Flask-Security Changelog¶
Here you can see the full list of changes between each Flask-Security release.
Version 3.0.0¶
Released TBD
Fixed a bug when user clicking confirmation link after confirmation and expiration causes confirmation email to resend. (see #556)
Added support for I18N.
Added options SECURITY_EMAIL_PLAINTEXT and SECURITY_EMAIL_HTML for sending respecively plaintext and HTML version of email.
Fixed validation when missing login information.
Fixed condition for token extraction from JSON body.
Better support for universal bdist wheel.
Added port of CLI using Click configurable using options SECURITY_CLI_USERS_NAME and SECURITY_CLI_ROLES_NAME.
Added new configuration option SECURITY_DATETIME_FACTORY which can be used to force default timezone for newly created datetimes. (see mattupstate/flask-security#466)
Better IP tracking if using Flask 0.12.
Renamed deprecated Flask-WFT base form class.
Added tests for custom forms configured using app config.
Added validation and tests for next argument in logout endpoint. (see #499)
Bumped minimal required versions of several packages.
Extended test matric on Travis CI for minimal and released package versions.
Added of .editorconfig and forced tests for code style.
Fixed a security bug when validating a confirmation token, also checks if the email that the token was created with matches the user’s current email.
Replaced token loader with request loader.
Changed trackable behavior of login_user when IP can not be detected from a request from ‘untrackable’ to None value.
Use ProxyFix instead of inspecting X-Forwarded-For header.
Fix identical problem with app as with datastore.
Removed always-failing assertion.
Fixed failure of init_app to set self.datastore.
Changed to new style flask imports.
Added proper error code when returning JSON response.
Changed obsolette Required validator from WTForms to DataRequired. Bumped Flask-WTF to 0.13.
Fixed missing SECURITY_SUBDOMAIN in config docs.
Added cascade delete in PeeweeDatastore.
Added notes to docs about SECURITY_USER_IDENTITY_ATTRIBUTES.
Inspect value of SECURITY_UNAUTHORIZED_VIEW.
Send password reset instructions if an attempt has expired.
Added “Forgot password?” link to LoginForm description.
Upgraded passlib, and removed bcrypt version restriction.
Removed a duplicate line (‘retype_password’: ‘Retype Password’) in forms.py.
Various documentation improvement.
Version 1.7.5¶
Released December 2nd 2015
Added SECURITY_TOKEN_MAX_AGE configuration setting
Fixed calls to SQLAlchemyUserDatastore.get_user(None) (this now returns False instead of raising a TypeError
Fixed URL generation adding extra slashes in some cases (see GitHub #343)
Fixed handling of trackable IP addresses when the X-Forwarded-For header contains multiple values
Include WWW-Authenticate headers in @auth_required authentication checks
Fixed error when check_token function is used with a json list
Added support for custom AnonymousUser classes
Restricted forgot_password endpoint to anonymous users
Allowed unauthorized callback to be overridden
Fixed issue where passwords cannot be reset if currently set to None
Ensured that password reset tokens are invalidated after use
Updated is_authenticated and is_active functions to support Flask-Login changes
Various documentation improvements
Version 1.7.4¶
Released October 13th 2014
Fixed a bug related to changing existing passwords from plaintext to hashed
Fixed a bug in form validation that did not enforce case insensivitiy
Fixed a bug with validating redirects
Version 1.7.3¶
Released June 10th 2014
Fixed a bug where redirection to SECURITY_POST_LOGIN_VIEW was not respected
Fixed string encoding in various places to be friendly to unicode
Now using werkzeug.security.safe_str_cmp to check tokens
Removed user information from JSON output on /reset responses
Added Python 3.4 support
Version 1.7.2¶
Released May 6th 2014
Updated IP tracking to check for X-Forwarded-For header
Fixed a bug regarding the re-hashing of passwords with a new algorithm
Fixed a bug regarding the password_changed signal.
Version 1.7.1¶
Released January 14th 2014
Fixed a bug where passwords would fail to verify when specifying a password hash algorithm
Version 1.7.0¶
Released January 10th 2014
Python 3.3 support!
