Repository: pennersr/django-allauth

Issue:
Setting a user's password always logs them out
I believe "set password" should honor `ACCOUNT_LOGOUT_ON_PASSWORD_CHANGE`, that is:

``` diff
diff --git a/allauth/account/views.py b/allauth/account/views.py
index f4cc684..f06b8a4 100644
--- a/allauth/account/views.py
+++ b/allauth/account/views.py
@@ -525,6 +525,9 @@ class PasswordSetView(AjaxCapableProcessFormViewMixin, FormView):

     def form_valid(self, form):
         form.save()
+        if (update_session_auth_hash is not None and
+                not app_settings.LOGOUT_ON_PASSWORD_CHANGE):
+            update_session_auth_hash(self.request, form.user)
         get_adapter().add_message(self.request,
                                   messages.SUCCESS,
                                   'account/messages/password_set.txt')
```

Alternatively you could provide a `ACCOUNT_LOGOUT_ON_PASSWORD_SET` setting that would default to the value of `ACCOUNT_LOGOUT_ON_PASSWORD_CHANGE`. But I fail to imagine a reason why one would want them to have different values.



Discussion:
+1
`ACCOUNT_LOGOUT_ON_PASSWORD_CHANGE = False` is not respected in `PasswordSetView`.
If you set your password for first time (if only social login) then you are logged out after setting password.
@aaugustin if your example fixes bug, could you make PR?
Thanks.

I could, but I'd like to hear back from a maintainer about their preferred approach first.

(It isn't hard to copy-paste the diff above either.)

@aaugustin Same code is applied to `PasswordChangeView` and i can't see any reason why it shouldn't be applied to `PasswordSetView` as well. 
Oh, but you're thinking wether you should introduce new config variable, ok, I get it.
Logging out users on password is not a very needed feature, it is more of a side-effect and not natural for actual users changing password. I would definitely consider it a bug if an app log me out because I change password.
My opinion is that we should not introduce new one, but use same param.

@aaugustin Agreed -- this should be rectified. It is really not worthwhile introducing a setting for this. It does deserve a note in the `changelog.rst` so that people become aware this behavior was changed.
Minor nitpick about the proposed code change -- I would prefer to move this logic in one shared method to keep things DRY...


Resolving patch:
diff --git a/allauth/account/utils.py b/allauth/account/utils.py
--- a/allauth/account/utils.py
+++ b/allauth/account/utils.py
@@ -17,6 +17,11 @@
 
 from allauth.compat import OrderedDict
 
+try:
+    from django.contrib.auth import update_session_auth_hash
+except ImportError:
+    update_session_auth_hash = None
+
 try:
     from django.utils.encoding import force_text
 except ImportError:
@@ -59,6 +64,15 @@ def get_login_redirect_url(request, url=None, redirect_field_name="next"):
 _user_display_callable = None
 
 
+def logout_on_password_change(request, user):
+    # Since it is the default behavior of Django to invalidate all sessions on
+    # password change, this function actually has to preserve the session when
+    # logout isn't desired.
+    if (update_session_auth_hash is not None and
+            not app_settings.LOGOUT_ON_PASSWORD_CHANGE):
+        update_session_auth_hash(request, user)
+
+
 def default_user_display(user):
     if app_settings.USER_MODEL_USERNAME_FIELD:
         return getattr(user, app_settings.USER_MODEL_USERNAME_FIELD)
diff --git a/allauth/account/views.py b/allauth/account/views.py
--- a/allauth/account/views.py
+++ b/allauth/account/views.py
@@ -28,11 +28,6 @@
 
 from .adapter import get_adapter
 
-try:
-    from django.contrib.auth import update_session_auth_hash
-except ImportError:
-    update_session_auth_hash = None
-
 
 sensitive_post_parameters_m = method_decorator(
     sensitive_post_parameters('password', 'password1', 'password2'))
@@ -481,9 +476,7 @@ def get_form_kwargs(self):
 
     def form_valid(self, form):
         form.save()
-        if (update_session_auth_hash is not None and
-                not app_settings.LOGOUT_ON_PASSWORD_CHANGE):
-            update_session_auth_hash(self.request, form.user)
+        logout_on_password_change(self.request, form.user)
         get_adapter().add_message(self.request,
                                   messages.SUCCESS,
                                   'account/messages/password_changed.txt')
@@ -525,6 +518,7 @@ def get_form_kwargs(self):
 
     def form_valid(self, form):
         form.save()
+        logout_on_password_change(self.request, form.user)
         get_adapter().add_message(self.request,
                                   messages.SUCCESS,
                                   'account/messages/password_set.txt')


Test patch: