Merge branch 'main' into my-branch

bishtsoftware · web-flow · commit d424808fbd34 · 2026-06-18T20:21:53.000+05:30
diff --git a/CHANGES.rst b/CHANGES.rst
@@ -19,6 +19,7 @@ Features & Improvements
 - (:issue:`1237`) Add support for CSRF on logout
 - (:pr:`1241`) Convert all _WITHIN configuration variable to use timedelta
 - (:issue:`1153`) Enable localization of %(within)s variables using humanize
+- (:pr:`xx`) Add link expiration to confirmation and reset password email templates
 
 Fixes
 +++++
diff --git a/docs/configuration.rst b/docs/configuration.rst
@@ -1079,6 +1079,13 @@ Confirmable
     Sets the subject for the email confirmation message.
 
     Default: ``_("Please confirm your email")``.
+.. py:data:: SECURITY_EMAIL_TEMPLATE_CONFIRM
+
+    Specifies the path to the template for the email send confirmation instructions.
+
+    Default: ``"confirmation_instructions"``.
+
+    .. versionadded:: 5.9.0
 .. py:data:: SECURITY_CONFIRM_ERROR_VIEW
 
     Specifies the view to redirect to if a confirmation error occurs.
@@ -1253,6 +1260,14 @@ Recoverable
 
     Default: ``_("Password reset instructions")``.
 
+.. py:data:: SECURITY_EMAIL_TEMPLATE_PASSWORD_RESET
+
+    Specifies the path to the template for the email send password reset instructions.
+
+    Default: ``"reset_instructions"``.
+
+    .. versionadded:: 5.9.0
+
 .. py:data:: SECURITY_EMAIL_SUBJECT_PASSWORD_NOTICE
 
     Sets subject for the password notice.
@@ -1273,6 +1288,13 @@ Change-Email
     Sets the subject for the change email confirmation email.
 
     Default: ``_("Confirm your new email address")``.
+.. py:data:: SECURITY_CHANGE_EMAIL_EMAIL_TEMPLATE
+
+    Specifies the path to the template for the change email email instructions.
+
+    Default: ``"change_email_instructions"``.
+
+    .. versionadded:: 5.9.0
 .. py:data:: SECURITY_CHANGE_EMAIL_TEMPLATE
 
     Specifies the path to the template for the change email page.
diff --git a/flask_security/change_email.py b/flask_security/change_email.py
@@ -183,7 +183,7 @@ def _send_instructions(user, new_email):
     send_mail(
         cv("CHANGE_EMAIL_SUBJECT"),
         new_email,
-        "change_email_instructions",
+        cv("CHANGE_EMAIL_EMAIL_TEMPLATE"),
         user=user,
         link=link,
         token=token,
diff --git a/flask_security/confirmable.py b/flask_security/confirmable.py
@@ -21,6 +21,7 @@
     url_for_security,
     check_and_get_token_status,
     verify_hash,
+    td_format,
 )
 
 
@@ -40,10 +41,11 @@ def send_confirmation_instructions(user):
     send_mail(
         cv("EMAIL_SUBJECT_CONFIRM"),
         user.email,
-        "confirmation_instructions",
+        cv("EMAIL_TEMPLATE_CONFIRM"),
         user=user,
         confirmation_link=confirmation_link,
         confirmation_token=token,
+        within=td_format(cv("CONFIRM_EMAIL_WITHIN")),
     )
 