Dependency updates
Fixed a bug when SECURITY_LOGIN_WITHOUT_CONFIRMATION = True did not allow users to log in
Added SECURITY_SEND_PASSWORD_RESET_NOTICE_EMAIL configuraiton option to optionally send password reset notice emails
Add documentation for @security.send_mail_task
Move to request.get_json as request.json is now deprecated in Flask
Fixed a bug when using AJAX to change a user’s password
Added documentation for select functions in the flask_security.utils module
Fixed a bug in flask_security.forms.NextFormMixin
Added CHANGE_PASSWORD_TEMPLATE configuration option to optionally specify a different change password template
Added the ability to specify addtional fields on the user model to be used for identifying the user via the USER_IDENTITY_ATTRIBUTES configuration option
An error is now shown if a user tries to change their password and the password is the same as before. The message can be customed with the SECURITY_MSG_PASSWORD_IS_SAME configuration option
Fixed a bug in MongoEngineUserDatastore where user model would not be updated when using the add_role_to_user method
Added SECURITY_SEND_PASSWORD_CHANGE_EMAIL configuration option to optionally disable password change email from being sent
Fixed a bug in the find_or_create_role method of the PeeWee datastore
Removed pypy tests
Fixed some tests
Include CHANGES and LICENSE in MANIFEST.in
A bit of documentation cleanup
A bit of code cleanup including removal of unnecessary utcnow call and simplification of get_max_age method
Version 1.6.9¶
Released August 20th 2013
Fix bug in SQLAlchemy datastore’s get_user function
Fix bug in PeeWee datastore’s remove_role_from_user function
Fixed import error caused by new Flask-WTF release
Version 1.6.8¶
Released August 1st 2013
Fixed bug with case sensitivity of email address during login
Code cleanup regarding token_callback
Ignore validation errors in find_user function for MongoEngineUserDatastore
Version 1.6.7¶
Released July 11th 2013
Made password length form error message configurable
Fixed email confirmation bug that prevented logged in users from confirming their email
Version 1.6.5¶
Released June 20th 2013
Fixed bug in flask.ext.security.confirmable.generate_confirmation_link
Version 1.6.4¶
Released June 18th 2013
Added SECURITY_DEFAULT_REMEMBER_ME configuration value to unify behavior between endpoints
Fixed Flask-Login dependency problem
Added optional next parameter to registration endpoint, similar to that of login
Version 1.6.3¶
Released May 8th 2013
Fixed bug in regards to imports with latest version of MongoEngine
Version 1.6.0¶
Released March 13th 2013
Added Flask-Pewee support
Password hashing is now more flexible and can be changed to a different type at will
Flask-Login messages are configurable
AJAX requests must now send a CSRF token for security reasons
Form messages are now configurable
Forms can now be extended with more fields
Added change password endpoint
Added the user to the request context when successfully authenticated via http basic and token auth
The Flask-Security blueprint subdomain is now configurable
Redirects to other domains are now not allowed during requests that may redirect
Template paths can be configured
The welcome/register email can now optionally be sent to the user
Passwords can now contain non-latin characters
Fixed a bug when confirming an account but the account has been deleted
Version 1.5.4¶
Released January 6th 2013
Fix bug in forms with csrf_enabled parameter not accounting attempts to login using JSON data
Version 1.5.2¶
Released December 11th 2012
Fix a small bug in flask_security.utils.login_user method
Version 1.5.1¶
Released November 26th 2012
Fixed bug with next form variable
Added better documentation regarding Flask-Mail configuration
Added ability to configure email subjects
Version 1.5.0¶
Released October 11th 2012
Major release. Upgrading from previous versions will require a bit of work to accomodate API changes. See documentation for a list of new features and for help on how to upgrade.
Version 1.2.2¶
Released April 27th 2012
Fixed bug where roles_required and roles_accepted did not pass the next argument to the login view
Version 1.2.1¶
Released March 28th 2012
Added optional user model mixin parameter for datastores
Added CreateRoleCommand to available Flask-Script commands
Version 1.2.0¶
Released March 12th 2012
Added configuration option SECURITY_FLASH_MESSAGES which can be set to a boolean value to specify if Flask-Security should flash messages or not.
Version 1.1.0¶
Initial release