Bump version number to 1.6.7

Email confirmation fix

.travis.yml

@@ -6,9 +6,9 @@ python:
   - "pypy"
 
 install:
-  - pip install . --quiet --use-mirrors
+  - pip install . --quiet
   - "if [[ $TRAVIS_PYTHON_VERSION == '2.6' ]]; then pip install importlib --quiet --use-mirrors; fi"
-  - pip install nose simplejson Flask-SQLAlchemy Flask-MongoEngine Flask-Peewee Flask-Mail py-bcrypt MySQL-python --quiet --use-mirrors
+  - pip install nose simplejson Flask-SQLAlchemy Flask-MongoEngine Flask-Peewee py-bcrypt MySQL-python --quiet
 
 before_script:
   - mysql -e 'create database flask_security_test;'

CHANGES

@@ -3,6 +3,30 @@ Flask-Security Changelog
 
 Here you can see the full list of changes between each Flask-Security release.
 
+Version 1.6.7
+-------------
+
+Released July 11th 2013
+
+- Made password length form error message configurable
+- Fixed email confirmation bug that prevented logged in users from confirming their email
+
+
+Version 1.6.6
+-------------
+
+Released June 28th 2013
+
+- Fixed dependency versions
+
+
+Version 1.6.5
+-------------
+
+Released June 20th 2013
+
+- Fixed bug in `flask.ext.security.confirmable.generate_confirmation_link`
+
 
 Version 1.6.4
 -------------

docs/_templates/sidebarintro.html

@@ -9,7 +9,7 @@
 <ul>
   <li><a href="http://pypi.python.org/pypi/Flask-Security">Flask-Security @ PyPI</a></li>
   <li><a href="http://github.com/mattupstate/flask-security">Flask-Security @ github</a></li>
-  <li><a href="http://github.com/jfinkels/flask-security/issues">Issue Tracker</a></li>
+  <li><a href="http://github.com/mattupstate/flask-security/issues">Issue Tracker</a></li>
 </ul>
 <ul>
   <li><a href="http://pypi.python.org/pypi/Flask-Social">Flask-Social</a></li>

docs/conf.py

@@ -49,7 +49,7 @@ copyright = u'2012, Matt Wright'
 # built documents.
 #
 # The short X.Y version.
-version = '1.6.4'
+version = '1.6.7'
 # The full version, including alpha/beta/rc tags.
 release = version
 

docs/configuration.rst

@@ -156,6 +156,10 @@ Feature Flags
                           sent an email with a login link. This feature is
                           experimental and should be used with caution. Defaults
                           to ``False``.
+``SECURITY_CHANGEABLE``   Specifies if Flask-Security should enable the
+                          change password endpoint. The URL for this endpoint is
+                          specified by the ``SECURITY_CHANGE_URL`` configuration
+                          option. Defaults to ``False``.
 ========================= ======================================================
 
 Email

flask_security/__init__.py

@@ -10,7 +10,7 @@
     :license: MIT, see LICENSE for more details.
 """
 
-__version__ = '1.6.4'
+__version__ = '1.6.7'
 
 from .core import Security, RoleMixin, UserMixin, AnonymousUser, current_user
 from .datastore import SQLAlchemyUserDatastore, MongoEngineUserDatastore, PeeweeUserDatastore

flask_security/confirmable.py

@@ -27,7 +27,7 @@ _datastore = LocalProxy(lambda: _security.datastore)
 
 def generate_confirmation_link(user):
     token = generate_confirmation_token(user)
-    return url_for_security('confirm_email', token=token, _extenal=True), token
+    return url_for_security('confirm_email', token=token, _external=True), token
 
 
 def send_confirmation_instructions(user):

flask_security/core.py

@@ -110,6 +110,7 @@ _default_messages = {
     'EMAIL_NOT_PROVIDED': ('Email not provided', 'error'),
     'INVALID_EMAIL_ADDRESS': ('Invalid email address', 'error'),
     'PASSWORD_NOT_PROVIDED': ('Password not provided', 'error'),
+    'PASSWORD_INVALID_LENGTH': ('Password must be at least 6 characters', 'error'),
     'USER_DOES_NOT_EXIST': ('Specified user does not exist', 'error'),
     'INVALID_PASSWORD': ('Invalid password', 'error'),
     'PASSWORDLESS_LOGIN_SUCCESSFUL': ('You have successfuly logged in.', 'success'),

