website_membership_signup_required: fix reset_password form

website_membership_signup_required/controllers/main.py

@@ -32,7 +32,18 @@ class AuthSignupHomeMembership(AuthSignupHome):
         # it as `qcontext['error']` which the template renders as a red
         # alert above the form, so no extra plumbing is needed). The browser
         # also enforces it client-side via `required="required"`.
-        if qcontext.get("accepted_terms") != "accepted":
+        #
+        # `_prepare_signup_values` is also invoked by the core during the
+        # password reset flow (`/web/reset_password`). That form does NOT
+        # render the terms checkbox, so we must skip the validation there.
+        # Existing users resetting their password already accepted the terms
+        # when they signed up. We detect the reset flow primarily by the
+        # request path and secondarily by the qcontext flag set by core.
+        is_reset_password = (
+            request.httprequest.path == "/web/reset_password"
+            or qcontext.get("reset_password")
+        )
+        if not is_reset_password and qcontext.get("accepted_terms") != "accepted":
             raise UserError(_("You must accept the terms and conditions."))
         # partner_firstname: the signup form collects `firstname` / `lastname`
         # separately. We inject both into the signup values so the resulting