Bump version number to 1.7.5

Add changelog for bugfix version 1.7.5

.gitignore

@@ -34,3 +34,13 @@ env/
 
 *.db
 *cache*
+
+# vim
+[._]*.s[a-w][a-z]
+[._]s[a-w][a-z]
+*.un~
+Session.vim
+.netrwhist
+*~
+
+.eggs/README.txt

.travis.yml

@@ -5,13 +5,27 @@ python:
   - "2.7"
   - "3.3"
   - "3.4"
+  - "3.5"
   - "pypy"
 
+sudo: false
+
+cache:
+  - apt
+  - pip
+
 install:
   - pip install -r requirements.txt -r requirements-dev.txt -e .
   - pip install coverage coveralls
   - "if [[ $TRAVIS_PYTHON_VERSION == '2.6' ]]; then pip install importlib; fi"
 
+addons:
+  apt:
+    sources:
+      - deadsnakes
+    packages:
+      - python3.5
+
 services:
   - mongodb
 

AUTHORS

@@ -36,3 +36,4 @@ Rotem Yaari
 Srijan Choudhary
 Tristan Escalada
 Vadim Kotov
+Walt Askew

CHANGES

@@ -3,6 +3,36 @@ Flask-Security Changelog
 
 Here you can see the full list of changes between each Flask-Security release.
 
+Version 1.7.5
+-------------
+
+Released December 2nd 2015
+
+- Added `SECURITY_TOKEN_MAX_AGE` configuration setting
+- Fixed calls to `SQLAlchemyUserDatastore.get_user(None)` (this now returns `False` instead of raising a `TypeError`
+- Fixed URL generation adding extra slashes in some cases (see GitHub #343)
+- Fixed handling of trackable IP addresses when the `X-Forwarded-For` header contains multiple values
+- Include WWW-Authenticate headers in `@auth_required` authentication checks
+- Fixed error when `check_token` function is used with a json list
+- Added support for custom `AnonymousUser` classes
+- Restricted `forgot_password` endpoint to anonymous users
+- Allowed unauthorized callback to be overridden
+- Fixed issue where passwords cannot be reset if currently set to `None`
+- Ensured that password reset tokens are invalidated after use
+- Updated `is_authenticated` and `is_active` functions to support Flask-Login changes
+- Various documentation improvements
+
+
+Version 1.7.4
+-------------
+
+Released October 13th 2014
+
+- Fixed a bug related to changing existing passwords from plaintext to hashed
+- Fixed a bug in form validation that did not enforce case insensivitiy
+- Fixed a bug with validating redirects
+
+
 Version 1.7.3
 -------------
 

docs/api.rst

@@ -87,43 +87,38 @@ sends the following signals.
 
 .. data:: user_registered
 
-   Sent when a user registers on the site. It is passed a dict with
+   Sent when a user registers on the site. In addition to the app (which is the
-   the `user` and `confirm_token`, the user being logged in and the
+   sender), it is passed `user` and `confirm_token` arguments.
-   (if so configured) the confirmation token issued.
 
 .. data:: user_confirmed
 
-   Sent when a user is confirmed. It is passed `user`, which is the
+   Sent when a user is confirmed. In addition to the app (which is the
-   user being confirmed.
+   sender), it is passed a `user` argument.
 
 .. data:: confirm_instructions_sent
 
-   Sent when a user requests confirmation instructions. It is passed
+   Sent when a user requests confirmation instructions. In addition to the app
-   the `user`.
+   (which is the sender), it is passed a `user` argument.
 
 .. data:: login_instructions_sent
 
-   Sent when passwordless login is used and user logs in. It is passed
+   Sent when passwordless login is used and user logs in. In addition to the app
-   a dict with the `user` and `login_token`, the user being logged in
+   (which is the sender), it is passed `user` and `login_token` arguments.
-   and the (if so configured) the login token issued.
 
 .. data:: password_reset
 
-   Sent when a user completes a password reset. It is passed the
+   Sent when a user completes a password reset. In addition to the app (which is
-   `user`.
+   the sender), it is passed a `user` argument.
 
 .. data:: password_changed
 
-   Sent when a user completes a password change. It is passed the
+   Sent when a user completes a password change. In addition to the app (which is
-   `user`.
+   the sender), it is passed a `user` argument.
 
 .. data:: reset_password_instructions_sent
 
-   Sent when a user requests a password reset. It is passed a dict
+   Sent when a user requests a password reset. In addition to the app (which is
-   with the `user` and `token`, the user being logged in and
+   the sender), it is passed `user` and `token` arguments.
-   the (if so configured) the reset token issued.
 
-All signals are also passed a `app` keyword argument, which is the
-current application.
 
 .. _Flask documentation on signals: http://flask.pocoo.org/docs/signals/

docs/conf.py

@@ -49,7 +49,7 @@ copyright = u'2012, Matt Wright'
 # built documents.
 #
 # The short X.Y version.
-version = '1.7.3'
+version = '1.7.5'
 # The full version, including alpha/beta/rc tags.
 release = version
 

docs/configuration.rst

@@ -15,7 +15,7 @@ Core
 ``SECURITY_URL_PREFIX``                  Specifies the URL prefix for the
                                          Flask-Security blueprint. Defaults to
                                          ``None``.
-``SECURITY_FLASH_MESSAGES``              Specifies wether or not to flash
+``SECURITY_FLASH_MESSAGES``              Specifies whether or not to flash
                                          messages during security procedures.
                                          Defaults to ``True``.
 ``SECURITY_PASSWORD_HASH``               Specifies the password hash algorithm to
@@ -23,7 +23,10 @@ Core
                                          passwords. Recommended values for
                                          production systems are ``bcrypt``,
                                          ``sha512_crypt``, or ``pbkdf2_sha512``.
-                                         Defaults to ``plaintext``.
+                                         Defaults to ``plaintext``. Note:
+                                         ``bcrypt>=2.0.0`` is not currently
+                                         supported. If ``bcrypt`` is preferred,
+                                         please use ``bcrypt<2.0``.
 ``SECURITY_PASSWORD_SALT``               Specifies the HMAC salt. This is only
                                          used if the password hash type is set
                                          to something other than plain text.
@@ -31,12 +34,16 @@ Core
 ``SECURITY_EMAIL_SENDER``                Specifies the email address to send
                                          emails as. Defaults to
                                          ``no-reply@localhost``.
-``SECURITY_TOKEN_AUTHENTICATION_KEY``    Specifies the query sting parameter to
+``SECURITY_TOKEN_AUTHENTICATION_KEY``    Specifies the query string parameter to
                                          read when using token authentication.
                                          Defaults to ``auth_token``.
 ``SECURITY_TOKEN_AUTHENTICATION_HEADER`` Specifies the HTTP header to read when
                                          using token authentication. Defaults to
                                          ``Authentication-Token``.
+``SECURITY_TOKEN_MAX_AGE``               Specifies the number of seconds before
+                                         an authentication token expires.
+                                         Defaults to None, meaning the token
+                                         never expires.
 ``SECURITY_DEFAULT_HTTP_AUTH_REALM``     Specifies the default authentication
                                          realm when using basic HTTP auth.
                                          Defaults to ``Login Required``
@@ -69,37 +76,37 @@ URLs and Views
 ``SECURITY_CONFIRM_ERROR_VIEW`` Specifies the view to redirect to if a
                                 confirmation error occurs. This value can be set
                                 to a URL or an endpoint name. If this value is
-                                ``None`` the user is presented the default view
+                                ``None``, the user is presented the default view
                                 to resend a confirmation link. Defaults to
                                 ``None``.
 ``SECURITY_POST_REGISTER_VIEW`` Specifies the view to redirect to after a user
                                 successfully registers. This value can be set to
                                 a URL or an endpoint name. If this value is
-                                ``None`` the user is redirected to the value of
+                                ``None``, the user is redirected to the value of
                                 ``SECURITY_POST_LOGIN_VIEW``. Defaults to
                                 ``None``.
 ``SECURITY_POST_CONFIRM_VIEW``  Specifies the view to redirect to after a user
                                 successfully confirms their email. This value
                                 can be set to a URL or an endpoint name. If this
-                                value is ``None`` the user is redirected  to the
+                                value is ``None``, the user is redirected  to the
                                 value of ``SECURITY_POST_LOGIN_VIEW``. Defaults
                                 to ``None``.
 ``SECURITY_POST_RESET_VIEW``    Specifies the view to redirect to after a user
                                 successfully resets their password. This value
                                 can be set to a URL or an endpoint name. If this
-                                value is ``None`` the user is redirected  to the
+                                value is ``None``, the user is redirected  to the
                                 value of ``SECURITY_POST_LOGIN_VIEW``. Defaults
                                 to ``None``.
 ``SECURITY_POST_CHANGE_VIEW``   Specifies the view to redirect to after a user
                                 successfully changes their password. This value
                                 can be set to a URL or an endpoint name. If this
-                                value is ``None`` the user is redirected  to the
+                                value is ``None``, the user is redirected  to the
                                 value of ``SECURITY_POST_LOGIN_VIEW``. Defaults
                                 to ``None``.
 ``SECURITY_UNAUTHORIZED_VIEW``  Specifies the view to redirect to if a user
                                 attempts to access a URL/endpoint that they do
                                 not have permission to access. If this value is
-                                ``None`` the user is presented with a default
+                                ``None``, the user is presented with a default
                                 HTTP 403 response. Defaults to ``None``.
 =============================== ================================================
 