flask_security/forms.py

@@ -69,6 +69,7 @@ class Length(ValidatorMixin, wtf.Length):
 email_required = Required(message='EMAIL_NOT_PROVIDED')
 email_validator = Email(message='INVALID_EMAIL_ADDRESS')
 password_required = Required(message='PASSWORD_NOT_PROVIDED')
+password_length = Length(min=6, max=128, message='PASSWORD_INVALID_LENGTH')
 
 
 def get_form_field_label(key):
@@ -122,8 +123,7 @@ class PasswordFormMixin():
 
 class NewPasswordFormMixin():
     password = PasswordField(get_form_field_label('password'),
-        validators=[password_required,
+        validators=[password_required, password_length])
-                    Length(min=6, max=128)])
 
 
 class PasswordConfirmFormMixin():
@@ -256,8 +256,7 @@ class ChangePasswordForm(Form, PasswordFormMixin):
     """The default change password form"""
 
     new_password = PasswordField(get_form_field_label('new_password'),
-        validators=[password_required,
+        validators=[password_required, password_length])
-                    Length(min=6, max=128)])
 
     new_password_confirm = PasswordField(get_form_field_label('retype_password'),
         validators=[EqualTo('new_password', message='RETYPE_PASSWORD_MISMATCH')])

flask_security/views.py

@@ -200,7 +200,6 @@ def send_confirmation():
                            **_ctx('send_confirmation'))
 
 
-@anonymous_user_required
 def confirm_email(token):
     """View function which handles a email confirmation request."""
 
@@ -217,8 +216,11 @@ def confirm_email(token):
         return redirect(get_url(_security.confirm_error_view) or
                         url_for('send_confirmation'))
 
+    if user != current_user:
+        logout_user()
+        login_user(user)
+
     confirm_user(user)
-    login_user(user)
     after_this_request(_commit)
     do_flash(*get_message('EMAIL_CONFIRMED'))
 

setup.py

@@ -20,7 +20,7 @@ from setuptools import setup
 
 setup(
     name='Flask-Security',
-    version='1.6.4',
+    version='1.6.7',
     url='https://github.com/mattupstate/flask-security',
     license='MIT',
     author='Matt Wright',
@@ -35,10 +35,10 @@ setup(
     platforms='any',
     install_requires=[
         'Flask>=0.9',
-        'Flask-Login==0.2.3',
+        'Flask-Login>=0.2.3',
-        'Flask-Mail==0.7.3',
+        'Flask-Mail>=0.7.3',
-        'Flask-Principal==0.3.3',
+        'Flask-Principal>=0.3.3',
-        'Flask-WTF==0.8',
+        'Flask-WTF>=0.8',
         'itsdangerous>=0.17',
         'passlib>=1.6.1',
     ],

tests/configured_tests.py

@@ -336,6 +336,24 @@ class LoginWithoutImmediateConfirmTests(SecurityTest):
         r = self._post('/register', data=data, follow_redirects=True)
         self.assertIn(e, r.data)
 
+    def test_confirm_email_of_user_different_than_current_user(self):
+        e1 = 'dude@lp.com'
+        e2 = 'lady@lp.com'
+
+        with capture_registrations() as registrations:
+            self.register(e1)
+            self.register(e2)
+            token1 = registrations[0]['confirm_token']
+            token2 = registrations[1]['confirm_token']
+
+        self.client.get('/confirm/' + token1, follow_redirects=True)
+        self.client.get('/logout')
+        self.authenticate(email=e1)
+        r = self.client.get('/confirm/' + token2, follow_redirects=True)
+        msg = self.app.config['SECURITY_MSG_EMAIL_CONFIRMED'][0]
+        self.assertIn(msg, r.data)
+        self.assertIn('Hello %s' % e2, r.data)
+
 
 class RecoverableTests(SecurityTest):
 
@@ -459,7 +477,7 @@ class ChangePasswordTest(SecurityTest):
             'new_password_confirm': 'a'
         }, follow_redirects=True)
         self.assertNotIn('You successfully changed your password', r.data)
-        self.assertIn('Field must be between', r.data)
+        self.assertIn('Password must be at least 6 characters', r.data)
 
     def test_change_password_success(self):
         self.authenticate()