     confirm_instructions_sent.send(
diff --git a/flask_security/core.py b/flask_security/core.py
@@ -251,6 +251,7 @@
     "POST_CHANGE_EMAIL_VIEW": None,  # spa
     "CHANGE_EMAIL_SALT": "change-email-salt",
     "CHANGE_EMAIL_SUBJECT": _("Confirm your new email address"),
+    "CHANGE_EMAIL_EMAIL_TEMPLATE": "change_email_instructions",
     "CHANGE_USERNAME": False,
     "CHANGE_USERNAME_TEMPLATE": "security/change_username.html",
     "CHANGE_USERNAME_URL": "/change-username",
@@ -330,6 +331,8 @@
     "EMAIL_HTML": True,
     "EMAIL_SUBJECT_TWO_FACTOR": _("Two-Factor Login"),
     "EMAIL_SUBJECT_TWO_FACTOR_RESCUE": _("Two-Factor Rescue"),
+    "EMAIL_TEMPLATE_CONFIRM": "confirmation_instructions",
+    "EMAIL_TEMPLATE_PASSWORD_RESET": "reset_instructions",
     "USER_IDENTITY_ATTRIBUTES": [
         {"email": {"mapper": uia_email_mapper, "case_insensitive": True}}
     ],
diff --git a/flask_security/recoverable.py b/flask_security/recoverable.py
@@ -23,6 +23,7 @@
     hash_password,
     send_mail,
     url_for_security,
+    td_format,
 )
 
 
@@ -42,10 +43,11 @@ def send_reset_password_instructions(user):
         send_mail(
             cv("EMAIL_SUBJECT_PASSWORD_RESET"),
             user.email,
-            "reset_instructions",
+            cv("EMAIL_TEMPLATE_PASSWORD_RESET"),
             user=user,
             reset_link=reset_link,
             reset_token=token,
+            within=td_format(cv("RESET_PASSWORD_WITHIN")),
         )
 
     reset_password_instructions_sent.send(
diff --git a/flask_security/templates/security/email/confirmation_instructions.html b/flask_security/templates/security/email/confirmation_instructions.html
@@ -3,6 +3,8 @@
   confirmation_token - this token is part of confirmation link - but can be used to
     construct arbitrary URLs for redirecting.
   user - the entire user model object
+  within - formatted expiration of link
   security - the Flask-Security configuration
 #}
 <p>{{ _fsdomain('Use <a href="%(confirmation_link)s">this link</a> to confirm your email address.', confirmation_link=confirmation_link)|safe }}</p>
+<p>{{ _fsdomain('This link will expire in %(within)s.', within=within) }}</p>
diff --git a/flask_security/templates/security/email/confirmation_instructions.txt b/flask_security/templates/security/email/confirmation_instructions.txt
@@ -3,6 +3,8 @@
   confirmation_token - this token is part of confirmation link - but can be used to
     construct arbitrary URLs for redirecting.
   user - the entire user model object
+  within - formatted expiration of link
   security - the Flask-Security configuration
 #}
 {{ _fsdomain('Use %(confirmation_link)s to confirm your email address.', confirmation_link=confirmation_link)|safe }}
+{{ _fsdomain('This link will expire in %(within)s.', within=within) }}
diff --git a/flask_security/templates/security/email/reset_instructions.html b/flask_security/templates/security/email/reset_instructions.html
@@ -3,8 +3,8 @@
   reset_token - this token is part of reset link - but can be used to
     construct arbitrary URLs for redirecting.
   user - the entire user model object
+  within - formatted expiration of link
   security - the Flask-Security configuration
 #}
-<p>
-  <a href="{{ reset_link }}">{{ _fsdomain('Click here to reset your password') }}</a>
-</p>
+<p>{{ _fsdomain('Use <a href="%(reset_link)s">this link</a> to reset your password.', reset_link=reset_link)|safe }}</p>
+<p>{{ _fsdomain('This link will expire in %(within)s.', within=within) }}</p>
diff --git a/flask_security/templates/security/email/reset_instructions.txt b/flask_security/templates/security/email/reset_instructions.txt
@@ -3,8 +3,8 @@
   reset_token - this token is part of reset link - but can be used to
     construct arbitrary URLs for redirecting.
   user - the entire user model object
+  within - formatted expiration of link
   security - the Flask-Security configuration
 #}
-{{ _fsdomain('Click the link below to reset your password:') }}
-
-{{ reset_link }}
+{{ _fsdomain('Use %(reset_link)s to reset your password.', reset_link=reset_link)|safe }}
+{{ _fsdomain('This link will expire in %(within)s.', within=within) }}
diff --git a/tests/templates/security/email/change_email_instructions_test.txt b/tests/templates/security/email/change_email_instructions_test.txt
@@ -11,3 +11,5 @@ Email:{{ user.email }}
 Token:{{ token }}
 RegisterBlueprint:{{ security.register_blueprint }}
 Within:{{ within }}
+
+{% include "security/email/change_email_instructions.txt" %}
diff --git a/tests/templates/security/email/confirmation_instructions_test.txt b/tests/templates/security/email/confirmation_instructions_test.txt
@@ -3,9 +3,13 @@
   confirmation_token - this token is part of confirmation link - but can be used to
     construct arbitrary URLs for redirecting.
   user - the entire user model object
+  within - formatted expiration of link
   security - the Flask-Security configuration
 #}
 Link:{{ confirmation_link }}
 Email:{{ user.email }}
 Token:{{ confirmation_token }}
 RegisterBlueprint:{{ security.register_blueprint }}
+Within:{{ within }}
+
+{% include "security/email/confirmation_instructions.txt" %}
diff --git a/tests/templates/security/email/reset_instructions_test.txt b/tests/templates/security/email/reset_instructions_test.txt
@@ -3,6 +3,7 @@
   reset_token - this token is part of reset link - but can be used to
     construct arbitrary URLs for redirecting.
   user - the entire user model object
+  within - formatted expiration of link
   security - the Flask-Security configuration
 #}
 {{ global }}
@@ -13,3 +14,6 @@ Email:{{ user.email }}
 Token:{{ reset_token }}
 RegisterBlueprint:{{ security.register_blueprint }}
 SecurityConfig:{{ config["SECURITY_RESET_URL"] }}
+Within:{{ within }}
+
+{% include "security/email/reset_instructions.txt" %}
diff --git a/tests/test_change_email.py b/tests/test_change_email.py
@@ -137,6 +137,11 @@ def test_expired_token(client, get_message):
     assert msg in response.data
 
