bvandeusenandClaude Opus 5.5
593b583d23
Step #5429 "Reset by email: request, link and new-password page" of milestone 497 "Passwords: change your own, and reset it by email". - Sign-in page: "Forgot your password?" while a mail server is set. - /forgot takes a username or email and answers the same either way; only an active local account with a real address gets mail. Requests count per address on their own throttle, so they never lock out sign-in. - password_resets (migration 0039): a one-time key, stored as its sha256, working for an hour; asking again replaces it. - /reset/<key>: the new password, then signed straight in; every other browser is signed out (sessions_since). Bad keys count as invite keys do. - Email "[Steward] Reset your password", in the account's own zone. - Audited: user.password_reset_requested, user.password_reset_by_email. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
14 lines
411 B
Plaintext
14 lines
411 B
Plaintext
{# A password-reset email's plain-text part; the same facts as password_reset.html. #}
|
|
Someone asked to reset the Steward password for {{ r.username }}.
|
|
|
|
Open the link to choose a new password. Anywhere you're signed in now, you'll
|
|
be signed out.
|
|
|
|
Link works until: {{ r.expires }}
|
|
|
|
Choose a new password: {{ r.link }}
|
|
|
|
--
|
|
The link works once. If you didn't ask for this, ignore it: your password is
|
|
unchanged.
|