d3cfddfcac
Use token_callback for checking tokens.
...
Fixes error if user is not found.
2013-07-23 15:37:28 -07:00
d87765fc3b
PEP8 polish
2013-07-22 12:37:44 -04:00
0f46f35981
Bump version number to 1.6.7
2013-07-11 14:58:46 -04:00
8eeb832d2e
Conditionally logout the current user when confirming an email address to prevent unnecessary code/signals to be fired. Fixes #133
2013-07-11 14:50:21 -04:00
03d27cd600
add logout_user() to the beginning of confirm_email()
2013-07-11 14:14:50 -04:00
d30a27b3bb
remove '@anonymous_user_required' from confirm_email()
2013-07-11 14:14:28 -04:00
78903fa2e5
Make password length message configurable.
2013-07-02 10:36:22 -04:00
514de64303
Bump version number to 1.6.6
2013-06-28 17:24:50 -04:00
4d8a813004
Bump version number to 1.6.5
2013-06-20 16:01:36 -04:00
06312ef50f
Fix typo with _external parameter in confirmable.py. Fixes #126
2013-06-20 16:01:22 -04:00
3d34d87a97
Bump version number to 1.6.4
2013-06-18 15:00:41 -04:00
d19bb98abd
Version 1.6.4 changes. Refer to CHANGES for updates. Fixes #123 #121 #120 $119
2013-06-18 14:56:12 -04:00
c24af5ca6e
Whitespace!
2013-05-28 11:11:37 -04:00
26045fc4dc
Use the _external parameter when generating links for emails
2013-05-28 11:11:19 -04:00
bf260d4b7e
Add optional next parameter to registration endpoint. Fixes #117 .
2013-05-28 11:01:42 -04:00
db56ff74a9
Bump version number to 1.6.3
2013-05-08 12:29:48 -04:00
c587988a3a
Merge branch 'develop' of github.com:mattupstate/flask-security into develop
2013-05-03 12:14:14 -04:00
f2d5245bd8
Import check to account for new version of MongoEngine
2013-05-03 12:13:58 -04:00
e749b77ca7
Make flask-login respect SECURITY_FLASH_MESSAGES
2013-04-14 16:37:23 -04:00
3b81ec57ea
Changed has_role to accept strings with mongoengine. Fixes #110
2013-04-13 15:11:56 -04:00
38874433c7
Add tests for Peewee support
2013-04-04 18:09:55 -04:00
4eda3e756f
PEP8 polish
2013-04-04 16:39:50 -04:00
4815b1afed
Make find_user method for MongoEngineUserDatastore add contraints to query
2013-04-04 15:50:46 -04:00
99ac732d10
Bump version number to 1.6.2
2013-04-04 10:24:03 -04:00
e8b0c62818
Update CHANGES and a little polish
2013-04-04 10:23:51 -04:00
3575a2df18
Fixed http_auth when authorization is not provided in header
2013-04-03 21:29:04 -04:00
c84c485493
Bump version number to 1.6.1
2013-04-03 11:07:36 -04:00
f1cca43d9c
sending signals fixed
2013-04-03 12:36:53 +02:00
6f9869e9c2
import auth_required into top level package
2013-03-27 17:20:31 -04:00
ba1758e5c7
Bump version number to 1.6.0
2013-03-13 14:06:34 -04:00
8708fd8514
Update form messaging to be more flexible. Fixes #80
2013-03-13 13:40:35 -04:00
520b8ecef4
Show an invalid confirmation token message if a user attempts to confirm their account after it has been deleted. Fixes #93
2013-03-13 12:27:26 -04:00
34aa43ead3
Merge pull request #100 from chrishaines/develop
...
Make subdomain configurable
2013-03-13 09:10:16 -07:00
8ecc3b9a78
Add user to request context for http basic and token auth
2013-03-13 12:09:28 -04:00
c0d1d0566f
Make subdomain configurable
2013-03-13 00:13:54 -04:00
bbe99b5436
Fixes #98
2013-03-07 15:38:34 -05:00
48dd3fa5bf
NextFormMixin security bug fixed: open redirect
...
NextFormMixin was missing validations check on redirection [1]. Only internal redirections
are now allowed.
Attack Example: http://127.0.0.1:5000/login?next=http://google.com (it should not redirect to google.com)
wq
[1] https://www.owasp.org/index.php/Top_10_2010-A10-Unvalidated_Redirects_and_Forwards
2013-03-05 21:20:45 +00:00
38a1dfa336
Merge pull request #85 from chrishaines/template_list
...
Template paths can be specified in config
2013-03-03 18:38:35 -08:00
ae64370478
added option to disable register email
2013-02-20 17:04:47 +01:00
8085e0031e
Password should be encoded as 'utf-8' before creating hmac to support passwords with non-latin symbols
2013-02-03 22:14:32 +04:00
4f414cf70f
Merge branch 'develop' of git://github.com/mattupstate/flask-security into template_list
...
Conflicts:
requirements.txt
2013-02-01 19:40:01 -05:00
adb2680289
Add change password endpoint
2013-02-01 18:21:43 -05:00
f1f621d178
Merge pull request #78 from eskil/change_password_form
...
Change password form
2013-02-01 15:16:45 -08:00
840f72a589
Merge pull request #82 from maebert/flask-peewee
...
Flask-Peewee support
2013-02-01 14:44:52 -08:00
c49d9b57ed
Make login form messages configurable
2013-02-01 17:32:54 -05:00
34b3bf9e80
Fix CSRF functionality for LoginForm
...
The login form was not respecting csrf validation. I've adjusted the tests as well to always send a CSRF token along. This now requires all requests to pass a csrf token. If performing plain AJAX requests the token will have to be extracted from the form in some way. Fixes #86
2013-02-01 17:23:18 -05:00
02c49ee423
Paths for templates are now configurable
2013-01-29 22:24:11 -05:00
51e06bdbb0
Fixes typo in find_or_create_role
2013-01-29 15:46:59 -08:00
462fb1ae7e
Convenience method for finding or creating a role
...
`datastore. find_or_create_role("admin")` will now always return a role
with the name admin; useful for initialisation,
2013-01-28 18:58:11 -08:00
aea5b91649
Method stub parameters and docs for find_role didn't match implementations.
2013-01-28 18:57:19 -08:00
Eric Butler