 
+@pytest.mark.settings(
+    change_email_within=timedelta(minutes=90),
+    change_email_email_template="change_email_instructions_test",
+    email_html=False,
+)
 def test_template(app, client, get_message, outbox):
     # Check contents of email template - this uses a test template
     # to check all context vars since the default template
@@ -152,14 +157,19 @@ def test_template(app, client, get_message, outbox):
         assert matcher[1].split(":")[1] == "matt@lp.com"
         assert matcher[2].split(":")[1] == ce_requests[0]["token"]
         assert matcher[3].split(":")[1] == "True"  # register_blueprint
-        assert matcher[4].split(":")[1] == "2 hours"
+        assert matcher[4].split(":")[1] == "1 hour and 30 minutes"  # within
+        # entire original template is included in this test one
+        assert "This link will expire in 1 hour and 30 minutes." in outbox[0].body
 
         # check link
         _, link = matcher[0].split(":", 1)
         response = client.get(link, follow_redirects=True)
         assert get_message("CHANGE_EMAIL_CONFIRMED") in response.data
 
 
+@pytest.mark.settings(
+    change_email_email_template="change_email_instructions_test", email_html=False
+)
 @pytest.mark.parametrize("humanizer", ["fr_FR"], indirect=["humanizer"])
 def test_template_fr(app, client, get_message, outbox, humanizer):
     # Check contents of email template - with humanize xlation of within
diff --git a/tests/test_confirmable.py b/tests/test_confirmable.py
@@ -139,6 +139,9 @@ def on_instructions_sent(app, **kwargs):
 
