Fixed #20705 -- Allowed using PasswordResetForm with user models with an email field not named 'email'.

3 files changed, 15 insertions, 4 deletions

diff --git a/django/contrib/auth/base_user.py b/django/contrib/auth/base_user.py
index de069659e1..9ad5cde87f 100644
--- a/django/contrib/auth/base_user.py
+++ b/django/contrib/auth/base_user.py
@@ -138,5 +138,12 @@ class AbstractBaseUser(models.Model):
         return salted_hmac(key_salt, self.password).hexdigest()
 
     @classmethod
+    def get_email_field_name(cls):
+        try:
+            return cls.EMAIL_FIELD
+        except AttributeError:
+            return 'email'
+
+    @classmethod
     def normalize_username(cls, username):
         return unicodedata.normalize('NFKC', force_text(username))
diff --git a/django/contrib/auth/forms.py b/django/contrib/auth/forms.py
index 7a6a8d74aa..dbdc08db64 100644
--- a/django/contrib/auth/forms.py
+++ b/django/contrib/auth/forms.py
@@ -254,8 +254,11 @@ class PasswordResetForm(forms.Form):
         that prevent inactive users and users with unusable passwords from
         resetting their password.
         """
-        active_users = get_user_model()._default_manager.filter(
-            email__iexact=email, is_active=True)
+        UserModel = get_user_model()
+        active_users = UserModel._default_manager.filter(**{
+            '%s__iexact' % UserModel.get_email_field_name(): email,
+            'is_active': True,
+        })
         return (u for u in active_users if u.has_usable_password())
 
     def save(self, domain_override=None,
@@ -277,7 +280,7 @@ class PasswordResetForm(forms.Form):
             else:
                 site_name = domain = domain_override
             context = {
-                'email': user.email,
+                'email': email,
                 'domain': domain,
                 'site_name': site_name,
                 'uid': urlsafe_base64_encode(force_bytes(user.pk)),
@@ -289,7 +292,7 @@ class PasswordResetForm(forms.Form):
                 context.update(extra_email_context)
             self.send_mail(
                 subject_template_name, email_template_name, context, from_email,
-                user.email, html_email_template_name=html_email_template_name,
+                email, html_email_template_name=html_email_template_name,
             )
 
 
diff --git a/django/contrib/auth/models.py b/django/contrib/auth/models.py
index e62307a0a7..eef38c17ee 100644
--- a/django/contrib/auth/models.py
+++ b/django/contrib/auth/models.py
@@ -333,6 +333,7 @@ class AbstractUser(AbstractBaseUser, PermissionsMixin):
 
     objects = UserManager()
 
+    EMAIL_FIELD = 'email'
     USERNAME_FIELD = 'username'
     REQUIRED_FIELDS = ['email']