Add a password-changed signal

flask_security/changeable.py

@@ -0,0 +1,45 @@
+# -*- coding: utf-8 -*-
+"""
+    flask.ext.security.changeable
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+    Flask-Security recoverable module
+
+    :copyright: (c) 2012 by Matt Wright.
+    :author: Eskil Heyn Olsen
+    :license: MIT, see LICENSE for more details.
+"""
+
+from flask import current_app as app, request
+from werkzeug.local import LocalProxy
+
+from .signals import password_changed
+from .utils import send_mail, encrypt_password, url_for_security, \
+    config_value
+
+
+# Convenient references
+_security = LocalProxy(lambda: app.extensions['security'])
+
+_datastore = LocalProxy(lambda: _security.datastore)
+
+
+def send_password_changed_notice(user):
+    """Sends the password changed notice email for the specified user.
+
+    :param user: The user to send the notice to
+    """
+    send_mail(config_value('EMAIL_SUBJECT_PASSWORD_CHANGE_NOTICE'), user.email,
+              'change_notice', user=user)
+
+
+def change_user_password(user, password):
+    """Change the specified user's password
+
+    :param user: The user to change_password
+    :param password: The unencrypted new password
+    """
+    user.password = encrypt_password(password)
+    _datastore.put(user)
+    send_password_changed_notice(user)
+    password_changed.send(user, app=app._get_current_object())

flask_security/core.py

@@ -73,6 +73,7 @@ _default_config = {
     'EMAIL_SUBJECT_CONFIRM': 'Please confirm your email',
     'EMAIL_SUBJECT_PASSWORDLESS': 'Login instructions',
     'EMAIL_SUBJECT_PASSWORD_NOTICE': 'Your password has been reset',
+    'EMAIL_SUBJECT_PASSWORD_CHANGE_NOTICE': 'Your password has been changed',
     'EMAIL_SUBJECT_PASSWORD_RESET': 'Password reset instructions'
 }
 

flask_security/signals.py

@@ -24,4 +24,6 @@ login_instructions_sent = signals.signal("login-instructions-sent")
 
 password_reset = signals.signal("password-reset")
 
+password_changed = signals.signal("password-changed")
+
 reset_password_instructions_sent = signals.signal("password-reset-instructions-sent")

flask_security/templates/security/email/change_notice.html

@@ -0,0 +1,4 @@
+<p>Your password has been changed.</p>
+{% if security.recoverable %}
+<p>If you did not change your password, <a href="{{ url_for_security('forgot_password') }}">click here to reset your password</a>.</p>
+{% endif %}

flask_security/templates/security/email/change_notice.txt

@@ -0,0 +1,5 @@
+Your password has been changed
+{% if security.recoverable %}
+If you did not change your password, click the link below to reset your password:
+{{ url_for_security('forgot_password') }}
+{% endif %}

flask_security/utils.py

@@ -27,7 +27,7 @@ from werkzeug.local import LocalProxy
 
 from .signals import user_registered, user_confirmed, \
     confirm_instructions_sent, login_instructions_sent, \
-    password_reset, reset_password_instructions_sent
+    password_reset, password_changed, reset_password_instructions_sent
 
 # Convenient references
 _security = LocalProxy(lambda: current_app.extensions['security'])
@@ -372,6 +372,7 @@ def capture_signals():
     """Factory method that creates a `CaptureSignals` with all the flask_security signals."""
     return CaptureSignals([user_registered, user_confirmed,
                            confirm_instructions_sent, login_instructions_sent,
-                           password_reset, reset_password_instructions_sent])
+                           password_reset, password_changed,
+                           reset_password_instructions_sent])
 
 

flask_security/views.py

@@ -11,7 +11,7 @@
 
 from flask import current_app, redirect, request, render_template, jsonify, \
      after_this_request, Blueprint
-from flask.ext.login import current_user
+from flask_login import current_user
 from werkzeug.datastructures import MultiDict
 from werkzeug.local import LocalProxy
 
@@ -22,6 +22,7 @@ from .passwordless import send_login_instructions, \
      login_token_status
 from .recoverable import reset_password_token_status, \
      send_reset_password_instructions, update_password
+from .changeable import change_user_password
 from .registerable import register_user
 from .utils import get_url, get_post_login_redirect, do_flash, \
      get_message, login_user, logout_user, url_for_security as url_for
@@ -292,7 +293,7 @@ def change_password():
 
     if form.validate_on_submit():
         after_this_request(_commit)
-        update_password(current_user, form.new_password.data)
+        change_user_password(current_user, form.new_password.data)
         if request.json is None:
             do_flash(*get_message('PASSWORD_CHANGE'))