Vulnerable code sample

# Simplified representation of user and gym models for context
class User:
    def __init__(self, username, permissions=None, gym=None):
        self.username = username
        self.permissions = permissions if permissions else set()
        # The 'gym' attribute can be a Gym object or None
        self.gym = gym
        self.password = "a_secret_password"

# This function represents the vulnerable 'reset_user_password' view
# prior to the fix in version 2.6.
#
# In a real web application, `requesting_user` would be derived from the
# session, and `target_user` would be looked up from the database.
def reset_user_password(requesting_user: User, target_user: User, new_password: str):
    """
    Allows a user with 'gym.manage_gym' permission to reset another user's password.
    """

    # Step 1: Check for the required permission.
    if 'gym.manage_gym' not in requesting_user.permissions:
        # In a real app, this would return an HTTP 403 Forbidden response.
        return "Error: Permission denied."

    # Step 2: VULNERABLE AUTHORIZATION CHECK
    # The code intends to ensure the action is within the same gym scope.
    # However, if both `requesting_user.gym` and `target_user.gym` are None,
    # the comparison `None != None` evaluates to `False`, and the check is bypassed.
    if requesting_user.gym != target_user.gym:
        return "Error: You can only manage users assigned to your own gym."

    # Step 3: If authorization passes (or is bypassed), reset the password.
    target_user.password = new_password

    # Step 4: VULNERABLE INFORMATION DISCLOSURE
    # The new password is leaked in the response body, enabling account takeover.
    response_body = f"Success! The password for {target_user.username} has been changed to: {new_password}"
    return response_body