BLT User signup email verification

when signed up. The username is taken and if the email was incorrect, there is no way to edit and change it.

https://blt.owasp.org/issue/5508 found by Anonymous at url: http://blt.owasp.org

Mar 25 '25 16:03 bug-reporter-bot

/assign

Mar 25 '25 18:03 Himanshu-639

Hello @Himanshu-639! You've been assigned to OWASP-BLT/BLT issue #4049. You have 24 hours to complete a pull request.

Mar 25 '25 18:03 github-actions[bot]

⏰ This issue has been automatically unassigned due to 24 hours of inactivity. The issue is now available for anyone to work on again.

Mar 26 '25 18:03 github-actions[bot]

/assign

Mar 26 '25 19:03 Himanshu-639

Hello @Himanshu-639! You've been assigned to OWASP-BLT/BLT issue #4049. You have 24 hours to complete a pull request.

Mar 26 '25 19:03 github-actions[bot]

@CodeRabbit tell me the best way to implement it Should i create a new page for it or just a popup will be fine?

Mar 27 '25 06:03 Himanshu-639

[!TIP] For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Fetch the issue details
gh issue view 4049 --repo OWASP-BLT/BLT

Length of output: 409

🏁 Script executed:

#!/bin/bash
# Check the repository structure
ls -la

# Look for user-related directories
find . -type d -name "*user*" 2>/dev/null

# Look for authentication-related directories
find . -type d -name "*auth*" 2>/dev/null

Length of output: 2784

🏁 Script executed:

#!/bin/bash
# Check structure of website directory
find ./website -type d | sort

# Look for user-related files
find . -type f -name "*user*.py" 2>/dev/null

# Look for authentication-related files
find . -type f -name "*auth*.py" 2>/dev/null

# Look for files related to registration or signup
find . -type f -name "*regist*.py" -o -name "*sign*.py" 2>/dev/null

Length of output: 7724

🏁 Script executed:

#!/bin/bash
# Check user model definition
cat ./website/models.py | grep -A 50 "class UserProfile" || echo "UserProfile not found in models.py"

# Check user-related views
cat ./website/views/user.py | grep -B 5 -A 30 "def signup" || echo "signup view not found"

# Check user-related views for email verification
cat ./website/views/user.py | grep -B 5 -A 30 "def verify" || echo "verify email view not found"

# Check for registration templates
ls -la ./website/templates/registration/

Length of output: 3782

🏁 Script executed:

#!/bin/bash
# Check installed packages
grep -E "django-allauth|django-registration" pyproject.toml || echo "Third-party auth packages not found in pyproject.toml"

# Check project settings for auth configuration
cat ./blt/settings.py | grep -A 20 "INSTALLED_APPS" | head -30

# Check for authentication URLs configuration
cat ./blt/urls.py | grep -A 10 "urlpatterns" | grep -E "auth|account|registration"

# Check if the registration URLs are defined in a separate file
find . -type f -name "urls.py" | xargs grep -l "registration"

# Look at account templates
ls -la ./website/templates/account/ 2>/dev/null || echo "No account templates directory"

Length of output: 1870

🏁 Script executed:

#!/bin/bash
# Check the signup template
cat ./website/templates/account/signup.html | head -60

# Check email verification templates
ls -la ./website/templates/account/email/

# Check allauth settings configuration in settings.py
cat ./blt/settings.py | grep -A 30 "ACCOUNT_" | grep -v "^#"

Length of output: 7065

@Himanshu-639 After analyzing the codebase, I can see that you're using django-allauth with mandatory email verification, but there's no way for users to update their email if they made a mistake during registration.

For this feature, I recommend implementing a popup/modal rather than a new page, for these reasons:

Simplicity: Email change is a straightforward action that works well in a modal
User Experience: Users won't need to navigate away from their profile page
Development Effort: Implementing a modal is faster than building a complete new page
Common Pattern: This follows standard UI patterns for account management

The implementation should:

Add an "Update Email" button on the profile page
Show a modal with a form to enter a new email
Send a verification email to the new address
Only update the email after verification is complete

This approach balances user experience with development effort while solving the core issue of users being stuck with incorrect emails.

Mar 27 '25 06:03 coderabbitai[bot]

⏰ This issue has been automatically unassigned due to 24 hours of inactivity. The issue is now available for anyone to work on again.

Mar 28 '25 07:03 github-actions[bot]

@CodeRabbit code the solution and also dont forgot to handle edge cases i.e., the first verification link should not work after sending the 2nd link

Mar 30 '25 18:03 Himanshu-639

Oops, something went wrong! Please try again later. 🐰 💔

Mar 30 '25 18:03 coderabbitai[bot]

@CodeRabbit code the solution and also dont forgot to handle edge cases i.e., the first verification link should not work after sending the 2nd link

Mar 30 '25 18:03 Himanshu-639

[!TIP] For best results, initiate chat on the files or code changes.