@@ -144,7 +151,7 @@ Feature Flags
 ========================= ======================================================
 ``SECURITY_CONFIRMABLE``  Specifies if users are required to confirm their email
                           address when registering a new account. If this value
-                          is `True` Flask-Security creates an endpoint to handle
+                          is `True`, Flask-Security creates an endpoint to handle
                           confirmations and requests to resend confirmation
                           instructions. The URL for this endpoint is specified
                           by the ``SECURITY_CONFIRM_URL`` configuration option.
@@ -158,11 +165,12 @@ Feature Flags
                           specified by the ``SECURITY_RESET_URL`` configuration
                           option. Defaults to ``False``.
 ``SECURITY_TRACKABLE``    Specifies if Flask-Security should track basic user
-                          login statistics. If set to ``True`` ensure your
+                          login statistics. If set to ``True``, ensure your
-                          models have the required fields/attribues. Defaults to
+                          models have the required fields/attribues. Be sure to
+                          use `ProxyFix <http://flask.pocoo.org/docs/0.10/deploying/wsgi-standalone/#proxy-setups>` if you are using a proxy. Defaults to
                           ``False``
 ``SECURITY_PASSWORDLESS`` Specifies if Flask-Security should enable the
-                          passwordless login feature. If set to ``True`` users
+                          passwordless login feature. If set to ``True``, users
                           are not required to enter a password to login but are
                           sent an email with a login link. This feature is
                           experimental and should be used with caution. Defaults
@@ -261,3 +269,44 @@ Miscellaneous
                                               me" value used when logging in
                                               a user. Defaults to ``False``.
 ============================================= ==================================
+
+Messages
+-------------
+
+The following are the messages Flask-Security uses.  They are tuples; the first
+element is the message and the second element is the error level.
+
+The default messages and error levels can be found in ``core.py``.
+
+* ``SECURITY_MSG_ALREADY_CONFIRMED``
+* ``SECURITY_MSG_CONFIRMATION_EXPIRED``
+* ``SECURITY_MSG_CONFIRMATION_REQUEST``
+* ``SECURITY_MSG_CONFIRMATION_REQUIRED``
+* ``SECURITY_MSG_CONFIRM_REGISTRATION``
+* ``SECURITY_MSG_DISABLED_ACCOUNT``
+* ``SECURITY_MSG_EMAIL_ALREADY_ASSOCIATED``
+* ``SECURITY_MSG_EMAIL_CONFIRMED``
+* ``SECURITY_MSG_EMAIL_NOT_PROVIDED``
+* ``SECURITY_MSG_INVALID_CONFIRMATION_TOKEN``
+* ``SECURITY_MSG_INVALID_EMAIL_ADDRESS``
+* ``SECURITY_MSG_INVALID_LOGIN_TOKEN``
+* ``SECURITY_MSG_INVALID_PASSWORD``
+* ``SECURITY_MSG_INVALID_REDIRECT``
+* ``SECURITY_MSG_INVALID_RESET_PASSWORD_TOKEN``
+* ``SECURITY_MSG_LOGIN``
+* ``SECURITY_MSG_LOGIN_EMAIL_SENT``
+* ``SECURITY_MSG_LOGIN_EXPIRED``
+* ``SECURITY_MSG_PASSWORDLESS_LOGIN_SUCCESSFUL``
+* ``SECURITY_MSG_PASSWORD_CHANGE``
+* ``SECURITY_MSG_PASSWORD_INVALID_LENGTH``
+* ``SECURITY_MSG_PASSWORD_IS_THE_SAME``
+* ``SECURITY_MSG_PASSWORD_MISMATCH``
+* ``SECURITY_MSG_PASSWORD_NOT_PROVIDED``
+* ``SECURITY_MSG_PASSWORD_NOT_SET``
+* ``SECURITY_MSG_PASSWORD_RESET``
+* ``SECURITY_MSG_PASSWORD_RESET_EXPIRED``
+* ``SECURITY_MSG_PASSWORD_RESET_REQUEST``
+* ``SECURITY_MSG_REFRESH``
+* ``SECURITY_MSG_RETYPE_PASSWORD_MISMATCH``
+* ``SECURITY_MSG_UNAUTHORIZED``
+* ``SECURITY_MSG_USER_DOES_NOT_EXIST``

docs/customizing.rst

@@ -2,7 +2,7 @@ Customizing Views
 =================
 
 Flask-Security bootstraps your application with various views for handling its
-configured features to get you up and running as quick as possible. However,
+configured features to get you up and running as quickly as possible. However,
 you'll probably want to change the way these views look to be more in line with
 your application's visual design.
 
@@ -36,7 +36,7 @@ Flask application context processor:
 * ``<template_name>_form``: A form object for the view
 * ``security``: The Flask-Security extension object
 
-To add more values to the template context you can specify a context processor
+To add more values to the template context, you can specify a context processor
 for all views or a specific view. For example::
 
     security = Security(app, user_datastore)
@@ -73,8 +73,8 @@ register form or override validators::
     from flask_security.forms import RegisterForm
 
     class ExtendedRegisterForm(RegisterForm):
-        first_name = TextField('First Name', [Required()])
+        first_name = StringField('First Name', [Required()])
-        last_name = TextField('Last Name', [Required()])
+        last_name = StringField('Last Name', [Required()])
 
     security = Security(app, user_datastore,
              register_form=ExtendedRegisterForm)
@@ -106,7 +106,7 @@ The following is a list of all the available form overrides:
 Emails
 ------
 
-Flask-Security is also packaged with a default tempalte for each email that it
+Flask-Security is also packaged with a default template for each email that it
 may send. Templates are located within the subfolder named ``security/email``.
 The following is a list of email templates:
 
@@ -131,7 +131,7 @@ Overriding these templates is simple:
 
 Each template is passed a template context object that includes values for any
 links that are required in the email. If you require more values in the
-templates you can specify an email context processor with the
+templates, you can specify an email context processor with the
 ``mail_context_processor`` decorator. For example::
 
     security = Security(app, user_datastore)
@@ -146,7 +146,7 @@ Emails with Celery
 ------------------
 
 Sometimes it makes sense to send emails via a task queue, such as `Celery`_.
-To delay the sending of emails you can use the ``@security.send_mail_task``
+To delay the sending of emails, you can use the ``@security.send_mail_task``
 decorator like so::
 
     # Setup the task

docs/features.rst

@@ -24,7 +24,7 @@ instance, you may assign roles such as `Admin`, `Editor`, `SuperUser`, or a
 combination of said roles to a user. Access control is based on the role name
 and all roles should be uniquely named. This feature is implemented using the
 `Flask-Principal`_ extension. If you'd like to implement more granular access
-control you can refer to the Flask-Princpal `documentation on this topic`_.
+control, you can refer to the Flask-Principal `documentation on this topic`_.
 
 
 Password Encryption
@@ -89,7 +89,7 @@ User Registration
 
 Flask-Security comes packaged with a basic user registration view. This view is
 very simple and new users need only supply an email address and their password.
-This view can be overrided if your registration process requires more fields.
+This view can be overridden if your registration process requires more fields.
 
 
 Login Tracking

docs/models.rst

@@ -5,7 +5,7 @@ Flask-Security assumes you'll be using libraries such as SQLAlchemy,
 MongoEngine or Peewee to define a data model that includes a `User` and
 `Role` model. The fields on your models must follow a particular convention
 depending on the functionality your app requires. Aside from this, you're
-free to add any additional fields to your model(s) if you want. At the bear
+free to add any additional fields to your model(s) if you want. At the bare
 minimum your `User` and `Role` model should include the following fields:
 
 **User**
@@ -32,7 +32,7 @@ Confirmable
 ^^^^^^^^^^^
 
 If you enable account confirmation by setting your application's
-`SECURITY_CONFIRMABLE` configuration value to `True` your `User` model will
+`SECURITY_CONFIRMABLE` configuration value to `True`, your `User` model will
 require the following additional field:
 
 * ``confirmed_at``
@@ -41,7 +41,7 @@ Trackable
 ^^^^^^^^^
 
 If you enable user tracking by setting your application's `SECURITY_TRACKABLE`
-configuration value to `True` your `User` model will require the following
+configuration value to `True`, your `User` model will require the following
 additional fields:
 
 * ``last_login_at``

flask_security/__init__.py

@@ -1,7 +1,7 @@
 # -*- coding: utf-8 -*-
 """
-    flask.ext.security
+    flask_security
-    ~~~~~~~~~~~~~~~~~~
+    ~~~~~~~~~~~~~~
 
