ivenn / todo Goto Github PK

Steps to reproduce:

1. Open browser. Be shoure that you are logged out.
2. Go to http://host:port/confirm/some_token

Excpected result:

You should see a massage: "The confirmation link us invalid or expired"

Actual result:

you are see a massage: "
User was already confirmed, just login!
Please log in to access this page.
"

It's happenes by two reasons:

1. Wrong use of confirm_token method.
   We are use this method by the next way:

    try:
        username = confirm_token(token)
    except:
        flash('The confirmation link us invalid or expired')

But confirm token return False, in case a token isn't valid.
we have username = False
2. But by unknow reason the next statesment with username = False, returns admin for us

    user = User.query.filter_by(username=username).first()

admin alredy confirmed and we see "User was already confirmed," message.