Repository: wagtail/wagtail

Issue:
When changing your password from with admin a user is presented with an edit button. 
I've just reset my password from within admin and I get this horrible large edit button. 
<img width="1267" alt="screen shot 2018-01-16 at 12 33 46" src="https://user-images.githubusercontent.com/7290588/34989276-e10b3338-fab9-11e7-9e69-05d1c7846af4.png">

Can we remove the edit button and amend the message to say 'Your details have been updated. You've been logged out for security reasons, please login to continue.' or something like this. 
When changing your password from with admin a user is presented with an edit button. 
I've just reset my password from within admin and I get this horrible large edit button. 
<img width="1267" alt="screen shot 2018-01-16 at 12 33 46" src="https://user-images.githubusercontent.com/7290588/34989276-e10b3338-fab9-11e7-9e69-05d1c7846af4.png">

Can we remove the edit button and amend the message to say 'Your details have been updated. You've been logged out for security reasons, please login to continue.' or something like this. 


Discussion:

Resolving patch:
diff --git a/wagtail/users/views/users.py b/wagtail/users/views/users.py
--- a/wagtail/users/views/users.py
+++ b/wagtail/users/views/users.py
@@ -1,5 +1,5 @@
 from django.conf import settings
-from django.contrib.auth import get_user_model
+from django.contrib.auth import get_user_model, update_session_auth_hash
 from django.db.models import Q
 from django.shortcuts import get_object_or_404, redirect, render
 from django.urls import reverse
@@ -149,8 +149,14 @@ def edit(request, user_id):
         form = get_user_edit_form()(request.POST, request.FILES, instance=user, editing_self=editing_self)
         if form.is_valid():
             user = form.save()
-            messages.success(request, _("Your details have been updated. You've been logged out for security reasons, "
-                                        "please login to continue."))
+
+            if user == request.user and 'password1' in form.changed_data:
+                # User is changing their own password; need to update their session hash
+                update_session_auth_hash(request, user)
+
+            messages.success(request, _("User '{0}' updated.").format(user), buttons=[
+                messages.button(reverse('wagtailusers_users:edit', args=(user.pk,)), _('Edit'))
+            ])
             for fn in hooks.get_hooks('after_edit_user'):
                 result = fn(request, user)
                 if hasattr(result, 'status_code'):


Test patch:
diff --git a/wagtail/users/tests.py b/wagtail/users/tests.py
--- a/wagtail/users/tests.py
+++ b/wagtail/users/tests.py
@@ -768,6 +768,29 @@ def test_edit_self(self):
         # Check that the user is still active
         self.assertEqual(user.is_active, True)
 
+    def test_editing_own_password_does_not_log_out(self):
+        response = self.post({
+            'username': 'test@email.com',
+            'email': 'test@email.com',
+            'first_name': "Edited Myself",
+            'last_name': "User",
+            'password1': "c0rrecth0rse",
+            'password2': "c0rrecth0rse",
+            'is_active': 'on',
+            'is_superuser': 'on',
+        }, self.current_user.pk)
+
+        # Should redirect back to index
+        self.assertRedirects(response, reverse('wagtailusers_users:index'))
+
+        # Check that the user was edited
+        user = get_user_model().objects.get(pk=self.current_user.pk)
+        self.assertEqual(user.first_name, 'Edited Myself')
+
+        # Check user is not logged out
+        response = self.client.get(reverse('wagtailusers_users:index'))
+        self.assertEqual(response.status_code, 200)
+
     def test_cannot_demote_self(self):
         """
         check that unsetting a user's own is_active or is_superuser flag has no effect