     Flask-Security is a Flask extension that aims to add quick and simple
     security via Flask-Login, Flask-Principal, Flask-WTF, and passlib.
@@ -10,8 +10,6 @@
     :license: MIT, see LICENSE for more details.
 """
 
-__version__ = '1.7.3'
-
 from .core import Security, RoleMixin, UserMixin, AnonymousUser, current_user
 from .datastore import SQLAlchemyUserDatastore, MongoEngineUserDatastore, PeeweeUserDatastore
 from .decorators import auth_token_required, http_auth_required, \
@@ -21,3 +19,5 @@ from .forms import ForgotPasswordForm, LoginForm, RegisterForm, \
 from .signals import confirm_instructions_sent, password_reset, \
     reset_password_instructions_sent, user_confirmed, user_registered
 from .utils import login_user, logout_user, url_for_security
+
+__version__ = '1.7.5'

flask_security/changeable.py

@@ -1,7 +1,7 @@
 # -*- coding: utf-8 -*-
 """
-    flask.ext.security.changeable
+    flask_security.changeable
-    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+    ~~~~~~~~~~~~~~~~~~~~~~~~~
 
     Flask-Security recoverable module
 
@@ -42,4 +42,5 @@ def change_user_password(user, password):
     user.password = encrypt_password(password)
     _datastore.put(user)
     send_password_changed_notice(user)
-    password_changed.send(app._get_current_object(), user=user)
+    password_changed.send(app._get_current_object(),
+                          user=user._get_current_object())

flask_security/confirmable.py

@@ -1,7 +1,7 @@
 # -*- coding: utf-8 -*-
 """
-    flask.ext.security.confirmable
+    flask_security.confirmable
-    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~
 
     Flask-Security confirmable module
 

flask_security/core.py

@@ -1,7 +1,7 @@
 # -*- coding: utf-8 -*-
 """
-    flask.ext.security.core
+    flask_security.core
-    ~~~~~~~~~~~~~~~~~~~~~~~
+    ~~~~~~~~~~~~~~~~~~~
 
     Flask-Security core module
 
@@ -10,9 +10,9 @@
 """
 
 from flask import current_app, render_template
-from flask.ext.login import AnonymousUserMixin, UserMixin as BaseUserMixin, \
+from flask_login import AnonymousUserMixin, UserMixin as BaseUserMixin, \
     LoginManager, current_user
-from flask.ext.principal import Principal, RoleNeed, UserNeed, Identity, \
+from flask_principal import Principal, RoleNeed, UserNeed, Identity, \
     identity_loaded
 from itsdangerous import URLSafeTimedSerializer
 from passlib.context import CryptContext
@@ -75,6 +75,7 @@ _default_config = {
     'EMAIL_SENDER': 'no-reply@localhost',
     'TOKEN_AUTHENTICATION_KEY': 'auth_token',
     'TOKEN_AUTHENTICATION_HEADER': 'Authentication-Token',
+    'TOKEN_MAX_AGE': None,
     'CONFIRM_SALT': 'confirm-salt',
     'RESET_SALT': 'reset-salt',
     'LOGIN_SALT': 'login-salt',
@@ -192,17 +193,17 @@ def _user_loader(user_id):
 
 def _token_loader(token):
     try:
-        data = _security.remember_token_serializer.loads(token)
+        data = _security.remember_token_serializer.loads(token, max_age=_security.token_max_age)
         user = _security.datastore.find_user(id=data[0])
         if user and safe_str_cmp(md5(user.password), data[1]):
             return user
     except:
         pass
-    return AnonymousUser()
+    return _security.login_manager.anonymous_user()
 
 
 def _identity_loader():
-    if not isinstance(current_user._get_current_object(), AnonymousUser):
+    if not isinstance(current_user._get_current_object(), AnonymousUserMixin):
         identity = Identity(current_user.id)
         return identity
 
@@ -217,9 +218,9 @@ def _on_identity_loaded(sender, identity):
     identity.user = current_user
 
 
-def _get_login_manager(app):
+def _get_login_manager(app, anonymous_user):
     lm = LoginManager()
-    lm.anonymous_user = AnonymousUser
+    lm.anonymous_user = anonymous_user or AnonymousUser
     lm.login_view = '%s.login' % cv('BLUEPRINT_NAME', app=app)
     lm.user_loader(_user_loader)
     lm.token_loader(_token_loader)
@@ -257,14 +258,14 @@ def _get_serializer(app, name):
     return URLSafeTimedSerializer(secret_key=secret_key, salt=salt)
 
 
-def _get_state(app, datastore, **kwargs):
+def _get_state(app, datastore, anonymous_user=None, **kwargs):
     for key, value in get_config(app).items():
         kwargs[key.lower()] = value
 
     kwargs.update(dict(
         app=app,
         datastore=datastore,
-        login_manager=_get_login_manager(app),
+        login_manager=_get_login_manager(app, anonymous_user),
         principal=_get_principal(app),
         pwd_context=_get_pwd_context(app),
         remember_token_serializer=_get_serializer(app, 'remember'),
@@ -272,7 +273,8 @@ def _get_state(app, datastore, **kwargs):
         reset_serializer=_get_serializer(app, 'reset'),
         confirm_serializer=_get_serializer(app, 'confirm'),
         _context_processors={},
-        _send_mail_task=None
+        _send_mail_task=None,
+        _unauthorized_callback=None
     ))
 
     for key, value in _default_forms.items():
@@ -303,6 +305,7 @@ class RoleMixin(object):
 class UserMixin(BaseUserMixin):
     """Mixin for `User` model definitions"""
 
+    @property
     def is_active(self):
         """Returns `True` if the user is active."""
         return self.active
@@ -350,6 +353,9 @@ class _SecurityState(object):
                 rv.update(fn())
         return rv
 
+    def context_processor(self, fn):
+        self._add_ctx_processor(None, fn)
+
     def forgot_password_context_processor(self, fn):
         self._add_ctx_processor('forgot_password', fn)
 
@@ -377,6 +383,9 @@ class _SecurityState(object):
     def send_mail_task(self, fn):
         self._send_mail_task = fn
 
+    def unauthorized_handler(self, fn):
+        self._unauthorized_callback = fn
+
 
 class Security(object):
     """The :class:`Security` class initializes the Flask-Security extension.
@@ -395,7 +404,8 @@ class Security(object):
                  login_form=None, confirm_register_form=None,
                  register_form=None, forgot_password_form=None,
                  reset_password_form=None, change_password_form=None,
-                 send_confirmation_form=None, passwordless_login_form=None):
+                 send_confirmation_form=None, passwordless_login_form=None,
+                 anonymous_user=None):
         """Initializes the Flask-Security extension for the specified
         application and datastore implentation.
 
@@ -421,7 +431,8 @@ class Security(object):
                            reset_password_form=reset_password_form,
                            change_password_form=change_password_form,
                            send_confirmation_form=send_confirmation_form,
-                           passwordless_login_form=passwordless_login_form)
+                           passwordless_login_form=passwordless_login_form,
+                           anonymous_user=anonymous_user)
 
         if register_blueprint:
             app.register_blueprint(create_blueprint(state, __name__))

flask_security/datastore.py

@@ -1,7 +1,7 @@
 # -*- coding: utf-8 -*-
 """
-    flask.ext.security.datastore
+    flask_security.datastore
-    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+    ~~~~~~~~~~~~~~~~~~~~~~~~
 
     This module contains an user datastore classes.
 
@@ -85,7 +85,7 @@ class UserDatastore(object):
         return kwargs
 
     def get_user(self, id_or_email):
-        """Returns a user matching the specified ID or email address"""
+        """Returns a user matching the specified ID or email address."""
         raise NotImplementedError
 
     def find_user(self, *args, **kwargs):
@@ -97,7 +97,7 @@ class UserDatastore(object):
         raise NotImplementedError
 
     def add_role_to_user(self, user, role):
-        """Adds a role tp a user
+        """Adds a role to a user.
 
         :param user: The user to manipulate
         :param role: The role to add to the user
@@ -110,7 +110,7 @@ class UserDatastore(object):
         return False
 
     def remove_role_from_user(self, user, role):
-        """Removes a role from a user
+        """Removes a role from a user.
 
         :param user: The user to manipulate
         :param role: The role to remove from the user
@@ -120,6 +120,7 @@ class UserDatastore(object):
         if role in user.roles:
             rv = True
             user.roles.remove(role)
+            self.put(user)
         return rv
 
     def toggle_active(self, user):
@@ -155,7 +156,7 @@ class UserDatastore(object):
 
     def find_or_create_role(self, name, **kwargs):
         """Returns a role matching the given name or creates it with any
-        additionally provided parameters
+        additionally provided parameters.
         """
         kwargs["name"] = name
         return self.find_role(name) or self.create_role(**kwargs)
@@ -167,7 +168,7 @@ class UserDatastore(object):
         return self.put(user)
 
     def delete_user(self, user):
-        """Delete the specified user
+        """Deletes the specified user.
 
