def reset_password(request):
    '''
    Password reset handling.
    '''
    if 'email' not in load_backends(BACKENDS).keys():
        messages.error(
            request,
            _('Can not reset password, email authentication is disabled!')
        )
        return redirect('login')

    if request.method == 'POST':
        form = ResetForm(request.POST)
        if form.is_valid():
            # Force creating new session
            request.session.create()
            if request.user.is_authenticated():
                logout(request)

            request.session['password_reset'] = True
            return complete(request, 'email')
        else:
            return redirect('email-sent')
    else:
        form = ResetForm()

    return render(
        request,
        'accounts/reset.html',
        {
            'title': _('Password reset'),
            'form': form,
        }
    )
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.