[!TIP] The multi-step agents feature is in experimental mode.

A summary of the edits CodeRabbit can apply:

We will insert a new model EmailChangeRequest into website/models.py to record email change requests. This model will generate a unique token (using uuid ) and, upon saving a new request, invalidate any previous valid requests for that user.
We will insert a new form named EmailChangeForm into website/forms.py to capture the user’s new email address.
We will create a new file website/views/email_update.py which will contain two class‐based views: UpdateEmailView to process the email update request and send the verification email, and VerifyEmailChangeView to verify the token and update the user’s email.
We will update website/urls.py to add URL patterns for the email update and verification views, exposing the endpoints to the front-end.
We will modify website/templates/profile.html to add an “Update Email” button that triggers a modal popup containing the email update form.
We will create a new file (website/views/email_update.py) that implements the email update views (update_email_view and verify_new_email_view) which generate a unique token (thus invalidating any previously sent token) and verify the token when the user clicks the emailed link.
We will modify blt/urls.py to import the email update views from website/views/email_update.py.
We will update blt/urls.py by adding new URL routes to handle the email update request and its verification. This adds endpoints for the modal popup’s POST request and the verification link.
We will create a new modal template in website/templates/account/update_email_modal.html that provides users with a simple way to update their email address. The modal includes a form with an input field for the new email and a CSRF token placeholder. It uses AJAX (via jQuery) to submit the form without reloading the page, and displays feedback to the user. The feedback clearly states that upon sending a new verification email, any previously issued verification links will be invalidated.
We will create a new Django view in website/views/update_email.py to handle the email update process. This view, mapped under the URL name "account_update_email", will process the POST request by retrieving the new email, invalidating any pending email confirmations for the email (ensuring that previous verification links are disabled), updating the user's EmailAddress record, and sending a new verification email via django-allauth.
We will add new view functions in website/views/user.py to handle email update via a modal popup and email verification. The changes will include an "update_email" view to process the new email submission, generate a unique token and cache it (thus invalidating any previous tokens), and a "verify_email_change" view to verify the token and update the email. These functions will incorporate error handling for edge cases such as missing fields, email conflicts, and expired/invalid tokens.
This update will create the JavaScript solution in the file website/static/js/update_email.js to implement an “Update Email” modal popup. The code attaches event handlers on page load to display a modal when the user clicks the "Update Email" button, validates the newly entered email using regex, and sends an AJAX POST request to the server endpoint ("/update_email/") with the new email data. On a successful response, it alerts the user that a new verification link has been sent (thereby invalidating any previous links on the server side), resets the form, and closes the modal. It also handles errors by re-enabling the Submit button and displaying an error message.

A summary of the context that CodeRabbit is considering across the codebase:

To implement the “update email” feature we will add a modal‐based email update mechanism that creates a new EmailChangeRequest for each email‐change submission. The model’s save() method will automatically invalidate any previous valid tokens (ensuring that the first verification link is no longer valid when a new request is made). In addition, we will build a simple form to capture the new email, two views – one for processing the request and sending the verification email and the other for verifying the new token – update URL patterns to expose the endpoints, and add front‑end changes (a button and modal) on the profile page.
We executed a shell script to search for existing uses of send_email_confirmation to ensure our implementation aligns with django-allauth's usage in the codebase. The deletion of EmailConfirmation objects in our view ensures that any previously issued verification link becomes invalid once a new verification email is sent.
[ ] ✅ Create PR with these edits
[ ] 📋 Get copyable edits
[ ] 🔄 Try a different approach

Mar 30 '25 18:03 coderabbitai[bot]

@CodeRabbit pls code it and also remember that the change email option should be displayed on the page that say "Confirmation link has been sent to (older email)"

Mar 30 '25 18:03 Himanshu-639

Oops, something went wrong! Please try again later. 🐰 💔

Mar 30 '25 18:03 coderabbitai[bot]

Oops, something went wrong! Please try again later. 🐰 💔

Mar 30 '25 18:03 coderabbitai[bot]

@CodeRabbit pls code it and also remember that the change email option should be displayed on the page that say "Confirmation link has been sent to (older email)"

Mar 31 '25 07:03 Himanshu-639

[!TIP] For best results, initiate chat on the files or code changes.

Mar 31 '25 07:03 coderabbitai[bot]

Oops, something went wrong! Please try again later. 🐰 💔

Mar 31 '25 07:03 coderabbitai[bot]