geonition/django_auth — Issue #15: Requesting a new password is faulty
Author: ksnabb
Created: 2011-12-16 06:37:49+00:00
State: open

The password cannot be changed for a user with password only because someone can give an email in the user interface. This process has to be made better and more secure.

E.g. an email can be sent to the user where he can follow a link to a page where he then can change the password.