Add confirmation of password for important changes

This commit adds an extra page or field for confirming your current password
when making important changes

Name                 | Email address     | Mobile number     | Password
---------------------|-------------------|-------------------|------------
No password required | As second page    | As second page    | On same page as new password

app/main/forms.py

@@ -31,8 +31,8 @@ def mobile_number():
                                    Regexp(regex=mobile_number_regex, message='Enter a +44 mobile number')])
 
 
-def password():
-    return PasswordField('Create a password',
+def password(label='Create a password'):
+    return PasswordField(label,
                          validators=[DataRequired(message='Password can not be empty'),
                                      Length(10, 255, message='Password must be at least 10 characters'),
                                      Blacklist(message='That password is blacklisted, too common')])
@@ -152,6 +152,11 @@ class NewPasswordForm(Form):
     new_password = password()
 
 
+class ChangePasswordForm(Form):
+    old_password = password('Current password')
+    new_password = password('New password')
+
+
 class CsvUploadForm(Form):
     file = FileField('File to upload', validators=[DataRequired(
                      message='Please pick a file'), CsvFileValidator()])

app/main/views/user_profile.py

@@ -2,8 +2,8 @@ from flask import request, render_template, redirect, url_for
 from flask.ext.login import current_user
 from app.main import main
 from app.main.forms import (
-    NewPasswordForm, ChangeNameForm, ChangeEmailForm, ConfirmEmailForm,
-    ChangeMobileNumberForm, ConfirmMobileNumberForm
+    ChangePasswordForm, ChangeNameForm, ChangeEmailForm, ConfirmEmailForm,
+    ChangeMobileNumberForm, ConfirmMobileNumberForm, ConfirmPasswordForm
 )
 
 
@@ -42,6 +42,22 @@ def userprofile_email():
             thing='email address',
             form_field=form.email_address
         )
+    elif request.method == 'POST':
+        return redirect(url_for('.userprofile_email_authenticate'))
+
+
+@main.route("/user-profile/email/authenticate", methods=['GET', 'POST'])
+def userprofile_email_authenticate():
+
+    form = ConfirmPasswordForm()
+
+    if request.method == 'GET':
+        return render_template(
+            'views/user-profile/authenticate.html',
+            thing='email address',
+            form=form,
+            back_link=url_for('.userprofile_email')
+        )
     elif request.method == 'POST':
         return redirect(url_for('.userprofile_email_confirm'))
 
@@ -74,6 +90,22 @@ def userprofile_mobile_number():
             thing='mobile number',
             form_field=form.mobile_number
         )
+    elif request.method == 'POST':
+        return redirect(url_for('.userprofile_mobile_number_authenticate'))
+
+
+@main.route("/user-profile/mobile-number/authenticate", methods=['GET', 'POST'])
+def userprofile_mobile_number_authenticate():
+
+    form = ConfirmPasswordForm()
+
+    if request.method == 'GET':
+        return render_template(
+            'views/user-profile/authenticate.html',
+            thing='mobile number',
+            form=form,
+            back_link=url_for('.userprofile_mobile_number_confirm')
+        )
     elif request.method == 'POST':
         return redirect(url_for('.userprofile_mobile_number_confirm'))
 
@@ -96,13 +128,12 @@ def userprofile_mobile_number_confirm():
 @main.route("/user-profile/password", methods=['GET', 'POST'])
 def userprofile_password():
 
-    form = NewPasswordForm()
+    form = ChangePasswordForm()
 
     if request.method == 'GET':
         return render_template(
-            'views/user-profile/change.html',
-            thing='password',
-            form_field=form.new_password
+            'views/user-profile/change-password.html',
+            form=form
         )
     elif request.method == 'POST':
         return redirect(url_for('.userprofile'))