         :param user: The user to delete
         """
@@ -194,7 +195,7 @@ class SQLAlchemyUserDatastore(SQLAlchemyDatastore, UserDatastore):
     def _is_numeric(self, value):
         try:
             int(value)
-        except ValueError:
+        except (TypeError, ValueError):
             return False
         return True
 
@@ -300,7 +301,7 @@ class PeeweeUserDatastore(PeeweeDatastore, UserDatastore):
         return user
 
     def add_role_to_user(self, user, role):
-        """Adds a role tp a user
+        """Adds a role to a user.
 
         :param user: The user to manipulate
         :param role: The role to add to the user
@@ -315,7 +316,7 @@ class PeeweeUserDatastore(PeeweeDatastore, UserDatastore):
             return True
 
     def remove_role_from_user(self, user, role):
-        """Removes a role from a user
+        """Removes a role from a user.
 
         :param user: The user to manipulate
         :param role: The role to remove from the user

flask_security/decorators.py

@@ -1,7 +1,7 @@
 # -*- coding: utf-8 -*-
 """
-    flask.ext.security.decorators
+    flask_security.decorators
-    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+    ~~~~~~~~~~~~~~~~~~~~~~~~~
 
     Flask-Security decorators module
 
@@ -13,8 +13,8 @@ from collections import namedtuple
 from functools import wraps
 
 from flask import current_app, Response, request, redirect, _request_ctx_stack
-from flask.ext.login import current_user, login_required  # pragma: no flakes
+from flask_login import current_user, login_required  # pragma: no flakes
-from flask.ext.principal import RoleNeed, Permission, Identity, identity_changed
+from flask_principal import RoleNeed, Permission, Identity, identity_changed
 from werkzeug.local import LocalProxy
 
 from . import utils
@@ -52,11 +52,12 @@ def _check_token():
     header_token = request.headers.get(header_key, None)
     token = request.args.get(args_key, header_token)
     if request.get_json(silent=True):
-        token = request.json.get(args_key, token)
+        if not isinstance(request.json, list):
+            token = request.json.get(args_key, token)
 
     user = _security.login_manager.token_callback(token)
 
-    if user and user.is_authenticated():
+    if user and user.is_authenticated:
         app = current_app._get_current_object()
         _request_ctx_stack.top.user = user
         identity_changed.send(app, identity=Identity(user.id))
@@ -90,9 +91,12 @@ def http_auth_required(realm):
         def wrapper(*args, **kwargs):
             if _check_http_auth():
                 return fn(*args, **kwargs)
-            r = _security.default_http_auth_realm if callable(realm) else realm
+            if _security._unauthorized_callback:
-            h = {'WWW-Authenticate': 'Basic realm="%s"' % r}
+                return _security._unauthorized_callback()
-            return _get_unauthorized_response(headers=h)
+            else:
+                r = _security.default_http_auth_realm if callable(realm) else realm
+                h = {'WWW-Authenticate': 'Basic realm="%s"' % r}
+                return _get_unauthorized_response(headers=h)
         return wrapper
 
     if callable(realm):
@@ -112,7 +116,10 @@ def auth_token_required(fn):
     def decorated(*args, **kwargs):
         if _check_token():
             return fn(*args, **kwargs)
-        return _get_unauthorized_response()
+        if _security._unauthorized_callback:
+            return _security._unauthorized_callback()
+        else:
+            return _get_unauthorized_response()
     return decorated
 
 
@@ -131,17 +138,24 @@ def auth_required(*auth_methods):
     login_mechanisms = {
         'token': lambda: _check_token(),
         'basic': lambda: _check_http_auth(),
-        'session': lambda: current_user.is_authenticated()
+        'session': lambda: current_user.is_authenticated
     }
 
     def wrapper(fn):
         @wraps(fn)
         def decorated_view(*args, **kwargs):
-            mechanisms = [login_mechanisms.get(method) for method in auth_methods]
+            h = {}
-            for mechanism in mechanisms:
+            mechanisms = [(method, login_mechanisms.get(method)) for method in auth_methods]
+            for method, mechanism in mechanisms:
                 if mechanism and mechanism():
                     return fn(*args, **kwargs)
-            return _get_unauthorized_response()
+                elif method == 'basic':
+                    r = _security.default_http_auth_realm
+                    h['WWW-Authenticate'] = 'Basic realm="%s"' % r
+            if _security._unauthorized_callback:
+                return _security._unauthorized_callback()
+            else:
+                return _get_unauthorized_response(headers=h)
         return decorated_view
     return wrapper
 
@@ -166,7 +180,10 @@ def roles_required(*roles):
             perms = [Permission(RoleNeed(role)) for role in roles]
             for perm in perms:
                 if not perm.can():
-                    return _get_unauthorized_view()
+                    if _security._unauthorized_callback:
+                        return _security._unauthorized_callback()
+                    else:
+                        return _get_unauthorized_view()
             return fn(*args, **kwargs)
         return decorated_view
     return wrapper
@@ -192,7 +209,10 @@ def roles_accepted(*roles):
             perm = Permission(*[RoleNeed(role) for role in roles])
             if perm.can():
                 return fn(*args, **kwargs)
-            return _get_unauthorized_view()
+            if _security._unauthorized_callback:
+                return _security._unauthorized_callback()
+            else:
+                return _get_unauthorized_view()
         return decorated_view
     return wrapper
 
@@ -200,7 +220,7 @@ def roles_accepted(*roles):
 def anonymous_user_required(f):
     @wraps(f)
     def wrapper(*args, **kwargs):
-        if current_user.is_authenticated():
+        if current_user.is_authenticated:
             return redirect(utils.get_url(_security.post_login_view))
         return f(*args, **kwargs)
     return wrapper

flask_security/forms.py

@@ -1,7 +1,7 @@
 # -*- coding: utf-8 -*-
 """
-    flask.ext.security.forms
+    flask_security.forms
-    ~~~~~~~~~~~~~~~~~~~~~~~~
+    ~~~~~~~~~~~~~~~~~~~~
 
     Flask-Security forms module
 
@@ -13,7 +13,7 @@ import inspect
 
 from flask import request, current_app, flash
 from flask_wtf import Form as BaseForm
-from wtforms import TextField, PasswordField, validators, \
+from wtforms import StringField, PasswordField, validators, \
     SubmitField, HiddenField, BooleanField, ValidationError, Field
 from flask_login import current_user
 from werkzeug.local import LocalProxy
@@ -75,13 +75,13 @@ def get_form_field_label(key):
 
 
 def unique_user_email(form, field):
-    if _datastore.find_user(email=field.data) is not None:
+    if _datastore.get_user(field.data) is not None:
         msg = get_message('EMAIL_ALREADY_ASSOCIATED', email=field.data)[0]
         raise ValidationError(msg)
 
 
 def valid_user_email(form, field):
-    form.user = _datastore.find_user(email=field.data)
+    form.user = _datastore.get_user(field.data)
     if form.user is None:
         raise ValidationError(get_message('USER_DOES_NOT_EXIST')[0])
 
@@ -94,20 +94,20 @@ class Form(BaseForm):
 
 
 class EmailFormMixin():
-    email = TextField(
+    email = StringField(
         get_form_field_label('email'),
         validators=[email_required, email_validator])
 
 
 class UserEmailFormMixin():
     user = None
-    email = TextField(
+    email = StringField(
         get_form_field_label('email'),
         validators=[email_required, email_validator, valid_user_email])
 
 
 class UniqueEmailFormMixin():
-    email = TextField(
+    email = StringField(
         get_form_field_label('email'),
         validators=[email_required, email_validator, unique_user_email])
 
@@ -175,6 +175,14 @@ class ForgotPasswordForm(Form, UserEmailFormMixin):
 
     submit = SubmitField(get_form_field_label('recover_password'))
 
+    def validate(self):
+        if not super(ForgotPasswordForm, self).validate():
+            return False
+        if requires_confirmation(self.user):
+            self.email.errors.append(get_message('CONFIRMATION_REQUIRED')[0])
+            return False
+        return True
+
 
 class PasswordlessLoginForm(Form, UserEmailFormMixin):
     """The passwordless login form"""
@@ -187,7 +195,7 @@ class PasswordlessLoginForm(Form, UserEmailFormMixin):
     def validate(self):
         if not super(PasswordlessLoginForm, self).validate():
             return False
-        if not self.user.is_active():
+        if not self.user.is_active:
             self.email.errors.append(get_message('DISABLED_ACCOUNT')[0])
             return False
         return True
@@ -196,7 +204,7 @@ class PasswordlessLoginForm(Form, UserEmailFormMixin):
 class LoginForm(Form, NextFormMixin):
     """The default login form"""
 
-    email = TextField(get_form_field_label('email'))
+    email = StringField(get_form_field_label('email'))
     password = PasswordField(get_form_field_label('password'))
     remember = BooleanField(get_form_field_label('remember_me'))
     submit = SubmitField(get_form_field_label('login'))
@@ -233,7 +241,7 @@ class LoginForm(Form, NextFormMixin):
         if requires_confirmation(self.user):
             self.email.errors.append(get_message('CONFIRMATION_REQUIRED')[0])
             return False
-        if not self.user.is_active():
+        if not self.user.is_active:
             self.email.errors.append(get_message('DISABLED_ACCOUNT')[0])
             return False
         return True
@@ -244,8 +252,12 @@ class ConfirmRegisterForm(Form, RegisterFormMixin,
     pass
 
