(Security bug) PasswordResetConfirm doesn't check token! It allows to change password for anyone

[axens]

https://github.com/Tivix/django-rest-auth/blob/master/rest_auth/serializers.py#L116

Perhaps, you forgot to raise an exception, for example like that:

if self._errors:
            raise serializers.ValidationError(self._errors)

[mateusz-sikora]

I think that is_valid() method of Serializer class will raise an exception if there are any items in self._errors list. I'm almost sure that it was working like that in DRFv2.4, but will check it for DRFv3.0.

Thanks for reporting this!

[mateusz-sikora]

@axens You were right! Patch is already pushed to the repo, will release new version shortly.
Thanks once again for catching this bug!

[axens]

@mateusz-sikora Thank you!