Fix confirmation endpoint to flash an "already confirmed" message if user attempts to confirm after already being confirmed

flask_security/confirmable.py

@@ -77,6 +77,9 @@ def confirm_user(user):
 
     :param user: The user to confirm
     """
+    if user.confirmed_at is not None:
+        return False
     user.confirmed_at = datetime.utcnow()
     _datastore.put(user)
     user_confirmed.send(app._get_current_object(), user=user)
+    return True

flask_security/views.py

@@ -222,9 +222,13 @@ def confirm_email(token):
         logout_user()
         login_user(user)
 
-    confirm_user(user)
-    after_this_request(_commit)
-    do_flash(*get_message('EMAIL_CONFIRMED'))
+    if confirm_user(user):
+        after_this_request(_commit)
+        msg = 'EMAIL_CONFIRMED'
+    else:
+        msg = 'ALREADY_CONFIRMED'
+
+    do_flash(*get_message(msg))
 
     return redirect(get_url(_security.post_confirm_view) or
                     get_url(_security.post_login_view))