update password automatically

flask_security/decorators.py

@@ -67,7 +67,8 @@ def _check_http_auth():
     auth = request.authorization or dict(username=None, password=None)
     user = _security.datastore.find_user(email=auth.username)
 
-    if user and utils.verify_password(auth.password, user.password):
+    if user and utils.verify_password(auth.password, user):
+        _security.datastore.commit()
         app = current_app._get_current_object()
         identity_changed.send(app, identity=Identity(user.id))
         return True

flask_security/forms.py

@@ -162,7 +162,7 @@ class LoginForm(Form, NextFormMixin):
         if self.user is None:
             self.email.errors.append('Specified user does not exist')
             return False
-        if not verify_password(self.password.data, self.user.password):
+        if not verify_password(self.password.data, self.user):
             self.password.errors.append('Invalid password')
             return False
         if requires_confirmation(self.user):

flask_security/utils.py

@@ -82,8 +82,12 @@ def get_hmac(password):
     return base64.b64encode(h.digest())
 
 
-def verify_password(password, password_hash):
-    return _pwd_context.verify(get_hmac(password), password_hash)
+def verify_password(password, user):
+    verify, new_password = _pwd_context.verify_and_update(get_hmac(password), user.password)
+    if verify and new_password:
+        user.password = new_password
+        _datastore.put(user)
+    return verify
 
 
 def encrypt_password(password):