Skip to content
This repository has been archived by the owner on Apr 26, 2024. It is now read-only.

Remove POST method from password reset submit_token endpoint #6056

Merged
merged 5 commits into from Sep 19, 2019
Merged
Show file tree
Hide file tree
Changes from 2 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
1 change: 1 addition & 0 deletions changelog.d/6056.bugfix
@@ -0,0 +1 @@
Fix broken call to `validate_threepid_session` during POST requests for password reset.
17 changes: 11 additions & 6 deletions synapse/rest/client/v2_alpha/account.py
Expand Up @@ -282,12 +282,17 @@ def on_POST(self, request, medium):
body = parse_json_object_from_request(request)
assert_params_in_dict(body, ["sid", "client_secret", "token"])

valid, _ = yield self.store.validate_threepid_session(
body["sid"], body["client_secret"], body["token"], self.clock.time_msec()
)
response_code = 200 if valid else 400

return response_code, {"success": valid}
try:
yield self.store.validate_threepid_session(
body["sid"],
body["client_secret"],
body["token"],
self.clock.time_msec(),
)
return 200, {"success": True}
except ThreepidValidationError:
# Validation failure
return 400, {"success": False}


class PasswordRestServlet(RestServlet):
Expand Down