Password reset not public by default

[logut]

Urls for login and logout are public if django.contrib.auth is installed but not password_reset, password_reset_done, password_reset_confirm nor password_reset_complete.
Could you add theses ? I can make a PR later if you prefer.

[mgrouchy]

Total oversight, I will add them!

[mgrouchy]

Bah, I have been slow. I am adding this to my todo list right now to resolve. Really sorry about this!

[pvandegeer]

Adding them to settings manually like below doesn't help. Am I missing something?

STRONGHOLD_PUBLIC_NAMED_URLS = ( 'password_reset', 'password_reset_done', 'password_reset_confirm', 'password_reset_complete', )
The views for password_reset and password_reset_done work. I think the view behind the password_reset_confirm url also initially works when following the link in the password reset e-mail.
But the Django PasswordResetConfirmView then redirects to itself with a different token and that seems to get blocked, returning me to my LOGIN_URL.

It works as it should with the stronghold middelware disabled. Using Django 2.0 and Stronghold 0.3.0.

[logut]

@pvandegeer add them not by name but by pattern, related to #33 I think.

[tchamberlin]

I just ran into this. For anyone else, it is indeed pretty straightforward to work around.

I set up the following public URLs:

STRONGHOLD_PUBLIC_NAMED_URLS = (
    "password_reset",
    "password_reset_done",
    "password_reset_confirm",
    "password_reset_complete",
)

password_reset_confirm cannot be reversed (since no parameters are given), and fails silently. So, you need to add:

STRONGHOLD_PUBLIC_URLS = ("^/accounts/reset/.*",)

To work around it.

[zafercuz]

For people who are using django-allauth add this to the configs:

STRONGHOLD_PUBLIC_URLS = ("/accounts/password/reset/key/.*", "/accounts/confirm-email/.*",)
STRONGHOLD_PUBLIC_NAMED_URLS = (
    'account_signup',
    'account_login',
    'account_reset_password',
    'account_reset_password_done',
    'account_reset_password_from_key',
    'account_reset_password_from_key_done',
    'account_email_verification_sent',
    'account_confirm_email'
)