

@tornado.gen.coroutine
def post(self):
    name = self.get_argument('name', '')
    name = unicodedata.normalize('NFKC', name)
    name = tornado.escape.squeeze(name.strip())
    formerror = None
    if (self.twsessionstatus == 'auth'):
        formerror = 'You are already signed in!'
    elif (not name):
        formerror = 'You must enter your player name or email address.'
    if formerror:
        self.render('recover.html', formerror=formerror, init_name=name)
        return
    try:
        res = (yield self.application.twsessionmgr.find_player_nopw(self, name))
    except MessageException as ex:
        formerror = str(ex)
        self.render('recover.html', formerror=formerror, init_name=name)
        return
    try:
        if (not res):
            raise MessageException('There is no such player.')
        if res.get('guest', None):
            raise MessageException('The guest account password cannot be changed.')
        uid = res['_id']
        email = res['email']
        rec = (yield motor.Op(self.application.mongodb.pwrecover.find_one, {
            '_id': uid,
        }))
        if rec:
            raise MessageException('A recovery email has already been sent for this account. Please wait for it to arrive. If the message has been lost, you may try again in 24 hours.')
        while True:
            key = self.application.twsessionmgr.random_bytes(16).decode()
            rec = (yield motor.Op(self.application.mongodb.pwrecover.find_one, {
                'key': key,
            }))
            if (not rec):
                break
        rec = {
            '_id': uid,
            'key': key,
            'createtime': twcommon.misc.now(),
        }
        (yield motor.Op(self.application.mongodb.pwrecover.insert, rec))
        self.application.twlog.warning('Player lost password: %s', email)
        message = self.render_string('mail_recover.txt', hostname=self.application.twopts.hostname, key=key)
        mailer = tweblib.mailer.Mailer(self.application)
        (yield mailer.send(key, 'Password change request', message))
    except MessageException as ex:
        formerror = str(ex)
        self.render('recover.html', formerror=formerror, init_name=name)
        return
    self.render('recover.html', mailsent=True)

dataset/ETHPy150Open erkyrath/tworld/lib/tweblib/handlers.py RecoverHandler.post/VarMisuse@423/644 `email`->`key`