Merge remote-tracking branch 'origin/release/2.5' into develop

superdesk · Oct 27, 2023 · c915e03 · c915e03
2 parents a9e72c9 + deddcf1
commit c915e03
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/newsroom/users/users.py b/newsroom/users/users.py
@@ -349,6 +349,10 @@ def check_permissions(self, doc, updates=None):
             else [field for field in updates.keys() if updates[field] != doc.get(field) and field != "id"]
         )
 
+        if request.url_rule and request.url_rule.rule:
+            if request.url_rule.rule in ["/reset_password/<token>", "/token/<token_type>"]:
+                return
+
         if is_current_user_company_admin():
             manager = get_user()
             if doc.get("company") and doc["company"] == manager.get("company"):