 
 @pytest.mark.registerable()
+@pytest.mark.settings(
+    email_template_confirm="confirmation_instructions_test", email_html=False
+)
 def test_confirmation_template(app, client, get_message, outbox):
     # Check contents of email template - this uses a test template
     # in order to check all context vars since the default template
@@ -159,10 +162,7 @@ def on_instructions_sent(app, **kwargs):
         )
         # Register - this will use the welcome template
         client.post("/register", data=data, follow_redirects=True)
-        # Explicitly ask for confirmation -
-        # this will use the confirmation_instructions template
-        client.post("/confirm", data=dict(email="mary@lp.com"))
-        assert len(outbox) == 2
+        assert len(outbox) == 1
         # check registration email
         matcher = re.findall(r"\w+:.*", outbox[0].body, re.IGNORECASE)
         # should be 4 - link, email, token, config item
@@ -171,20 +171,27 @@ def on_instructions_sent(app, **kwargs):
         assert matcher[2].split(":")[1] == registrations[0]["confirmation_token"]
         assert matcher[3].split(":")[1] == "True"  # register_blueprint
 
+        # Explicitly ask for confirmation -
+        # this will use the confirmation_instructions template
+        client.post("/confirm", data=dict(email="mary@lp.com"))
         # check confirmation email
         matcher = re.findall(r"\w+:.*", outbox[1].body, re.IGNORECASE)
-        # should be 4 - link, email, token, config item
+        # should be 5 - link, email, token, config item, within
         assert matcher[1].split(":")[1] == "mary@lp.com"
         assert matcher[2].split(":")[1] == recorded_tokens_sent[0]
         token = matcher[2].split(":")[1]
         assert token == recorded_tokens_sent[0]
         assert matcher[3].split(":")[1] == "True"  # register_blueprint
+        assert matcher[4].split(":")[1] == "2 days"  # within
 
         # check link
         _, link = matcher[0].split(":", 1)
         response = client.get(link, follow_redirects=True)
         assert get_message("EMAIL_CONFIRMED") in response.data
 
+        # regular text template is included in the test template
+        assert "This link will expire in 2 days." in outbox[1].body
+
 
 @pytest.mark.registerable()
 @pytest.mark.settings(requires_confirmation_error_view="/confirm")
diff --git a/tests/test_context_processors.py b/tests/test_context_processors.py
@@ -30,6 +30,8 @@
     verify_template="custom_security/verify.html",
     username_recovery_template="custom_security/recover_username.html",
     change_username_template="custom_security/change_username.html",
+    email_template_password_reset="reset_instructions_test",
+    email_html=False,
 )
 def test_context_processors(client, app, outbox):
     @app.security.context_processor
diff --git a/tests/test_recoverable.py b/tests/test_recoverable.py
@@ -236,6 +236,12 @@ def on_instructions_sent(app, **kwargs):
     assert len(flashes) == 0
 
 
+@pytest.mark.registerable()
+@pytest.mark.settings(
+    email_template_password_reset="reset_instructions_test",
+    email_html=False,
+    reset_password_within=timedelta(minutes=45),
+)
 def test_recoverable_template(app, client, get_message, outbox):
     # Check contents of email template - this uses a test template
     # in order to check all context vars since the default template
@@ -246,17 +252,21 @@ def test_recoverable_template(app, client, get_message, outbox):
         )
         assert len(outbox) == 1
         matcher = re.findall(r"\w+:.*", outbox[0].body, re.IGNORECASE)
-        # should be 4 - link, email, token, config item
+        # should be 5 - link, email, token, config item, within
         assert matcher[1].split(":")[1] == "joe@lp.com"
         assert matcher[2].split(":")[1] == resets[0]["reset_token"]
         assert matcher[3].split(":")[1] == "True"  # register_blueprint
         assert matcher[4].split(":")[1] == "/reset"  # SECURITY_RESET_URL
+        assert matcher[5].split(":")[1] == "45 minutes"  # within
 
         # check link
         link = matcher[0].split(":", 1)[1]
         response = client.get(link, follow_redirects=True)
         assert b"Reset Password" in response.data
 
+        # regular text template is included in the test template
+        assert "This link will expire in 45 minutes." in outbox[0].body
+
 
 def test_recover_invalidates_session(app, client):
     # Make sure that if we reset our password - prior sessions are invalidated.
