From 112c419403624b521705ac84f29731c5b19e312e Mon Sep 17 00:00:00 2001 From: Matt Wright Date: Thu, 24 May 2012 21:15:31 -0400 Subject: [PATCH] A bit more polish --- flask_security/core.py | 8 ++++++++ flask_security/views.py | 8 -------- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/flask_security/core.py b/flask_security/core.py index 509d2b6..7008079 100644 --- a/flask_security/core.py +++ b/flask_security/core.py @@ -21,6 +21,8 @@ from flask.ext.principal import Principal, RoleNeed, UserNeed, \ from flask.ext.wtf import Form, TextField, PasswordField, SubmitField, \ HiddenField, Required, BooleanField, EqualTo, Email from flask.ext.security import views, exceptions, utils +from flask.ext.security.confirmable import confirmation_token_is_expired, \ + requires_confirmation, reset_confirmation_token from passlib.context import CryptContext from werkzeug.datastructures import ImmutableList @@ -387,6 +389,12 @@ class AuthenticationProvider(object): except Exception, e: self.auth_error('Unexpected authentication error: %s' % e) + if confirmation_token_is_expired(user): + reset_confirmation_token(user) + + if requires_confirmation(user): + raise exceptions.BadCredentialsError('Account requires confirmation') + # compare passwords if current_app.security.pwd_context.verify(password, user.password): return user diff --git a/flask_security/views.py b/flask_security/views.py index 09614f1..359ec97 100644 --- a/flask_security/views.py +++ b/flask_security/views.py @@ -13,7 +13,6 @@ from flask import current_app, redirect, request, session, render_template from flask.ext.login import login_user, logout_user from flask.ext.principal import Identity, AnonymousIdentity, identity_changed from flask.ext.security.confirmable import confirm_by_token, \ - confirmation_token_is_expired, requires_confirmation, \ reset_confirmation_token, send_confirmation_instructions from flask.ext.security.recoverable import reset_by_token, \ reset_password_reset_token @@ -52,13 +51,6 @@ def authenticate(): try: user = security.auth_provider.authenticate(form) - # Conveniently reset the token if necessary and expired - if confirmation_token_is_expired(user): - reset_confirmation_token(user) - - if requires_confirmation(user): - raise BadCredentialsError('Account requires confirmation') - if _do_login(user, remember=form.remember.data): return redirect(get_post_login_redirect())