Repository: nextcloud/appstore

Issue:
Password reset sends outdated reset token
When requesting a password reset link from apps.nextcloud.com, the token in the link of the reset e-mail does not work, the website reports:

>  Bad API Token
> 
> The password reset link was invalid, possibly because it has already been used. Please request a new password reset.

When requesting a new password reset, an e-mail with the very same token is sent. In consequence it is impossible to change the password.

## Details

* Firefox 72.0.2

## Steps to reproduce

1. "Forget" your password
2. Request password reset link
3. Receive e-mail and open reset link
4. Observe error, follow suggestion and request new link
5. Receive e-mail with exactly the same token



Discussion:
We can confirm your report, same here. No way to log in again once you've forgot your password....

![Bildschirmfoto von 2020-02-20 15-29-38](https://user-images.githubusercontent.com/13522599/74944151-dabaf580-53f5-11ea-9286-e8368fef3cee.png)

@mario can you check if your customization needs to be updated https://github.com/nextcloud/appstore/pull/618 ?

@BernhardPosselt sure.
Just a little bump that this is still a problem.
https://github.com/nextcloud/appstore/blob/e72e1655619b55b848bf5056d63267921ebb27ce/nextcloudappstore/user/forms.py#L100-L102

I don't know django but it seems to me that the generated token is used to generate the password reset url but never saved. 
@kesselb that lines are commented out upstream and weren't changed in the past 10 years. While possible, I'd be surprised if everyone using the lib doesn't have functioning password resets for 10 years :) 

I will take a look though, who knows ... thanks for pointing at it.

Resolving patch:
diff --git a/nextcloudappstore/user/forms.py b/nextcloudappstore/user/forms.py
--- a/nextcloudappstore/user/forms.py
+++ b/nextcloudappstore/user/forms.py
@@ -1,3 +1,4 @@
+from allauth.account.forms import EmailAwarePasswordResetTokenGenerator
 from allauth.account.utils import filter_users_by_email, user_username, \
     user_pk_to_url_str
 from django import forms
@@ -82,7 +83,7 @@ def clean_email(self):
         email = self.cleaned_data["email"]
         from allauth.account.adapter import get_adapter
         email = get_adapter().clean_email(email)
-        self.users = filter_users_by_email(email)
+        self.users = filter_users_by_email(email, is_active=True)
 
         return self.cleaned_data["email"]
 
@@ -90,9 +91,7 @@ def save(self, request, **kwargs):
         from django.contrib.sites.shortcuts import get_current_site
         current_site = get_current_site(request)
         email = self.cleaned_data["email"]
-        from django.contrib.auth.tokens import default_token_generator
-        token_generator = kwargs.get("token_generator",
-                                     default_token_generator)
+        token_generator = EmailAwarePasswordResetTokenGenerator()
 
         for user in self.users:
             temp_key = token_generator.make_token(user)
@@ -118,7 +117,7 @@ def save(self, request, **kwargs):
             from allauth.account import app_settings
 
             if app_settings.AUTHENTICATION_METHOD \
-                    != app_settings.AuthenticationMethod.EMAIL:
+                != app_settings.AuthenticationMethod.EMAIL:
                 context['username'] = user_username(user)
             from allauth.account.adapter import get_adapter
             get_adapter(request).send_mail(


Test patch: