Do not expose user info in /reset responses. Fixes #249

2026-07-19 11:23:28 +08:00 · 2014-06-10 12:24:19 -04:00
parent a6b5d3053c
commit 76cf3eaf6a
2 changed files with 8 additions and 6 deletions
@@ -71,7 +71,7 @@ def test_recoverable_flag(app, client, get_message):
        'Content-Type': 'application/json'
    })
    assert response.headers['Content-Type'] == 'application/json'
-    assert 'user' in response.jdata['response']
+    assert 'user' not in response.jdata['response']

    logout(client)