@user_view
def emailchange(request, user, token, hash):
    try:
        _uid, newemail = EmailResetCode.parse(token, hash)
    except __HOLE__:
        return http.HttpResponse(status=400)

    if _uid != user.id:
        # I'm calling this a warning because invalid hashes up to this point
        # could be any number of things, but this is a targeted attack from
        # one user account to another
        log.warning((u"[Tampering] Valid email reset code for UID (%s) "
                     u"attempted to change email address for user (%s)") %
                    (_uid, user))
        return http.HttpResponse(status=400)

    if UserProfile.objects.filter(email=newemail).exists():
        log.warning((u"[Tampering] User (%s) tries to change his email to "
                     u"an existing account with the same email address (%s)") %
                    (user, newemail))
        return http.HttpResponse(status=400)

    user.email = newemail
    user.save()

    l = {'user': user, 'newemail': newemail}
    log.info(u"User (%(user)s) confirmed new email address (%(newemail)s)" % l)
    messages.success(
        request, _('Your email address was changed successfully'),
        _(u'From now on, please use {0} to log in.').format(newemail))

    return http.HttpResponseRedirect(reverse('users.edit'))
dataset/ETHPy150Open mozilla/addons-server/src/olympia/users/views.py/emailchange