@csrf_exempt
@require_POST
def password_reset(request):
 limiter = BadRequestRateLimiter()
 if limiter.is_rate_limit_exceeded(request):
  AUDIT_LOG.warning('Rate limit exceeded in password_reset')
  return HttpResponseForbidden()
 form = PasswordResetFormNoActive(request.POST)
 if form.is_valid():
  form.save(use_https=request.is_secure(), from_email=configuration_helpers.get_value('email_from_address', settings.DEFAULT_FROM_EMAIL), request=request, domain_override=request.get_host())
  tracker.emit(SETTING_CHANGE_INITIATED, {'setting': 'password', 'old': None, 'new': None, 'user_id': request.user.id})
  destroy_oauth_tokens(request.user)
 else:
  AUDIT_LOG.info('Bad password_reset user passed in.')
  limiter.tick_bad_request_counter(request)
 return JsonResponse({'success': True, 'value': render_to_string('registration/password_reset_done.html', {})})

@ csrf_exempt @ require_POST def password_reset ( request ) : limiter = BadRequestRateLimiter ( ) if limiter . is_rate_limit_exceeded ( request ) : AUDIT_LOG . warning ( 'Rate limit exceeded in password_reset' ) return HttpResponseForbidden ( ) form = PasswordResetFormNoActive ( request . POST ) if form . is_valid ( ) : form . save ( use_https = request . is_secure ( ) , from_email = configuration_helpers . get_value ( 'email_from_address' , settings . DEFAULT_FROM_EMAIL ) , request = request , domain_override = request . get_host ( ) ) tracker . emit ( SETTING_CHANGE_INITIATED , { 'setting' : 'password' , 'old' : None , 'new' : None , 'user_id' : request . user . id } ) destroy_oauth_tokens ( request . user ) else : AUDIT_LOG . info ( 'Bad password_reset user passed in.' ) limiter . tick_bad_request_counter ( request ) return JsonResponse ( { 'success' : True , 'value' : render_to_string ( 'registration/password_reset_done.html' , { } ) } )
password_reset sends the email with the new password .