From e11fc792e0fff1b03b722305b570dcf8f46e5f8c Mon Sep 17 00:00:00 2001 From: mkovalua Date: Wed, 15 Jul 2026 18:33:25 +0300 Subject: [PATCH 1/2] Add password length restriction to UserResetPasswordSerializer with 255 chars --- api/users/serializers.py | 2 +- .../test_user_settings_reset_password.py | 22 +++++++++++++++++++ 2 files changed, 23 insertions(+), 1 deletion(-) diff --git a/api/users/serializers.py b/api/users/serializers.py index 608f93c98c0..05f7c27bc77 100644 --- a/api/users/serializers.py +++ b/api/users/serializers.py @@ -455,7 +455,7 @@ class Meta: class UserResetPasswordSerializer(BaseAPISerializer): uid = ser.CharField(write_only=True, required=True) token = ser.CharField(write_only=True, required=True) - password = ser.CharField(write_only=True, required=True) + password = ser.CharField(write_only=True, required=True, max_length=255) class Meta: type_ = 'user_reset_password' diff --git a/api_tests/users/views/test_user_settings_reset_password.py b/api_tests/users/views/test_user_settings_reset_password.py index 51c2db80038..dd301e7c5ea 100644 --- a/api_tests/users/views/test_user_settings_reset_password.py +++ b/api_tests/users/views/test_user_settings_reset_password.py @@ -129,6 +129,28 @@ def test_post_invalid_password(self, app, url, user_one, csrf_token): res = app.post_json_api(url, payload, expect_errors=True, headers={'X-THROTTLE-TOKEN': 'test-token', 'X-CSRFToken': csrf_token}) assert res.status_code == 400 + def test_post_password_too_long(self, app, url, user_one, csrf_token): + app.set_cookie(CSRF_COOKIE_NAME, csrf_token) + encoded_email = urllib.parse.quote(user_one.email) + url = f'{url}?email={encoded_email}' + from tests.utils import capture_notifications + + with capture_notifications(): + res = app.get(url) + user_one.reload() + payload = { + 'data': { + 'attributes': { + 'uid': user_one._id, + 'token': user_one.verification_key_v2['token'], + 'password': 'a' * 256, + } + } + } + + res = app.post_json_api(url, payload, expect_errors=True, headers={'X-THROTTLE-TOKEN': 'test-token', 'X-CSRFToken': csrf_token}) + assert res.status_code == 400 and res.json['errors'][0]['detail'] == 'Ensure this field has no more than 256 characters.' + def test_throttle(self, app, url, throttle_user, csrf_token): app.set_cookie(CSRF_COOKIE_NAME, csrf_token) encoded_email = urllib.parse.quote(throttle_user.email) From 08f170a3814c8ce43d5010254f4ea9cd44a6a1b9 Mon Sep 17 00:00:00 2001 From: mkovalua Date: Wed, 15 Jul 2026 18:45:05 +0300 Subject: [PATCH 2/2] Update test_user_settings_reset_password.py --- api_tests/users/views/test_user_settings_reset_password.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/api_tests/users/views/test_user_settings_reset_password.py b/api_tests/users/views/test_user_settings_reset_password.py index dd301e7c5ea..6e40c5ea9de 100644 --- a/api_tests/users/views/test_user_settings_reset_password.py +++ b/api_tests/users/views/test_user_settings_reset_password.py @@ -149,7 +149,7 @@ def test_post_password_too_long(self, app, url, user_one, csrf_token): } res = app.post_json_api(url, payload, expect_errors=True, headers={'X-THROTTLE-TOKEN': 'test-token', 'X-CSRFToken': csrf_token}) - assert res.status_code == 400 and res.json['errors'][0]['detail'] == 'Ensure this field has no more than 256 characters.' + assert res.status_code == 400 and res.json['errors'][0]['detail'] == 'Ensure this field has no more than 255 characters.' def test_throttle(self, app, url, throttle_user, csrf_token): app.set_cookie(CSRF_COOKIE_NAME, csrf_token)