 
-class RegisterForm(ConfirmRegisterForm, PasswordConfirmFormMixin):
+class RegisterForm(ConfirmRegisterForm, PasswordConfirmFormMixin,
-    pass
+                   NextFormMixin):
+    def __init__(self, *args, **kwargs):
+        super(RegisterForm, self).__init__(*args, **kwargs)
+        if not self.next.data:
+            self.next.data = request.args.get('next', '')
 
 
 class ResetPasswordForm(Form, NewPasswordFormMixin, PasswordConfirmFormMixin):

flask_security/passwordless.py

@@ -1,7 +1,7 @@
 # -*- coding: utf-8 -*-
 """
-    flask.ext.security.passwordless
+    flask_security.passwordless
-    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
     Flask-Security passwordless module
 
@@ -35,8 +35,7 @@ def send_login_instructions(user):
     send_mail(config_value('EMAIL_SUBJECT_PASSWORDLESS'), user.email,
               'login_instructions', user=user, login_link=login_link)
 
-    login_instructions_sent.send(app._get_current_object(),
+    login_instructions_sent.send(app._get_current_object(), user=user, login_token=token)
-                                 user=user, login_token=token)
 
 
 def generate_login_token(user):

flask_security/recoverable.py

@@ -1,7 +1,7 @@
 # -*- coding: utf-8 -*-
 """
-    flask.ext.security.recoverable
+    flask_security.recoverable
-    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~
 
     Flask-Security recoverable module
 
@@ -11,6 +11,7 @@
 
 from flask import current_app as app
 from werkzeug.local import LocalProxy
+from werkzeug.security import safe_str_cmp
 
 from .signals import password_reset, reset_password_instructions_sent
 from .utils import send_mail, md5, encrypt_password, url_for_security, \
@@ -35,8 +36,7 @@ def send_reset_password_instructions(user):
               'reset_instructions',
               user=user, reset_link=reset_link)
 
-    reset_password_instructions_sent.send(app._get_current_object(),
+    reset_password_instructions_sent.send(app._get_current_object(), user=user, token=token)
-                                          user=user, token=token)
 
 
 def send_password_reset_notice(user):
@@ -54,7 +54,8 @@ def generate_reset_password_token(user):
 
     :param user: The user to work with
     """
-    data = [str(user.id), md5(user.password)]
+    password_hash = md5(user.password) if user.password else None
+    data = [str(user.id), password_hash]
     return _security.reset_serializer.dumps(data)
 
 
@@ -62,11 +63,19 @@ def reset_password_token_status(token):
     """Returns the expired status, invalid status, and user of a password reset
     token. For example::
 
-        expired, invalid, user = reset_password_token_status('...')
+        expired, invalid, user, data = reset_password_token_status('...')
 
     :param token: The password reset token
     """
-    return get_token_status(token, 'reset', 'RESET_PASSWORD')
+    expired, invalid, user, data = get_token_status(token, 'reset', 'RESET_PASSWORD',
+                                                    return_data=True)
+    if not invalid:
+        if user.password:
+            password_hash = md5(user.password)
+            if not safe_str_cmp(password_hash, data[1]):
+                invalid = True
+
+    return expired, invalid, user
 
 
 def update_password(user, password):

flask_security/registerable.py

@@ -1,7 +1,7 @@
 # -*- coding: utf-8 -*-
 """
-    flask.ext.security.registerable
+    flask_security.registerable
-    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
     Flask-Security registerable module
 

flask_security/script.py

@@ -1,7 +1,7 @@
 # -*- coding: utf-8 -*-
 """
-    flask.ext.security.script
+    flask_security.script
-    ~~~~~~~~~~~~~~~~~~~~~~~~~
+    ~~~~~~~~~~~~~~~~~~~~~
 
     Flask-Security script module
 
@@ -18,7 +18,7 @@ except ImportError:
 import re
 
 from flask import current_app
-from flask.ext.script import Command, Option
+from flask_script import Command, Option
 from werkzeug.local import LocalProxy
 
 from .utils import encrypt_password
@@ -100,7 +100,7 @@ class AddRoleCommand(_RoleCommand):
 
 
 class RemoveRoleCommand(_RoleCommand):
-    """Add a role to a user"""
+    """Remove a role from a user"""
 
     @commit
     def run(self, user_identifier, role_name):
@@ -115,7 +115,7 @@ class _ToggleActiveCommand(Command):
 
 
 class DeactivateUserCommand(_ToggleActiveCommand):
-    """Deactive a user"""
+    """Deactivate a user"""
 
     @commit
     def run(self, user_identifier):
@@ -124,7 +124,7 @@ class DeactivateUserCommand(_ToggleActiveCommand):
 
 
 class ActivateUserCommand(_ToggleActiveCommand):
-    """Deactive a user"""
+    """Activate a user"""
 
     @commit
     def run(self, user_identifier):

flask_security/signals.py

@@ -1,7 +1,7 @@
 # -*- coding: utf-8 -*-
 """
-    flask.ext.security.signals
+    flask_security.signals
-    ~~~~~~~~~~~~~~~~~~~~~~~~~~
+    ~~~~~~~~~~~~~~~~~~~~~~
 
     Flask-Security signals module
 

flask_security/templates/security/_menu.html

@@ -1,9 +1,9 @@
-{% if security.registerable or security.recoverable or security.confirmabled %}
+{% if security.registerable or security.recoverable or security.confirmable %}
 <h2>Menu</h2>
 <ul>
-  <li><a href="{{ url_for_security('login') }}">Login</a></li>
+  <li><a href="{{ url_for_security('login') }}{% if 'next' in request.args %}?next={{ request.args.next|urlencode }}{% endif %}">Login</a></li>
   {% if security.registerable %}
-  <li><a href="{{ url_for_security('register') }}">Register</a><br/></li>
+  <li><a href="{{ url_for_security('register') }}{% if 'next' in request.args %}?next={{ request.args.next|urlencode }}{% endif %}">Register</a><br/></li>
   {% endif %}
   {% if security.recoverable %}
   <li><a href="{{ url_for_security('forgot_password') }}">Forgot password</a><br/></li>

flask_security/utils.py

@@ -1,7 +1,7 @@
 # -*- coding: utf-8 -*-
 """
-    flask.ext.security.utils
+    flask_security.utils
-    ~~~~~~~~~~~~~~~~~~~~~~~~
+    ~~~~~~~~~~~~~~~~~~~~
 
     Flask-Security utils module
 
@@ -23,9 +23,9 @@ from contextlib import contextmanager
 from datetime import datetime, timedelta
 
 from flask import url_for, flash, current_app, request, session, render_template
-from flask.ext.login import login_user as _login_user, logout_user as _logout_user
+from flask_login import login_user as _login_user, logout_user as _logout_user
-from flask.ext.mail import Message
+from flask_mail import Message
-from flask.ext.principal import Identity, AnonymousIdentity, identity_changed
+from flask_principal import Identity, AnonymousIdentity, identity_changed
 from itsdangerous import BadSignature, SignatureExpired
 from werkzeug.local import LocalProxy
 
@@ -62,10 +62,10 @@ def login_user(user, remember=None):
         return False
 
     if _security.trackable:
-        if 'X-Forwarded-For' not in request.headers:
+        if 'X-Forwarded-For' in request.headers:
-            remote_addr = request.remote_addr or 'untrackable'
+            remote_addr = request.headers.getlist("X-Forwarded-For")[0].rpartition(' ')[-1]
         else:
-            remote_addr = request.headers.getlist("X-Forwarded-For")[0]
+            remote_addr = request.remote_addr or 'untrackable'
 
         old_current_login, new_current_login = user.current_login_at, datetime.utcnow()
         old_current_ip, new_current_ip = user.current_login_ip, remote_addr
@@ -115,7 +115,7 @@ def verify_password(password, password_hash):
     """Returns ``True`` if the password matches the supplied hash.
 
     :param password: A plaintext password to verify
-    :param password_hash: The expected hash value of the password (usually form your database)
+    :param password_hash: The expected hash value of the password (usually from your database)
     """
     if _security.password_hash != 'plaintext':
         password = get_hmac(password)
@@ -135,7 +135,7 @@ def verify_and_update_password(password, user):
         password = get_hmac(password)
     verified, new_password = _pwd_context.verify_and_update(password, user.password)
     if verified and new_password:
-        user.password = new_password
+        user.password = encrypt_password(password)
         _datastore.put(user)
     return verified
 
@@ -143,7 +143,7 @@ def verify_and_update_password(password, user):
 def encrypt_password(password):
     """Encrypts the specified plaintext password using the configured encryption options.
 
