码:
def _get_and_check_password_recovery_token(request, token_hex):
try:
token = tokens.get_token(token_hex)
except Token.DoesNotExist:
raise Http404
if token.is_expired():
token.delete()
messages.warning(request,
'Link you use for password recovery became obsolete. Please, request another one.')
return redirect(reverse('password_recovery') + '?email=%s' % token.user.email)
return token
def password_change(request):
if request.method == 'POST':
form = forms.PasswordChangeForm(request.POST)
if form.is_valid():
token_hex = form.cleaned_data.get('token')
new_password = form.cleaned_data['new_password']
if token_hex:
token_or_response = _get_and_check_password_recovery_token(request, token_hex)
if isinstance(token_or_response, Token):
user = token_or_response.user
else:
return token_or_response
else:
...
...
else:
token_hex = request.GET.get('token')
if token_hex:
token_or_response = _get_and_check_password_recovery_token(request, token_hex)
if isinstance(token_or_response, Token):
token_hex = token_or_response.hex
else:
return token_or_response
form = forms.PasswordChangeForm(initial={'token': token_hex})
else:
form = forms.PasswordChangeForm() # TODO Authenticated user changes his password.
return render_template(request, 'accounts/password_change.html', {'password_change_form': form})
正如你所看到的,令牌之前必须更改密码的形式来检查将被渲染,它会被我们提交后呃。所以我打电话给方法_get_and_check_password_recovery_token(request, token_hex)
2次。它返回响应对象(是未找到或不正确的令牌)或令牌。我对此感到不舒服 - 这是完全不同的对象。
你们看到更好的方式来写这段代码吗? Python中返回逻辑上不同的对象吗?
这更适合于http://codereview.stackexchange.com/。 – orlp 2012-07-17 09:07:06
谢谢,@nightcracker,我不知道这个资源。将来会发布类似的问题。 – Marboni 2012-07-17 09:10:42