#28248: Password resets are allowed for 1 day longer than
PASSWORD_RESET_TIMEOUT_DAYS
---------------------------------+------------------------------------
Reporter: Nick Zaccardi | Owner: nobody
Type: Bug | Status: closed
Component: contrib.auth | Version: 2.0
Severity: Release blocker | Resolution: invalid
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
---------------------------------+------------------------------------
Comment (by Nick Zaccardi):
Sorry to be a moment late to respond. I think the reversion is the correct
action for the 99+% and I support that direction. In fact, the fix I
originally supplied does have the rounding bug. My apologies for that, I
misunderstood the way the rounding work.
I do want to explain why this doesn't meet the 1% of use cases. When I
originally reported this I was working on a password reset feature in a
different app (a large corporate financial application) which has very
specific policies on passwords, password resets, and the validity time of
both. From a contractual perspective (regardless of user experience) >24hr
link would be a break in policy or worse a violation of contractual
obligation to implement a <24hr link. For most up to 2 days is fine, for
some, regardless of the real-life implications of the policy, it is a big
deal.
All that to say, why does this get rounded in the first place? why not
just use:
{{{
validity_time = now() + {{ reset_timedelta }}
if validity_time < now():
// is expired
}}}
Thanks for all you folks do!
--
Ticket URL: <https://code.djangoproject.com/ticket/28248#comment:10>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/062.74121946e40c893c7e344ec6b247b6a8%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
