Repository navigation

E-mail change confirmation improvements - #5029

Open

frjo wants to merge 35 commits into

mainfrom

fix/email-change-confirmation

Open

E-mail change confirmation improvements#5029
frjo wants to merge 35 commits into
mainfrom
fix/email-change-confirmation

Commits on Oct 27, 2026
- Improvments on earlier fix for security issue in e-mail change conformation link.
  frjo
  committed
  f1e6007
- Fix slack value.
  frjo
  committed
  6d39fb2
- Make requsting an existing e-mail look the same as any other e-mail change.
  frjo
  committed
  e8d0ae2
- Use website not web site.
  frjo
  committed
  2a5174f
- Check already in use in only one place.
  frjo
  committed
  96e0a98
- Use website not web site, two more places.
  frjo
  committed
  e238548
- Alert user that other profile feilds are saved directly even when e-mail change.
  frjo
  committed
  188d069
- Use diffrent salts for TimestampSigner so can not be reused. Ratelimit e-mail change.
  frjo
  committed
  9f96a4f
- Implement get_email_context(). Check e-mail in use on save.
  frjo
  committed
  17f6673
- Remove unused EmailChangePasswordForm form.
  frjo
  committed
  2276937
- Passwordless users can also use elevate.
  frjo
  committed
  71417d6
- The payloads are now signed once instead of twice.
  frjo
  committed
  3f9a79a
- Fixing tests after changes.
  frjo
  committed
  28d3258
- Update docs for ELEVATE_COOKIE_AGE.
  frjo
  committed
  3f9c7aa
- Update send_confirmation_email.
  frjo
  committed
  486717e
- Improve reuse link check.
  frjo
  committed
  79283e4
- Use form.initial[email] instead of loading the user again.
  frjo
  committed
  08b5299
- Skip cache check.
  frjo
  committed
  48e43df
- Treat existing address as invalid link to avoid leaking information.
  frjo
  committed
  5053e64
- Check if updated_email exist before checking it email exist.
  frjo
  committed
  80d7b8a
- Tie token to user, not only email..
  frjo
  committed
  97fb27c
- Remove unused setting PASSWORD_PAGE_TIMEOUT.
  frjo
  committed
  377229a
- Fix autoescape in email templates.
  frjo
  committed
  6adabce
- Use the card layout for done.html as well.
  frjo
  committed
  24b1712
- Update test to catch new behaviour.
  frjo
  committed
  d966e16
- Replace cache with session to stop links from sending multiple emails.
  frjo
  committed
  9747be6
- Remove tip from elevate template.
  frjo
  committed
  3714bdc
- Make profile form normalise the email the same way registration do.
  frjo
  committed
  f17cbec
- Fix autoescape in email templates, part 2.
  frjo
  committed
  292d98b
- Remove test that does not work correctly.
  frjo
  committed
  c77b5e8
- Only count request that send a mail towards ratelimit.
  frjo
  committed
  09d854e
- Use PASSWORDLESS_LOGIN_TIMEOUT instead of PASSWORD_RESET_TIMEOUT.
  frjo
  committed
  bce4679
- Add a Log out other sessions button to the account page.
  frjo
  committed
  c1c1763
- Only save profile forms if other profile fields beside e-mail is changed.
  frjo
  committed
  5f37641
- Only show Log out other sessions when there are other sessions.
  frjo
  committed
  e8f9328

Commits

Commits on Oct 27, 2026