{"action":"created","comment":{"url":"https://api.github.com/repos/django/django/pulls/comments/92150304","pull_request_review_id":12658539,"id":92150304,"diff_hunk":"@@ -0,0 +1,47 @@\n+import re\n+\n+from django.contrib.auth.views import INTERNAL_RESET_TOKEN\n+from django.test import Client\n+\n+\n+def extract_token_from_url(url):\n+    token_search = re.search(r'/reset/.*/(.+?)/', url)\n+    if token_search:\n+        return token_search.group(1)\n+\n+\n+class PasswordResetConfirmClient(Client):","path":"tests/auth_tests/client.py","position":15,"original_position":13,"commit_id":"40fb51143274ea5c497eb70b6573ad74b955b037","original_commit_id":"17ccd11acb49caaa4070717fb95bd57f567387e8","user":{"login":"apollo13","id":81547,"avatar_url":"https://avatars.githubusercontent.com/u/81547?v=3","gravatar_id":"","url":"https://api.github.com/users/apollo13","html_url":"https://github.com/apollo13","followers_url":"https://api.github.com/users/apollo13/followers","following_url":"https://api.github.com/users/apollo13/following{/other_user}","gists_url":"https://api.github.com/users/apollo13/gists{/gist_id}","starred_url":"https://api.github.com/users/apollo13/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/apollo13/subscriptions","organizations_url":"https://api.github.com/users/apollo13/orgs","repos_url":"https://api.github.com/users/apollo13/repos","events_url":"https://api.github.com/users/apollo13/events{/privacy}","received_events_url":"https://api.github.com/users/apollo13/received_events","type":"User","site_admin":false},"body":"Ok, but please ensure that there is at least one test testing if the redirect works properly too.","created_at":"2016-12-13T11:32:33Z","updated_at":"2016-12-13T11:32:33Z","html_url":"https://github.com/django/django/pull/7623#discussion_r92150304","pull_request_url":"https://api.github.com/repos/django/django/pulls/7623","_links":{"self":{"href":"https://api.github.com/repos/django/django/pulls/comments/92150304"},"html":{"href":"https://github.com/django/django/pull/7623#discussion_r92150304"},"pull_request":{"href":"https://api.github.com/repos/django/django/pulls/7623"}}},"pull_request":{"url":"https://api.github.com/repos/django/django/pulls/7623","id":95410873,"html_url":"https://github.com/django/django/pull/7623","diff_url":"https://github.com/django/django/pull/7623.diff","patch_url":"https://github.com/django/django/pull/7623.patch","issue_url":"https://api.github.com/repos/django/django/issues/7623","number":7623,"state":"open","locked":false,"title":"Fixed #27518 -- Avoid password reset link leak on password reset confirm page","user":{"login":"romgar","id":2834704,"avatar_url":"https://avatars.githubusercontent.com/u/2834704?v=3","gravatar_id":"","url":"https://api.github.com/users/romgar","html_url":"https://github.com/romgar","followers_url":"https://api.github.com/users/romgar/followers","following_url":"https://api.github.com/users/romgar/following{/other_user}","gists_url":"https://api.github.com/users/romgar/gists{/gist_id}","starred_url":"https://api.github.com/users/romgar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/romgar/subscriptions","organizations_url":"https://api.github.com/users/romgar/orgs","repos_url":"https://api.github.com/users/romgar/repos","events_url":"https://api.github.com/users/romgar/events{/privacy}","received_events_url":"https://api.github.com/users/romgar/received_events","type":"User","site_admin":false},"body":"On password reset confirm page, if the user has included some links to external sources, the HTTP header `Referer` sent to these sources will contain the full password reset URL.\r\nThat can allow external systems to reset password in behalf of the concerned user, if he doesn't\r\nreset his password immediately after landing on password reset confirm page.\r\nTo avoid that, the user is redirected to the same page, but we remove the token and save it in the\r\nuser session instead.\r\nThe issue and the solution are detailed in [related ticket](https://code.djangoproject.com/ticket/27518).","created_at":"2016-11-27T18:12:56Z","updated_at":"2016-12-13T11:32:33Z","closed_at":null,"merged_at":null,"merge_commit_sha":"437a54721c61279924e8bcdc42b6f02f91f61e74","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/django/django/pulls/7623/commits","review_comments_url":"https://api.github.com/repos/django/django/pulls/7623/comments","review_comment_url":"https://api.github.com/repos/django/django/pulls/comments{/number}","comments_url":"https://api.github.com/repos/django/django/issues/7623/comments","statuses_url":"https://api.github.com/repos/django/django/statuses/40fb51143274ea5c497eb70b6573ad74b955b037","head":{"label":"romgar:ticket_27518","ref":"ticket_27518","sha":"40fb51143274ea5c497eb70b6573ad74b955b037","user":{"login":"romgar","id":2834704,"avatar_url":"https://avatars.githubusercontent.com/u/2834704?v=3","gravatar_id":"","url":"https://api.github.com/users/romgar","html_url":"https://github.com/romgar","followers_url":"https://api.github.com/users/romgar/followers","following_url":"https://api.github.com/users/romgar/following{/other_user}","gists_url":"https://api.github.com/users/romgar/gists{/gist_id}","starred_url":"https://api