Implement change password

app/blueprints/users/account.py

@@ -68,6 +68,13 @@ def handle_login(form):
 
 @bp.route("/user/login/", methods=["GET", "POST"])
 def login():
+	if current_user.is_authenticated:
+		next = request.args.get("next")
+		if next and not is_safe_url(next):
+			abort(400)
+
+		return redirect(next or url_for("homepage.home"))
+
 	form = LoginForm(request.form)
 	if form.validate_on_submit():
 		ret = handle_login(form)
@@ -134,10 +141,61 @@ class SetPasswordForm(FlaskForm):
 	password2 = PasswordField("Verify password", [InputRequired(), Length(8, 100)])
 	submit = SubmitField("Save")
 
+class ChangePasswordForm(FlaskForm):
+	old_password = PasswordField("Old password", [InputRequired(), Length(8, 100)])
+	password = PasswordField("New password", [InputRequired(), Length(8, 100)])
+	password2 = PasswordField("Verify password", [InputRequired(), Length(8, 100)])
+	submit = SubmitField("Save")
+
+
+def handle_set_password(form):
+	one = form.password.data
+	two = form.password2.data
+	if one != two:
+		flash("Passwords do not much", "danger")
+		return
+
+	current_user.password = make_flask_login_password(form.password.data)
+	db.session.commit()
+
+	flash("Your password has been changed successfully.", "success")
+
+	if hasattr(form, "email"):
+		newEmail = form.email.data
+		if newEmail != current_user.email and newEmail.strip() != "":
+			token = randomString(32)
+
+			ver = UserEmailVerification()
+			ver.user = current_user
+			ver.token = token
+			ver.email = newEmail
+			db.session.add(ver)
+			db.session.commit()
+
+			task = sendVerifyEmail.delay(newEmail, token)
+			return redirect(
+					url_for("tasks.check", id=task.id, r=url_for("users.profile", username=current_user.username)))
+
+	return redirect(url_for("homepage.home"))
+
+
 @bp.route("/user/change-password/", methods=["GET", "POST"])
 @login_required
 def change_password():
-	return "change"
+	form = ChangePasswordForm(request.form)
+
+	if current_user.email is None:
+		form.email.validators = [InputRequired(), Email()]
+
+	if form.validate_on_submit():
+		if check_password_hash(current_user.password, form.old_password.data):
+			ret = handle_set_password(form)
+			if ret:
+				return ret
+		else:
+			flash("Old password is incorrect", "danger")
+
+	return render_template("users/change_set_password.html", form=form)
 
 
 @bp.route("/user/set-password/", methods=["GET", "POST"])
@@ -150,39 +208,12 @@ def set_password():
 	if current_user.email is None:
 		form.email.validators = [InputRequired(), Email()]
 
-	if request.method == "POST" and form.validate():
-		one = form.password.data
-		two = form.password2.data
-		if one == two:
-			# Hash password
-			hashed_password = make_flask_login_password(form.password.data)
+	if form.validate_on_submit():
+		ret = handle_set_password(form)
+		if ret:
+			return ret
 
-			# Change password
-			current_user.password = hashed_password
-			db.session.commit()
-
-			# Prepare one-time system message
-			flash('Your password has been changed successfully.', 'success')
-
-			newEmail = form["email"].data
-			if newEmail != current_user.email and newEmail.strip() != "":
-				token = randomString(32)
-
-				ver = UserEmailVerification()
-				ver.user = current_user
-				ver.token = token
-				ver.email = newEmail
-				db.session.add(ver)
-				db.session.commit()
-
-				task = sendVerifyEmail.delay(newEmail, token)
-				return redirect(url_for("tasks.check", id=task.id, r=url_for("users.profile", username=current_user.username)))
-			else:
-				return redirect(url_for("users.login"))
-		else:
-			flash("Passwords do not match", "danger")
-
-	return render_template("users/set_password.html", form=form, optional=request.args.get("optional"))
+	return render_template("users/change_set_password.html", form=form, optional=request.args.get("optional"))
 
 
 @bp.route("/user/verify/")

app/blueprints/users/profile.py

@@ -93,7 +93,7 @@ def profile(username):
 
 			if user.checkPerm(current_user, Permission.CHANGE_EMAIL):
 				newEmail = form["email"].data
-				if newEmail != user.email and newEmail.strip() != "":
+				if newEmail and newEmail != user.email and newEmail.strip() != "":
 					token = randomString(32)
 
 					msg = "Changed email of {}".format(user.display_name)