From 8f3f2d0f98bf246f1a61ff1e4856b1bb3ec3c073 Mon Sep 17 00:00:00 2001 From: Valentin CZERYBA Date: Sat, 15 Feb 2025 12:07:58 +0100 Subject: [PATCH] fix password update --- app/routers/password.py | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/app/routers/password.py b/app/routers/password.py index fc94059..e019496 100644 --- a/app/routers/password.py +++ b/app/routers/password.py @@ -95,12 +95,25 @@ async def reset_password(request: Request, key: str | None = None, email: str | @router.post("/password/update", tags=["password"]) async def update_password(request: Request, email: str = Form(...), key: str = Form(...), new_password: str = Form(...)): # Vérification du token dans Redis + # Récupérer la clé hachée depuis Redis key_hashed = database.connect_redis.get(email) - if key_hashed is None or key_hashed.decode() != key: + if key_hashed is None: raise HTTPException( status_code=status.HTTP_400_BAD_REQUEST, - detail="Key is invalid or expired" + detail="Invalid or expired reset key" + ) + + # Redis stocke les valeurs en `bytes`, donc il faut décoder si nécessaire + if isinstance(key_hashed, bytes): + key_hashed = key_hashed.decode() + + + # Vérifier que la clé en clair correspond au hash stocké + if not bcrypt.checkpw(key.encode(), key_hashed.encode()): + raise HTTPException( + status_code=status.HTTP_400_BAD_REQUEST, + detail="Invalid reset key" ) # Recherche de l'utilisateur dans la base de données -- 2.47.2