[Django] #35834: PasswordResetForm doesn't forward exceptions when email sending fails

[Django]

#35834: PasswordResetForm doesn't forward exceptions when email sending fails
-------------------------------------+-------------------------------------
Reporter: Olivier LEVILLAIN | Type:
| Uncategorized
Status: new | Component:
| contrib.auth
Version: 5.1 | Severity: Normal
Keywords: | Triage Stage:
| Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 1 | UI/UX: 0
-------------------------------------+-------------------------------------
In PasswordResetForm, the code to send the reset email is:
{{{
try:
email_message.send()
except Exception:
logger.exception(
"Failed to send password reset email to %s",
context["user"].pk
)
}}}
==> if the email sending fails (because for instance of an email password
change), the user who asked for a reset will see it as a success and never
receive his email and the admin will have to look at the logs to
understand what happened
It would be better if the exception was forwarded and an error appears on
the users screen.
--
Ticket URL: <https://code.djangoproject.com/ticket/35834>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.

[Django]

#35834: PasswordResetForm doesn't forward exceptions when email sending fails

-----------------------------------+--------------------------------------
Reporter: Olivier LEVILLAIN | Owner: (none)
Type: Bug | Status: closed
Component: contrib.auth | Version: 5.1
Severity: Normal | Resolution: wontfix

Keywords: | Triage Stage: Unreviewed
Has patch: 0 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 1 | UI/UX: 0

-----------------------------------+--------------------------------------
Changes (by Tim Graham):

* resolution: => wontfix
* status: new => closed
* type: Uncategorized => Bug

Comment:

When submitting an issue like this, you should check why the code was
added. In this case, your proposal is to revert a security patch:

In 8c35a0a903fd979e3262fe300ca084ffbfb300d6:

> Fixed CVE-2024-45231 -- Avoided server error on password reset when
email sending fails.
>
> On successful submission of a password reset request, an email is sent
to the accounts known to the system. If sending this email fails (due to
email backend misconfiguration, service provider outage, network issues,
etc.), an attacker might exploit this by detecting which password
resetrequests succeed and which ones generate a 500 error response.
--
Ticket URL: <https://code.djangoproject.com/ticket/35834#comment:1>