diff --git a/app/auth/forms.py b/app/auth/forms.py index de82c48..17ca675 100644 --- a/app/auth/forms.py +++ b/app/auth/forms.py @@ -42,3 +42,16 @@ class ChangePasswordForm(FlaskForm): password2 = PasswordField('Confirm new password', validators=[DataRequired()]) submit = SubmitField('Update password') + + +class PasswordResetRequestForm(FlaskForm): + email = StringField('Email', validators=[DataRequired(), Length(1, 64), + Email()]) + submit = SubmitField('Reset password') + + +class PasswordResetForm(FlaskForm): + password = PasswordField('New password', validators=[ + DataRequired(), EqualTo('password2', message='Passwords must match.')]) + password2 = PasswordField('Confirm password', validators=[DataRequired()]) + submit = SubmitField('Reset password') diff --git a/app/auth/views.py b/app/auth/views.py index a060c52..fbc90d4 100644 --- a/app/auth/views.py +++ b/app/auth/views.py @@ -4,7 +4,8 @@ from . import auth from .. import db from ..models import User from ..email import send_email -from .forms import LoginForm, RegistrationForm, ChangePasswordForm +from .forms import LoginForm, RegistrationForm, ChangePasswordForm, \ + PasswordResetRequestForm, PasswordResetForm @auth.before_app_request @@ -100,3 +101,35 @@ def change_password(): else: flash('Invalid password.') return render_template('auth/change_password.html', form=form) + + +@auth.route('/reset', methods=['GET', 'POST']) +def password_reset_request(): + if not current_user.is_anonymous: + redirect(url_for('main.index')) + form = PasswordResetRequestForm() + if form.validate_on_submit(): + user = User.query.filter_by(email=form.email.data).first() + if user: + token = user.generate_reset_token() + send_email(user.email, 'Reset your password', + 'auth/email/reset_password', user=user, token=token) + flash('An email with instructions to reset your password has been ' + 'sent to you') + return redirect(url_for('auth.login')) + return render_template('auth/reset_password.html', form=form) + + +@auth.route('/reset/', methods=['GET', 'POST']) +def password_reset(token): + if not current_user.is_anonymous: + redirect(url_for('main.index')) + form = PasswordResetForm() + if form.validate_on_submit(): + if User.reset_password(token, form.password.data): + db.session.commit() + flash('Your password has been updated.') + return redirect(url_for('auth.login')) + else: + return redirect(url_for('main.index')) + return render_template('auth/reset_password.html', form=form) diff --git a/app/models.py b/app/models.py index f7c7c3b..956d293 100644 --- a/app/models.py +++ b/app/models.py @@ -52,6 +52,24 @@ class User(UserMixin, db.Model): db.session.add(self) return True + def generate_reset_token(self, expiration=3600): + s = Serializer(current_app.config['SECRET_KEY'], expiration) + return s.dumps({'reset': self.id}).decode('utf-8') + + @staticmethod + def reset_password(token, new_password): + s = Serializer(current_app.config['SECRET_KEY']) + try: + data = s.loads(token.encode('utf-8')) + except BadSignature: + return False + user = User.query.get(data.get('reset')) + if user is None: + return False + user.password = new_password + db.session.add(user) + return True + def __repr__(self): return '' % self.username diff --git a/app/templates/auth/email/reset_password.html b/app/templates/auth/email/reset_password.html new file mode 100644 index 0000000..1eafdfe --- /dev/null +++ b/app/templates/auth/email/reset_password.html @@ -0,0 +1,8 @@ +

Dear {{ user.username }},

+

To reset your password click here.

+

Alternatively, you can paste the following link in your browser's address bar:

+

{{ url_for('auth.password_reset', token=token, _external=True) }}

+

If you have not requested a password reset simply ignore this message.

+

Sincerely,

+

The Flasky Team

+

Note: replies to this email address are not monitored.

diff --git a/app/templates/auth/email/reset_password.txt b/app/templates/auth/email/reset_password.txt new file mode 100644 index 0000000..fc6826c --- /dev/null +++ b/app/templates/auth/email/reset_password.txt @@ -0,0 +1,13 @@ +Dear {{ user.username }}, + +To reset your password click on the following link: + +{{ url_for('auth.password_reset', token=token, _external=True) }} + +If you have not requested a password reset simply ignore this message. + +Sincerely, + +The Flasky Team + +Note: replies to this email address are not monitored. diff --git a/app/templates/auth/login.html b/app/templates/auth/login.html index 449739f..136a753 100644 --- a/app/templates/auth/login.html +++ b/app/templates/auth/login.html @@ -10,11 +10,7 @@
{{ wtf.quick_form(form) }}
-

- New user? - - Click here to register - -

+

Forgot your password? Click here to reset it.

+

New user? Click here to register.

{% endblock %} diff --git a/app/templates/auth/reset_password.html b/app/templates/auth/reset_password.html new file mode 100644 index 0000000..d22036c --- /dev/null +++ b/app/templates/auth/reset_password.html @@ -0,0 +1,13 @@ +{% extends "base.html" %} +{% import "bootstrap/wtf.html" as wtf %} + +{% block title %}Flasky - Password Reset{% endblock %} + +{% block page_content %} +
+

Reset Your Password

+
+
+ {{ wtf.quick_form(form) }} +
+{% endblock %} diff --git a/tests/test_user_model.py b/tests/test_user_model.py index 4c87657..7c1c0cc 100644 --- a/tests/test_user_model.py +++ b/tests/test_user_model.py @@ -58,3 +58,19 @@ class UserModelTestCase(unittest.TestCase): token = u.generate_confirmation_token(1) time.sleep(2) self.assertFalse(u.confirm(token)) + + def test_valid_reset_token(self): + u = User(password='cat') + db.session.add(u) + db.session.commit() + token = u.generate_reset_token() + self.assertTrue(User.reset_password(token, 'dog')) + self.assertTrue(u.verify_password('dog')) + + def test_invalid_reset_token(self): + u = User(password='cat') + db.session.add(u) + db.session.commit() + token = u.generate_reset_token() + self.assertFalse(User.reset_password(token+'a', 'horse')) + self.assertTrue(u.verify_password('cat'))