-    :param password: The plaintext passwrod to encrypt
+    :param password: The plaintext password to encrypt
     """
     if _security.password_hash == 'plaintext':
         return password
@@ -188,6 +188,14 @@ def get_url(endpoint_or_url):
         return endpoint_or_url
 
 
+def slash_url_suffix(url, suffix):
+    """Adds a slash either to the beginning or the end of a suffix
+    (which is to be appended to a URL), depending on whether or not
+    the URL ends with a slash."""
+
+    return url.endswith('/') and ('%s/' % suffix) or ('/%s' % suffix)
+
+
 def get_security_endpoint_name(endpoint):
     return '%s.%s' % (_security.blueprint_name, endpoint)
 
@@ -212,7 +220,7 @@ def validate_redirect_url(url):
         return False
     url_next = urlsplit(url)
     url_base = urlsplit(request.host_url)
-    if url_next.netloc and url_next.netloc != url_base.netloc:
+    if (url_next.netloc or url_next.scheme) and url_next.netloc != url_base.netloc:
         return False
     return True
 
@@ -234,8 +242,8 @@ def get_post_login_redirect(declared=None):
     return get_post_action_redirect('SECURITY_POST_LOGIN_VIEW', declared)
 
 
-def get_post_register_redirect():
+def get_post_register_redirect(declared=None):
-    return get_post_action_redirect('SECURITY_POST_REGISTER_VIEW')
+    return get_post_action_redirect('SECURITY_POST_REGISTER_VIEW', declared)
 
 
 def find_redirect(key):
@@ -333,7 +341,7 @@ def send_mail(subject, recipient, template, **context):
     mail.send(msg)
 
 
-def get_token_status(token, serializer, max_age=None):
+def get_token_status(token, serializer, max_age=None, return_data=False):
     """Get the status of a token.
 
     :param token: The token to check
@@ -359,7 +367,11 @@ def get_token_status(token, serializer, max_age=None):
         user = _datastore.find_user(id=data[0])
 
     expired = expired and (user is not None)
-    return expired, invalid, user
+
+    if return_data:
+        return expired, invalid, user, data
+    else:
+        return expired, invalid, user
 
 
 def get_identity_attributes(app=None):

flask_security/views.py

@@ -1,7 +1,7 @@
 # -*- coding: utf-8 -*-
 """
-    flask.ext.security.views
+    flask_security.views
-    ~~~~~~~~~~~~~~~~~~~~~~~~
+    ~~~~~~~~~~~~~~~~~~~~
 
     Flask-Security views module
 
@@ -26,7 +26,7 @@ from .changeable import change_user_password
 from .registerable import register_user
 from .utils import config_value, do_flash, get_url, get_post_login_redirect, \
     get_post_register_redirect, get_message, login_user, logout_user, \
-    url_for_security as url_for
+    url_for_security as url_for, slash_url_suffix
 
 # Convenient references
 _security = LocalProxy(lambda: current_app.extensions['security'])
@@ -90,7 +90,7 @@ def login():
 def logout():
     """View function which handles a logout request."""
 
-    if current_user.is_authenticated():
+    if current_user.is_authenticated:
         logout_user()
 
     return redirect(request.args.get('next', None) or
@@ -122,7 +122,12 @@ def register():
             login_user(user)
 
         if not request.json:
-            return redirect(get_post_register_redirect())
+            if 'next' in form:
+                redirect_url = get_post_register_redirect(form.next.data)
+            else:
+                redirect_url = get_post_register_redirect()
+
+            return redirect(redirect_url)
         return _render_json(form, include_auth_token=True)
 
     if request.json:
@@ -233,6 +238,7 @@ def confirm_email(token):
                     get_url(_security.post_login_view))
 
 
+@anonymous_user_required
 def forgot_password():
     """View function that handles a forgotten password request."""
 
@@ -328,7 +334,7 @@ def create_blueprint(state, import_name):
         bp.route(state.login_url,
                  methods=['GET', 'POST'],
                  endpoint='login')(send_login)
-        bp.route(state.login_url + '/<token>',
+        bp.route(state.login_url + slash_url_suffix(state.login_url, '<token>'),
                  endpoint='token_login')(token_login)
     else:
         bp.route(state.login_url,
@@ -344,7 +350,7 @@ def create_blueprint(state, import_name):
         bp.route(state.reset_url,
                  methods=['GET', 'POST'],
                  endpoint='forgot_password')(forgot_password)
-        bp.route(state.reset_url + '/<token>',
+        bp.route(state.reset_url + slash_url_suffix(state.reset_url, '<token>'),
                  methods=['GET', 'POST'],
                  endpoint='reset_password')(reset_password)
 
@@ -357,7 +363,7 @@ def create_blueprint(state, import_name):
         bp.route(state.confirm_url,
                  methods=['GET', 'POST'],
                  endpoint='send_confirmation')(send_confirmation)
-        bp.route(state.confirm_url + '/<token>',
+        bp.route(state.confirm_url + slash_url_suffix(state.confirm_url, '<token>'),
                  methods=['GET', 'POST'],
                  endpoint='confirm_email')(confirm_email)
 

requirements-dev.txt

@@ -1,9 +1,9 @@
 Flask-SQLAlchemy>=1.0
-bcrypt>=1.0.2
+bcrypt>=1.0.2,<2.0.0
-flask-mongoengine>=0.7.0
+flask-mongoengine>=0.7.0,<0.7.3
 flask-peewee>=0.6.5
+pymongo==2.8
 pytest>=2.5.2
-pytest-cache>=1.0
 pytest-cov>=1.6
 pytest-flakes>=0.2
 pytest-pep8>=1.0.5

requirements.txt

@@ -1,5 +1,5 @@
 Flask>=0.9
-Flask-Login>=0.1.3
+Flask-Login>=0.3.0,<0.4
 Flask-Mail>=0.7.3
 Flask-Principal>=0.3.3
 Flask-WTF>=0.8

setup.py

@@ -32,7 +32,7 @@ class PyTest(TestCommand):
             '--cov-report', 'term-missing',
             '--pep8',
             '--flakes',
-            '--clearcache'
+            '--cache-clear'
         ]
         self.test_suite = True
 
@@ -44,7 +44,7 @@ class PyTest(TestCommand):
 
 setup(
     name='Flask-Security',
-    version='1.7.3',
+    version='1.7.5',
     url='https://github.com/mattupstate/flask-security',
     license='MIT',
     author='Matt Wright',

tests/templates/_nav.html

@@ -1,4 +1,4 @@
-{%- if current_user.is_authenticated() -%}
+{%- if current_user.is_authenticated -%}
   <p>Hello {{ current_user.email }}</p>
 {%- endif %}
 <ul>
@@ -11,7 +11,7 @@
   <li><a href="{{ url_for('admin_or_editor') }}">Admin or Editor</a></li>
   {% endif -%}
   <li>
-    {%- if current_user.is_authenticated() -%}
+    {%- if current_user.is_authenticated -%}
       <a href="{{ url_for('security.logout') }}">Log out</a>
     {%- else -%}
       <a href="{{ url_for('security.login') }}">Log in</a>

tests/templates/custom_security/change_password.html

@@ -1,3 +1,3 @@
 CUSTOM CHANGE PASSWORD
-
+{{ global }}
 {{ foo }}

tests/templates/custom_security/forgot_password.html

@@ -1,3 +1,3 @@
 CUSTOM FORGOT PASSWORD
-
+{{ global }}
 {{ foo }}

tests/templates/custom_security/login_user.html

@@ -1,3 +1,3 @@
 CUSTOM LOGIN USER
-
+{{ global }}
 {{ foo }}

tests/templates/custom_security/register_user.html

@@ -1,3 +1,3 @@
 CUSTOM REGISTER USER
-
+{{ global }}
 {{ foo }}

tests/templates/custom_security/reset_password.html

@@ -1,3 +1,3 @@
 CUSTOM RESET PASSWORD
-
+{{ global }}
 {{ foo }}

tests/templates/custom_security/send_confirmation.html

@@ -1,3 +1,3 @@
 CUSTOM SEND CONFIRMATION
-
+{{ global }}
 {{ foo }}

tests/templates/custom_security/send_login.html

@@ -1,3 +1,3 @@
 CUSTOM SEND LOGIN
-
+{{ global }}
 {{ foo }}

tests/templates/security/email/reset_instructions.html

@@ -1,3 +1,3 @@
 CUSTOM RESET INSTRUCTIONS
-
+{{ global }}
 {{ foo }}

tests/test_changeable.py

@@ -8,6 +8,8 @@
 
 import pytest
 
+from flask import Flask
+from flask_security.core import UserMixin
 from flask_security.signals import password_changed
 
 from utils import authenticate
@@ -20,6 +22,8 @@ def test_recoverable_flag(app, client, get_message):
 
     @password_changed.connect_via(app)
     def on_password_changed(app, user):
+        assert isinstance(app, Flask)
+        assert isinstance(user, UserMixin)
         recorded.append(user)
 
     authenticate(client)

tests/test_common.py

@@ -40,6 +40,12 @@ def test_authenticate_with_invalid_next(client, get_message):
     assert get_message('INVALID_REDIRECT') in response.data
 