.github.com/users/romgar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/romgar/subscriptions","organizations_url":"https://api.github.com/users/romgar/orgs","repos_url":"https://api.github.com/users/romgar/repos","events_url":"https://api.github.com/users/romgar/events{/privacy}","received_events_url":"https://api.github.com/users/romgar/received_events","type":"User","site_admin":false},"repo":{"id":45731483,"name":"django","full_name":"romgar/django","owner":{"login":"romgar","id":2834704,"avatar_url":"https://avatars.githubusercontent.com/u/2834704?v=3","gravatar_id":"","url":"https://api.github.com/users/romgar","html_url":"https://github.com/romgar","followers_url":"https://api.github.com/users/romgar/followers","following_url":"https://api.github.com/users/romgar/following{/other_user}","gists_url":"https://api.github.com/users/romgar/gists{/gist_id}","starred_url":"https://api.github.com/users/romgar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/romgar/subscriptions","organizations_url":"https://api.github.com/users/romgar/orgs","repos_url":"https://api.github.com/users/romgar/repos","events_url":"https://api.github.com/users/romgar/events{/privacy}","received_events_url":"https://api.github.com/users/romgar/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/romgar/django","description":"The Web framework for perfectionists with deadlines.","fork":true,"url":"https://api.github.com/repos/romgar/django","forks_url":"https://api.github.com/repos/romgar/django/forks","keys_url":"https://api.github.com/repos/romgar/django/keys{/key_id}","collaborators_url":"https://api.github.com/repos/romgar/django/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/romgar/django/teams","hooks_url":"https://api.github.com/repos/romgar/django/hooks","issue_events_url":"https://api.github.com/repos/romgar/django/issues/events{/number}","events_url":"https://api.github.com/repos/romgar/django/events","assignees_url":"https://api.github.com/repos/romgar/django/assignees{/user}","branches_url":"https://api.github.com/repos/romgar/django/branches{/branch}","tags_url":"https://api.github.com/repos/romgar/django/tags","blobs_url":"https://api.github.com/repos/romgar/django/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/romgar/django/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/romgar/django/git/refs{/sha}","trees_url":"https://api.github.com/repos/romgar/django/git/trees{/sha}","statuses_url":"https://api.github.com/repos/romgar/django/statuses/{sha}","languages_url":"https://api.github.com/repos/romgar/django/languages","stargazers_url":"https://api.github.com/repos/romgar/django/stargazers","contributors_url":"https://api.github.com/repos/romgar/django/contributors","subscribers_url":"https://api.github.com/repos/romgar/django/subscribers","subscription_url":"https://api.github.com/repos/romgar/django/subscription","commits_url":"https://api.github.com/repos/romgar/django/commits{/sha}","git_commits_url":"https://api.github.com/repos/romgar/django/git/commits{/sha}","comments_url":"https://api.github.com/repos/romgar/django/comments{/number}","issue_comment_url":"https://api.github.com/repos/romgar/django/issues/comments{/number}","contents_url":"https://api.github.com/repos/romgar/django/contents/{+path}","compare_url":"https://api.github.com/repos/romgar/django/compare/{base}...{head}","merges_url":"https://api.github.com/repos/romgar/django/merges","archive_url":"https://api.github.com/repos/romgar/django/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/romgar/django/downloads","issues_url":"https://api.github.com/repos/romgar/django/issues{/number}","pulls_url":"https://api.github.com/repos/romgar/django/pulls{/number}","milestones_url":"https://api.github.com/repos/romgar/django/milestones{/number}","notifications_url":"https://api.github.com/repos/romgar/django/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/romgar/django/labels{/name}","releases_url":"https://api.github.com/repos/romgar/django/releases{/id}","deployments_url":"https://api.github.com/repos/romgar/django/deployments","created_at":"2015-11-07T10:10:32Z","updated_at":"2016-02-11T16:56:46Z","pushed_at":"2016-12-13T10:30:47Z","git_url":"git://github.com/romgar/django.git","ssh_url":"git@github.com:romgar/django.git","clone_url":"https://github.com/romgar/django.git","svn_url":"https://github.com/romgar/django","homepage":"https://www.djangoproject.com/","size":151105,"stargazers_count":0,"watchers_count":0,"language":"Python","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"django:master","ref":"master","sha":"6252fd6314f66d2d303cc47c791ffefd27169b42","user":{"login":"django","id":27804,"avatar_url":"https://avatars.githubusercontent.com/u/27804?v=3","gravatar_id":"","url":"https://api.github.com/users/django","html_url":"https://github.com/django","followers_url":"https://api.github.com/users/django/followers","following_url":"https://api.github.com/users/django/following{/other_user}","gists_url":"https://api.github.com/users/django/gists{/gist_id}","starred_url":"https://api.github.com/users/django/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/django/subscriptions","organizations_url":"https://api.github.com/users/django