Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Refs #28248 -- Clarified the precision of PASSWORD_RESET_TIMEOUT_DAYS. #9141

Merged
merged 1 commit into from Oct 12, 2017
Merged

Refs #28248 -- Clarified the precision of PASSWORD_RESET_TIMEOUT_DAYS. #9141

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
6 changes: 5 additions & 1 deletion django/contrib/auth/tokens.py
View file
Open in desktop
Expand Up @@ -41,7 +41,11 @@ def check_token(self, user, token):
if not constant_time_compare(self._make_token_with_timestamp(user, ts), token):
return False

# Check the timestamp is within limit
# Check the timestamp is within limit. Timestamps are rounded to
# midnight (server time) providing a resolution of only 1 day. If a
# link is generated 5 minutes before midnight and used 6 minutes later,
# that counts as 1 day. Therefore, PASSWORD_RESET_TIMEOUT_DAYS = 1 means
# "at least 1 day, could be up to 2."
if (self._num_days(self._today()) - ts) > settings.PASSWORD_RESET_TIMEOUT_DAYS:
return False

Expand Down
6 changes: 4 additions & 2 deletions docs/ref/settings.txt
View file
Open in desktop
Expand Up @@ -2807,8 +2807,10 @@ the URL in two places (``settings`` and URLconf).

Default: ``3``

The number of days a password reset link is valid for. Used by the
:mod:`django.contrib.auth` password reset mechanism.
The minimum number of days a password reset link is valid for. Depending on
when the link is generated, it will be valid for up to a day longer.

Used by the :class:`~django.contrib.auth.views.PasswordResetConfirmView`.

.. setting:: PASSWORD_HASHERS

Expand Down