From 92d9a2a0d5c1d4bfbf70e3386e0a91465f7b5038 Mon Sep 17 00:00:00 2001
From: patrick-motsch
Date: Tue, 3 Mar 2026 23:07:41 +0100
Subject: [PATCH] 2 critical fixes: pwd reset and invitation caching ui
---
modules/interfaces/interfaceDbApp.py | 4 ----
modules/routes/routeSecurityLocal.py | 4 ++--
2 files changed, 2 insertions(+), 6 deletions(-)
diff --git a/modules/interfaces/interfaceDbApp.py b/modules/interfaces/interfaceDbApp.py
index 4de62bd0..c7e4f8bf 100644
--- a/modules/interfaces/interfaceDbApp.py
+++ b/modules/interfaces/interfaceDbApp.py
@@ -662,10 +662,6 @@ class AppObjects:
if authAuthority != AuthAuthority.LOCAL and authAuthority != AuthAuthority.LOCAL.value:
raise ValueError("User does not have local authentication enabled")
- # Check if user has a reset token set (password reset required)
- if userRecord.get("resetToken"):
- raise ValueError("Passwort-Zurücksetzung erforderlich. Bitte prüfen Sie Ihre E-Mail.")
-
if not userRecord.get("hashedPassword"):
raise ValueError("User has no password set")
diff --git a/modules/routes/routeSecurityLocal.py b/modules/routes/routeSecurityLocal.py
index b846af63..c83d0d3f 100644
--- a/modules/routes/routeSecurityLocal.py
+++ b/modules/routes/routeSecurityLocal.py
@@ -602,8 +602,8 @@ def password_reset_request(
# Generate reset token
token, expires = rootInterface.generateResetTokenAndExpiry()
- # Set reset token (clears password)
- rootInterface.setResetToken(user.id, token, expires)
+ # Set reset token but keep existing password valid until new one is set
+ rootInterface.setResetToken(user.id, token, expires, clearPassword=False)
# Generate magic link using provided frontend URL
magicLink = f"{baseUrl}/reset?token={token}"