 
+def test_authenticate_with_invalid_malformed_next(client, get_message):
+    data = dict(email='matt@lp.com', password='password')
+    response = client.post('/login?next=http:///google.com', data=data)
+    assert get_message('INVALID_REDIRECT') in response.data
+
+
 def test_authenticate_case_insensitive_email(app, client):
     response = authenticate(client, 'MATT@lp.com', follow_redirects=True)
     assert b'Hello matt@lp.com' in response.data
@@ -220,6 +226,19 @@ def test_multi_auth_basic(client):
     assert response.status_code == 401
 
 
+def test_multi_auth_basic_invalid(client):
+    response = client.get('/multi_auth', headers={
+        'Authorization': 'Basic %s' % base64.b64encode(b"bogus:bogus").decode('utf-8')
+    })
+    assert b'<h1>Unauthorized</h1>' in response.data
+    assert 'WWW-Authenticate' in response.headers
+    assert 'Basic realm="Login Required"' == response.headers['WWW-Authenticate']
+
+    response = client.get('/multi_auth')
+    print(response.headers)
+    assert response.status_code == 401
+
+
 def test_multi_auth_token(client):
     response = json_authenticate(client)
     token = response.jdata['response']['user']['authentication_token']

tests/test_confirmable.py

@@ -10,6 +10,8 @@ import time
 
 import pytest
 
+from flask import Flask
+from flask_security.core import UserMixin
 from flask_security.signals import user_confirmed, confirm_instructions_sent
 from flask_security.utils import capture_registrations
 
@@ -25,17 +27,22 @@ def test_confirmable_flag(app, client, sqlalchemy_datastore, get_message):
 
     @user_confirmed.connect_via(app)
     def on_confirmed(app, user):
+        assert isinstance(app, Flask)
+        assert isinstance(user, UserMixin)
         recorded_confirms.append(user)
 
     @confirm_instructions_sent.connect_via(app)
     def on_instructions_sent(app, user):
+        assert isinstance(app, Flask)
+        assert isinstance(user, UserMixin)
         recorded_instructions_sent.append(user)
 
     # Test login before confirmation
     email = 'dude@lp.com'
 
     with capture_registrations() as registrations:
-        response = client.post('/register', data=dict(email=email, password='password'))
+        data = dict(email=email, password='password', next='')
+        response = client.post('/register', data=data)
 
     assert response.status_code == 302
 
@@ -85,7 +92,8 @@ def test_confirmable_flag(app, client, sqlalchemy_datastore, get_message):
 
     # Test user was deleted before confirmation
     with capture_registrations() as registrations:
-        client.post('/register', data=dict(email='mary@lp.com', password='password'))
+        data = dict(email='mary@lp.com', password='password', next='')
+        client.post('/register', data=data)
 
     user = registrations[0]['user']
     token = registrations[0]['confirm_token']
@@ -102,7 +110,7 @@ def test_confirmable_flag(app, client, sqlalchemy_datastore, get_message):
 @pytest.mark.settings(confirm_email_within='1 milliseconds')
 def test_expired_confirmation_token(client, get_message):
     with capture_registrations() as registrations:
-        data = dict(email='mary@lp.com', password='password')
+        data = dict(email='mary@lp.com', password='password', next='')
         client.post('/register', data=data, follow_redirects=True)
 
     user = registrations[0]['user']
@@ -118,7 +126,7 @@ def test_expired_confirmation_token(client, get_message):
 @pytest.mark.registerable()
 @pytest.mark.settings(login_without_confirmation=True)
 def test_login_when_unconfirmed(client, get_message):
-    data = dict(email='mary@lp.com', password='password')
+    data = dict(email='mary@lp.com', password='password', next='')
     response = client.post('/register', data=data, follow_redirects=True)
     assert b'mary@lp.com' in response.data
 
@@ -131,7 +139,8 @@ def test_confirmation_different_user_when_logged_in(client, get_message):
 
     with capture_registrations() as registrations:
         for e in e1, e2:
-            client.post('/register', data=dict(email=e, password='password'))
+            data = dict(email=e, password='password', next='')
+            client.post('/register', data=data)
             logout(client)
 
     token1 = registrations[0]['confirm_token']
@@ -144,3 +153,15 @@ def test_confirmation_different_user_when_logged_in(client, get_message):
     response = client.get('/confirm/' + token2, follow_redirects=True)
     assert get_message('EMAIL_CONFIRMED') in response.data
     assert b'Hello lady@lp.com' in response.data
+
+
+@pytest.mark.registerable()
+@pytest.mark.settings(recoverable=True)
+def test_cannot_reset_password_when_email_is_not_confirmed(client, get_message):
+    email = 'dude@lp.com'
+
+    data = dict(email=email, password='password', next='')
+    response = client.post('/register', data=data, follow_redirects=True)
+
+    response = client.post('/reset', data=dict(email=email), follow_redirects=True)
+    assert get_message('CONFIRMATION_REQUIRED') in response.data

tests/test_context_processors.py

@@ -24,11 +24,16 @@ from utils import authenticate
     send_confirmation_template='custom_security/send_confirmation.html',
     register_user_template='custom_security/register_user.html')
 def test_context_processors(client, app):
+    @app.security.context_processor
+    def default_ctx_processor():
+        return {'global': 'global'}
+
     @app.security.forgot_password_context_processor
     def forgot_password():
         return {'foo': 'bar'}
 
     response = client.get('/reset')
+    assert b'global' in response.data
     assert b'bar' in response.data
 
     @app.security.login_context_processor
@@ -36,6 +41,7 @@ def test_context_processors(client, app):
         return {'foo': 'bar'}
 
     response = client.get('/login')
+    assert b'global' in response.data
     assert b'bar' in response.data
 
     @app.security.register_context_processor
@@ -43,6 +49,7 @@ def test_context_processors(client, app):
         return {'foo': 'bar'}
 
     response = client.get('/register')
+    assert b'global' in response.data
     assert b'bar' in response.data
 
     @app.security.reset_password_context_processor
@@ -50,6 +57,7 @@ def test_context_processors(client, app):
         return {'foo': 'bar'}
 
     response = client.get('/reset')
+    assert b'global' in response.data
     assert b'bar' in response.data
 
     @app.security.change_password_context_processor
@@ -58,6 +66,7 @@ def test_context_processors(client, app):
 
     authenticate(client)
     response = client.get('/change')
+    assert b'global' in response.data
     assert b'bar' in response.data
 
     @app.security.send_confirmation_context_processor
@@ -65,16 +74,20 @@ def test_context_processors(client, app):
         return {'foo': 'bar'}
 
     response = client.get('/confirm')
+    assert b'global' in response.data
     assert b'bar' in response.data
 
     @app.security.mail_context_processor
     def mail():
         return {'foo': 'bar'}
 
+    client.get('/logout')
+
     with app.mail.record_messages() as outbox:
         client.post('/reset', data=dict(email='matt@lp.com'))
 
     email = outbox[0]
+    assert 'global' in email.html
     assert 'bar' in email.html
 
 

tests/test_misc.py

@@ -11,7 +11,8 @@ import pytest
 from flask_security import Security
 from flask_security.forms import LoginForm, RegisterForm, ConfirmRegisterForm, \
     SendConfirmationForm, PasswordlessLoginForm, ForgotPasswordForm, ResetPasswordForm, \
-    ChangePasswordForm, TextField, PasswordField, email_required, email_validator, valid_user_email
+    ChangePasswordForm, StringField, PasswordField, email_required, email_validator, \
+    valid_user_email
 from flask_security.utils import capture_reset_password_requests, md5, string_types
 
 from utils import authenticate, init_app_with_options, populate_data
@@ -41,17 +42,17 @@ def test_register_blueprint_flag(app, sqlalchemy_datastore):
 @pytest.mark.changeable()
 def test_basic_custom_forms(app, sqlalchemy_datastore):
     class MyLoginForm(LoginForm):
-        email = TextField('My Login Email Address Field')
+        email = StringField('My Login Email Address Field')
 
     class MyRegisterForm(RegisterForm):
-        email = TextField('My Register Email Address Field')
+        email = StringField('My Register Email Address Field')
 
     class MyForgotPasswordForm(ForgotPasswordForm):
-        email = TextField('My Forgot Email Address Field',
+        email = StringField('My Forgot Email Address Field',
-                          validators=[email_required, email_validator, valid_user_email])
+                            validators=[email_required, email_validator, valid_user_email])
 
     class MyResetPasswordForm(ResetPasswordForm):
-        password = TextField('My Reset Password Field')
+        password = StringField('My Reset Password Field')
 
     class MyChangePasswordForm(ChangePasswordForm):
         password = PasswordField('My Change Password Field')
@@ -96,10 +97,10 @@ def test_confirmable_custom_form(app, sqlalchemy_datastore):
     app.config['SECURITY_CONFIRMABLE'] = True
 
     class MyRegisterForm(ConfirmRegisterForm):
-        email = TextField('My Register Email Address Field')
+        email = StringField('My Register Email Address Field')
 
     class MySendConfirmationForm(SendConfirmationForm):
-        email = TextField('My Send Confirmation Email Address Field')
+        email = StringField('My Send Confirmation Email Address Field')
 
     app.security = Security(app,
                             datastore=sqlalchemy_datastore,
@@ -119,7 +120,7 @@ def test_passwordless_custom_form(app, sqlalchemy_datastore):
     app.config['SECURITY_PASSWORDLESS'] = True
 
     class MyPasswordlessLoginForm(PasswordlessLoginForm):
-        email = TextField('My Passwordless Email Address Field')
+        email = StringField('My Passwordless Email Address Field')
 
     app.security = Security(app,
                             datastore=sqlalchemy_datastore,
@@ -171,6 +172,11 @@ def test_change_hash_type(app, sqlalchemy_datastore):
     response = client.post('/login', data=dict(email='matt@lp.com', password='password'))
     assert response.status_code == 302
 
