From d0497fc8860a818cec2a52ec469329e75b3c592e Mon Sep 17 00:00:00 2001
From: Christophe Simonis <christophe@kn.gl>
Date: Tue, 8 Jan 2013 00:49:20 +0100
Subject: [PATCH] update password automatically

---
 flask_security/decorators.py | 3 ++-
 flask_security/forms.py      | 2 +-
 flask_security/utils.py      | 8 ++++++--
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/flask_security/decorators.py b/flask_security/decorators.py
index 32e3409..e7ddad5 100644
--- a/flask_security/decorators.py
+++ b/flask_security/decorators.py
@@ -67,7 +67,8 @@ def _check_http_auth():
     auth = request.authorization or dict(username=None, password=None)
     user = _security.datastore.find_user(email=auth.username)
 
-    if user and utils.verify_password(auth.password, user.password):
+    if user and utils.verify_password(auth.password, user):
+        _security.datastore.commit()
         app = current_app._get_current_object()
         identity_changed.send(app, identity=Identity(user.id))
         return True
diff --git a/flask_security/forms.py b/flask_security/forms.py
index dc99118..12bf3c9 100644
--- a/flask_security/forms.py
+++ b/flask_security/forms.py
@@ -162,7 +162,7 @@ class LoginForm(Form, NextFormMixin):
         if self.user is None:
             self.email.errors.append('Specified user does not exist')
             return False
-        if not verify_password(self.password.data, self.user.password):
+        if not verify_password(self.password.data, self.user):
             self.password.errors.append('Invalid password')
             return False
         if requires_confirmation(self.user):
diff --git a/flask_security/utils.py b/flask_security/utils.py
index 03becf6..40f427a 100644
--- a/flask_security/utils.py
+++ b/flask_security/utils.py
@@ -82,8 +82,12 @@ def get_hmac(password):
     return base64.b64encode(h.digest())
 
 
-def verify_password(password, password_hash):
-    return _pwd_context.verify(get_hmac(password), password_hash)
+def verify_password(password, user):
+    verify, new_password = _pwd_context.verify_and_update(get_hmac(password), user.password)
+    if verify and new_password:
+        user.password = new_password
+        _datastore.put(user)
+    return verify
 
 
 def encrypt_password(password):