Version 1.6.4 changes. Refer to CHANGES for updates. Fixes #123 #121 #120 $119

flask_security/core.py

@@ -10,8 +10,8 @@
 """
 
 from flask import current_app
-from flask.ext.login import AnonymousUser as AnonymousUserBase, \
-    UserMixin as BaseUserMixin, LoginManager, current_user
+from flask.ext.login import AnonymousUserMixin, UserMixin as BaseUserMixin, \
+    LoginManager, current_user
 from flask.ext.principal import Principal, RoleNeed, UserNeed, Identity, \
     identity_loaded
 from itsdangerous import URLSafeTimedSerializer
@@ -76,6 +76,7 @@ _default_config = {
     'LOGIN_SALT': 'login-salt',
     'CHANGE_SALT': 'change-salt',
     'REMEMBER_SALT': 'remember-salt',
+    'DEFAULT_REMEMBER_ME': False,
     'DEFAULT_HTTP_AUTH_REALM': 'Login Required',
     'EMAIL_SUBJECT_REGISTER': 'Welcome',
     'EMAIL_SUBJECT_CONFIRM': 'Please confirm your email',
@@ -153,8 +154,7 @@ def _token_loader(token):
             return user
     except:
         pass
-
-    return None
+    return AnonymousUser()
 
 
 def _identity_loader():
@@ -272,11 +272,10 @@ class UserMixin(BaseUserMixin):
             return role in self.roles
 
 
-class AnonymousUser(AnonymousUserBase):
+class AnonymousUser(AnonymousUserMixin):
     """AnonymousUser definition"""
 
     def __init__(self):
-        super(AnonymousUser, self).__init__()
         self.roles = ImmutableList()
 
     def has_role(self, *args):

flask_security/utils.py

@@ -38,9 +38,12 @@ _datastore = LocalProxy(lambda: _security.datastore)
 _pwd_context = LocalProxy(lambda: _security.pwd_context)
 
 
-def login_user(user, remember=True):
+def login_user(user, remember=None):
     """Performs the login and sends the appropriate signal."""
 
+    if remember is None:
+        remember = config_value('DEFAULT_REMEMBER_ME')
+
     if not _login_user(user, remember):
         return False
 

flask_security/views.py

@@ -170,7 +170,7 @@ def token_login(token):
     if invalid or expired:
         return redirect(url_for('login'))
 
-    login_user(user, True)
+    login_user(user)
     after_this_request(_commit)
     do_flash(*get_message('PASSWORDLESS_LOGIN_SUCCESSFUL'))
 
@@ -218,7 +218,7 @@ def confirm_email(token):
                         url_for('send_confirmation'))
 
     confirm_user(user)
-    login_user(user, True)
+    login_user(user)
     after_this_request(_commit)
     do_flash(*get_message('EMAIL_CONFIRMED'))
 
@@ -269,7 +269,7 @@ def reset_password(token):
         after_this_request(_commit)
         update_password(user, form.password.data)
         do_flash(*get_message('PASSWORD_RESET'))
-        login_user(user, True)
+        login_user(user)
         return redirect(get_url(_security.post_reset_view) or
                         get_url(_security.post_login_view))