+    response = client.get('/logout')
+
+    response = client.post('/login', data=dict(email='matt@lp.com', password='password'))
+    assert response.status_code == 302
+
 
 def test_md5():
     data = md5(b'hello')
@@ -186,3 +192,19 @@ def test_password_unicode_password_salt(client):
     assert response.status_code == 302
     response = authenticate(client, follow_redirects=True)
     assert b'Hello matt@lp.com' in response.data
+
+
+def test_set_unauthorized_handler(app, client):
+    @app.security.unauthorized_handler
+    def unauthorized():
+        app.unauthorized_handler_set = True
+        return 'unauthorized-handler-set', 401
+
+    app.unauthorized_handler_set = False
+
+    authenticate(client, "joe@lp.com")
+    response = client.get("/admin", follow_redirects=True)
+
+    assert app.unauthorized_handler_set is True
+    assert b'unauthorized-handler-set' in response.data
+    assert response.status_code == 401

tests/test_passwordless.py

@@ -10,8 +10,10 @@ import time
 
 import pytest
 
+from flask import Flask
+from flask_security.core import UserMixin
 from flask_security.signals import login_instructions_sent
-from flask_security.utils import capture_passwordless_login_requests
+from flask_security.utils import capture_passwordless_login_requests, string_types
 
 from utils import logout
 
@@ -23,6 +25,9 @@ def test_trackable_flag(app, client, get_message):
 
     @login_instructions_sent.connect_via(app)
     def on_instructions_sent(app, user, login_token):
+        assert isinstance(app, Flask)
+        assert isinstance(user, UserMixin)
+        assert isinstance(login_token, string_types)
         recorded.append(user)
 
     # Test disabled account

tests/test_recoverable.py

@@ -10,8 +10,10 @@ import time
 
 import pytest
 
+from flask import Flask
+from flask_security.core import UserMixin
 from flask_security.signals import reset_password_instructions_sent, password_reset
-from flask_security.utils import capture_reset_password_requests
+from flask_security.utils import capture_reset_password_requests, string_types
 
 from utils import authenticate, logout
 
@@ -28,6 +30,9 @@ def test_recoverable_flag(app, client, get_message):
 
     @reset_password_instructions_sent.connect_via(app)
     def on_instructions_sent(app, user, token):
+        assert isinstance(app, Flask)
+        assert isinstance(user, UserMixin)
+        assert isinstance(token, string_types)
         recorded_instructions_sent.append(user)
 
     # Test the reset view
@@ -117,6 +122,47 @@ def test_expired_reset_token(client, get_message):
     assert msg in response.data
 
 
+def test_used_reset_token(client, get_message):
+    with capture_reset_password_requests() as requests:
+        client.post('/reset', data=dict(email='joe@lp.com'), follow_redirects=True)
+
+    token = requests[0]['token']
+
+    # use the token
+    response = client.post('/reset/' + token, data={
+        'password': 'newpassword',
+        'password_confirm': 'newpassword'
+    }, follow_redirects=True)
+
+    assert get_message('PASSWORD_RESET') in response.data
+
+    logout(client)
+
+    # attempt to use it a second time
+    response2 = client.post('/reset/' + token, data={
+        'password': 'otherpassword',
+        'password_confirm': 'otherpassword'
+    }, follow_redirects=True)
+
+    msg = get_message('INVALID_RESET_PASSWORD_TOKEN')
+    assert msg in response2.data
+
+
+def test_reset_passwordless_user(client, get_message):
+    with capture_reset_password_requests() as requests:
+        client.post('/reset', data=dict(email='jess@lp.com'), follow_redirects=True)
+
+    token = requests[0]['token']
+
+    # use the token
+    response = client.post('/reset/' + token, data={
+        'password': 'newpassword',
+        'password_confirm': 'newpassword'
+    }, follow_redirects=True)
+
+    assert get_message('PASSWORD_RESET') in response.data
+
+
 @pytest.mark.settings(reset_url='/custom_reset')
 def test_custom_reset_url(client):
     response = client.get('/custom_reset')

tests/test_registerable.py

@@ -8,6 +8,8 @@
 
 import pytest
 
+from flask import Flask
+from flask_security.core import UserMixin
 from flask_security.signals import user_registered
 
 from utils import authenticate, logout
@@ -26,9 +28,15 @@ def test_registerable_flag(client, app, get_message):
     # Test registering is successful, sends email, and fires signal
     @user_registered.connect_via(app)
     def on_user_registerd(app, user, confirm_token):
+        assert isinstance(app, Flask)
+        assert isinstance(user, UserMixin)
+        assert confirm_token is None
         recorded.append(user)
 
-    data = dict(email='dude@lp.com', password='password', password_confirm='password')
+    data = dict(
+        email='dude@lp.com', password='password', password_confirm='password',
+        next=''
+    )
     with app.mail.record_messages() as outbox:
         response = client.post('/register', data=data, follow_redirects=True)
 
@@ -45,10 +53,21 @@ def test_registerable_flag(client, app, get_message):
     logout(client)
 
     # Test registering with an existing email
-    data = dict(email='dude@lp.com', password='password', password_confirm='password')
+    data = dict(
+        email='dude@lp.com', password='password', password_confirm='password',
+        next=''
+    )
     response = client.post('/register', data=data, follow_redirects=True)
     assert get_message('EMAIL_ALREADY_ASSOCIATED', email='dude@lp.com') in response.data
 
+    # Test registering with an existing email but case insensitive
+    data = dict(
+        email='Dude@lp.com', password='password', password_confirm='password',
+        next=''
+    )
+    response = client.post('/register', data=data, follow_redirects=True)
+    assert get_message('EMAIL_ALREADY_ASSOCIATED', email='Dude@lp.com') in response.data
+
     # Test registering with JSON
     data = '{ "email": "dude2@lp.com", "password": "password"}'
     response = client.post('/register', data=data, headers={'Content-Type': 'application/json'})
@@ -68,7 +87,8 @@ def test_registerable_flag(client, app, get_message):
     # Test ?next param
     data = dict(email='dude3@lp.com',
                 password='password',
-                password_confirm='password')
+                password_confirm='password',
+                next='')
 
     response = client.post('/register?next=/page1', data=data, follow_redirects=True)
     assert b'Page 1' in response.data
@@ -81,7 +101,8 @@ def test_custom_register_url(client):
 
     data = dict(email='dude@lp.com',
                 password='password',
-                password_confirm='password')
+                password_confirm='password',
+                next='')
 
     response = client.post('/custom_register', data=data, follow_redirects=True)
     assert b'Post Register' in response.data
@@ -95,7 +116,10 @@ def test_custom_register_tempalate(client):
 
 @pytest.mark.settings(send_register_email=False)
 def test_disable_register_emails(client, app):
-    data = dict(email='dude@lp.com', password='password', password_confirm='password')
+    data = dict(
+        email='dude@lp.com', password='password', password_confirm='password',
+        next=''
+    )
     with app.mail.record_messages() as outbox:
         client.post('/register', data=data, follow_redirects=True)
     assert len(outbox) == 0

tests/test_trackable.py

@@ -26,3 +26,19 @@ def test_trackable_flag(app, client):
         assert user.last_login_ip == 'untrackable'
         assert user.current_login_ip == '127.0.0.1'
         assert user.login_count == 2
+
+
+def test_trackable_with_multiple_ips_in_headers(app, client):
+    e = 'matt@lp.com'
+    authenticate(client, email=e)
+    logout(client)
+    authenticate(client, email=e, headers={
+        'X-Forwarded-For': '99.99.99.99, 88.88.88.88'})
+
+    with app.app_context():
+        user = app.security.datastore.find_user(email=e)
+        assert user.last_login_at is not None
+        assert user.current_login_at is not None
+        assert user.last_login_ip == 'untrackable'
+        assert user.current_login_ip == '88.88.88.88'
+        assert user.login_count == 2

tox.ini

@@ -1,5 +1,5 @@
 [tox]
-envlist = py26, py27, py33, py34, pypy
+envlist = py26, py27, py33, py34, py35, pypy
 
 [testenv]
 deps =