From 292f89c20408451b59011a12121534e3bdff9144 Mon Sep 17 00:00:00 2001 From: Nick Retallack Date: Wed, 11 Dec 2013 03:08:58 -0800 Subject: [PATCH 1/2] Prevent it from exploding if you try to log in with a user who has no password in the database. --- flask_security/core.py | 1 + flask_security/forms.py | 3 +++ 2 files changed, 4 insertions(+) diff --git a/flask_security/core.py b/flask_security/core.py index aa8be7a..9a4c671 100644 --- a/flask_security/core.py +++ b/flask_security/core.py @@ -112,6 +112,7 @@ _default_messages = { 'EMAIL_NOT_PROVIDED': ('Email not provided', 'error'), 'INVALID_EMAIL_ADDRESS': ('Invalid email address', 'error'), 'PASSWORD_NOT_PROVIDED': ('Password not provided', 'error'), + 'PASSWORD_NOT_SET': ('No password is set for this user', 'error'), 'PASSWORD_INVALID_LENGTH': ('Password must be at least 6 characters', 'error'), 'USER_DOES_NOT_EXIST': ('Specified user does not exist', 'error'), 'INVALID_PASSWORD': ('Invalid password', 'error'), diff --git a/flask_security/forms.py b/flask_security/forms.py index e43ffd0..0b68717 100644 --- a/flask_security/forms.py +++ b/flask_security/forms.py @@ -225,6 +225,9 @@ class LoginForm(Form, NextFormMixin): if self.user is None: self.email.errors.append(get_message('USER_DOES_NOT_EXIST')[0]) return False + if not self.user.password: + self.password.errors.append(get_message('PASSWORD_NOT_SET')[0]) + return False if not verify_and_update_password(self.password.data, self.user): self.password.errors.append(get_message('INVALID_PASSWORD')[0]) return False From 1596ef75d4f253903458ba96a4251b1ed81f14ff Mon Sep 17 00:00:00 2001 From: Nick Retallack Date: Wed, 11 Dec 2013 03:12:29 -0800 Subject: [PATCH 2/2] login_without_confirmation should allow you to log in without confirmation --- flask_security/confirmable.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/flask_security/confirmable.py b/flask_security/confirmable.py index ca13d71..bfdcd2d 100644 --- a/flask_security/confirmable.py +++ b/flask_security/confirmable.py @@ -58,7 +58,7 @@ def generate_confirmation_token(user): def requires_confirmation(user): """Returns `True` if the user requires confirmation.""" - return _security.confirmable and user.confirmed_at == None + return _security.confirmable and not _security.login_without_confirmation and user.confirmed_at == None def confirm_email_token_status(token):