/orgs","repos_url":"https://api.github.com/users/django/repos","events_url":"https://api.github.com/users/django/events{/privacy}","received_events_url":"https://api.github.com/users/django/received_events","type":"Organization","site_admin":false},"repo":{"id":4164482,"name":"django","full_name":"django/django","owner":{"login":"django","id":27804,"avatar_url":"https://avatars.githubusercontent.com/u/27804?v=3","gravatar_id":"","url":"https://api.github.com/users/django","html_url":"https://github.com/django","followers_url":"https://api.github.com/users/django/followers","following_url":"https://api.github.com/users/django/following{/other_user}","gists_url":"https://api.github.com/users/django/gists{/gist_id}","starred_url":"https://api.github.com/users/django/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/django/subscriptions","organizations_url":"https://api.github.com/users/django/orgs","repos_url":"https://api.github.com/users/django/repos","events_url":"https://api.github.com/users/django/events{/privacy}","received_events_url":"https://api.github.com/users/django/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/django/django","description":"The Web framework for perfectionists with deadlines.","fork":false,"url":"https://api.github.com/repos/django/django","forks_url":"https://api.github.com/repos/django/django/forks","keys_url":"https://api.github.com/repos/django/django/keys{/key_id}","collaborators_url":"https://api.github.com/repos/django/django/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/django/django/teams","hooks_url":"https://api.github.com/repos/django/django/hooks","issue_events_url":"https://api.github.com/repos/django/django/issues/events{/number}","events_url":"https://api.github.com/repos/django/django/events","assignees_url":"https://api.github.com/repos/django/django/assignees{/user}","branches_url":"https://api.github.com/repos/django/django/branches{/branch}","tags_url":"https://api.github.com/repos/django/django/tags","blobs_url":"https://api.github.com/repos/django/django/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/django/django/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/django/django/git/refs{/sha}","trees_url":"https://api.github.com/repos/django/django/git/trees{/sha}","statuses_url":"https://api.github.com/repos/django/django/statuses/{sha}","languages_url":"https://api.github.com/repos/django/django/languages","stargazers_url":"https://api.github.com/repos/django/django/stargazers","contributors_url":"https://api.github.com/repos/django/django/contributors","subscribers_url":"https://api.github.com/repos/django/django/subscribers","subscription_url":"https://api.github.com/repos/django/django/subscription","commits_url":"https://api.github.com/repos/django/django/commits{/sha}","git_commits_url":"https://api.github.com/repos/django/django/git/commits{/sha}","comments_url":"https://api.github.com/repos/django/django/comments{/number}","issue_comment_url":"https://api.github.com/repos/django/django/issues/comments{/number}","contents_url":"https://api.github.com/repos/django/django/contents/{+path}","compare_url":"https://api.github.com/repos/django/django/compare/{base}...{head}","merges_url":"https://api.github.com/repos/django/django/merges","archive_url":"https://api.github.com/repos/django/django/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/django/django/downloads","issues_url":"https://api.github.com/repos/django/django/issues{/number}","pulls_url":"https://api.github.com/repos/django/django/pulls{/number}","milestones_url":"https://api.github.com/repos/django/django/milestones{/number}","notifications_url":"https://api.github.com/repos/django/django/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/django/django/labels{/name}","releases_url":"https://api.github.com/repos/django/django/releases{/id}","deployments_url":"https://api.github.com/repos/django/django/deployments","created_at":"2012-04-28T02:47:18Z","updated_at":"2016-12-13T10:23:08Z","pushed_at":"2016-12-13T10:30:49Z","git_url":"git://github.com/django/django.git","ssh_url":"git@github.com:django/django.git","clone_url":"https://github.com/django/django.git","svn_url":"https://github.com/django/django","homepage":"https://www.djangoproject.com/","size":219980,"stargazers_count":22574,"watchers_count":22574,"language":"Python","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":9133,"mirror_url":null,"open_issues_count":114,"forks":9133,"open_issues":114,"watchers":22574,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/django/django/pulls/7623"},"html":{"href":"https://github.com/django/django/pull/7623"},"issue":{"href":"https://api.github.com/repos/django/django/issues/7623"},"comments":{"href":"https://api.github.com/repos/django/django/issues/7623/comments"},"review_comments":{"href":"https://api.github.com/repos/django/django/pulls/7623/comments"},"review_comment":{"href":"https://api.github.com/repos/django/django/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/django/django/pulls/7623/commits"},"statuses":{"href":"https://api.github.com/repos/django/django/statuses/40fb51143274ea5c497eb70b6573ad74b955b037"}}}}
{"actor":{"display_login":"apollo13"}}