python - Flask-登录重置 MongoDB 密码 - 查询不起作用

Question

我正在尝试在 Flask 中使用电子邮件链接实现重置密码。 这是我在views.py中的代码:

@app.route("/reset_password/<token>", methods=['GET', 'POST'])
def reset_token(token):
    if current_user.is_authenticated:
        return redirect(url_for('homepage'))
    user = User.verify_reset_token(token)
    if user is None:
        flash('That is an invalid or expired token', 'warning')
        return redirect(url_for('reset_request'))
    form = ResetPasswordForm()
    if form.validate_on_submit():
       hashed_password = generate_password_hash(form.password.data, method='sha256') 
 User.objects(email=token.email).update_one(set__username=hashed_password)

        flash('Your password has been updated! You are now able to log in', 'success')
        return redirect(url_for('login'))
    return render_template('reset_token.html', title='Reset Password', form=form)

这是我在 models.py 中的代码

class User(UserMixin, db.Document):
meta = {'collection': 'users'}
email = db.StringField(max_length=35)
name = db.StringField(max_length=35)
surname = db.StringField(max_length=35)
password = db.StringField()
username = db.StringField()
image_file = db.StringField(nullable=False, default='static/img/default.jpg')

skills = db.ListField(db.StringField())

def get_reset_token(self, expires_sec=1800):
    s = Serializer(app.config['SECRET_KEY'], expires_sec)
    return s.dumps({'email': self.email}).decode('utf-8')

@staticmethod
def verify_reset_token(token):
    s = Serializer(app.config['SECRET_KEY'])
    try:
        email = s.loads(token)['email']
    except:
        return None
    return User.objects(email='email')

def __repr__(self):
    return f"User('{self.email}', '{self.image_file}')"

这是我在 forms.py 中的代码

    class RequestResetForm(FlaskForm):
    email = StringField('Email', validators=[validators.DataRequired()])
    submit = SubmitField('Request Password Reset')

    def validate_email(self, email):
        user = User.objects(email=email.data).first()
        if user is None:
            raise ValidationError('There is no account with that email. You must register first.')


class ResetPasswordForm(FlaskForm):
    password = PasswordField('New Password', validators=[validators.DataRequired()])
    confirm_password = PasswordField('Confirm Password', validators=[validators.DataRequired(), validators.EqualTo('password')])
    submit = SubmitField('Reset Password')

当我尝试插入新密码时(之后带有 token 的链接被发送到我的电子邮件)，它没有保存，我可以使用旧密码访问个人资料。 我用的是蒙戈引擎。 有人能帮助我吗？ 谢谢。

Answer 1

您已经在此处使用 token 的验证方法定义了您的用户模型

user = User.verify_reset_token(token)

所以你必须通过这种方式“提取”用户的电子邮件

User.objects(email=user.email).update_one(set__username=hashed_password)