diff --git a/auth/forms.py b/auth/forms.py index d87276d..6d97745 100644 --- a/auth/forms.py +++ b/auth/forms.py @@ -6,8 +6,9 @@ from .models import User, Settings, AllowedDomain from extensions import db import re -def validate_password_strength(password): +def validate_password_strength(form, field): """Validate password based on current settings""" + password = field.data settings = Settings.query.first() if not settings: return # No settings found, allow any password diff --git a/auth/routes.py b/auth/routes.py index 5127b49..1a13325 100644 --- a/auth/routes.py +++ b/auth/routes.py @@ -1933,4 +1933,55 @@ def clear_error_logs(): 'success': True, 'message': f'Deleted {deleted_count} error logs older than {days_to_keep} days', 'deleted_count': deleted_count - }) \ No newline at end of file + }) + +@auth.route('/change_password', methods=['POST']) +@login_required +def change_password(): + try: + form = ChangePasswordForm() + if form.validate_on_submit(): + # Check if current password is correct + if not bcrypt.check_password_hash(current_user.password, form.current_password.data): + flash('Current password is incorrect.', 'danger') + return redirect(url_for('auth.profile')) + + # Set new password + hashed_password = bcrypt.generate_password_hash(form.new_password.data).decode('utf-8') + current_user.password = hashed_password + db.session.commit() + + # Log password change + logger.info( + "User changed their password: %s (ID: %s) from IP %s", + current_user.username, + current_user.id, + request.remote_addr, + extra={ + 'ip_address': request.remote_addr, + 'user_agent': request.headers.get('User-Agent'), + 'user_id': current_user.id, + 'username': current_user.username, + 'action': 'password_change' + } + ) + + flash('Your password has been updated!', 'success') + return redirect(url_for('auth.profile')) + else: + for field, errors in form.errors.items(): + for error in errors: + flash(f'{error}', 'danger') + return redirect(url_for('auth.profile')) + + except Exception as e: + logger.exception("Error in change_password function", extra={ + 'ip_address': request.remote_addr, + 'user_agent': request.headers.get('User-Agent'), + 'user_id': current_user.id if current_user.is_authenticated else None, + 'username': current_user.username if current_user.is_authenticated else None, + 'error': str(e) + }) + + flash('An error occurred while changing your password. Please try again.', 'danger') + return redirect(url_for('auth.profile')) \ No newline at end of file diff --git a/templates/auth/company_api_keys.html b/templates/auth/company_api_keys.html index 286da65..e2f9a4b 100644 --- a/templates/auth/company_api_keys.html +++ b/templates/auth/company_api_keys.html @@ -21,7 +21,7 @@