Ashesh Vashi 58c531d831 Act only on the internal account when accounts from other sources share its email or username. #10676 ...

The same email or username may belong to accounts from several auth
sources. Flask-Security looks the account up by email alone, and took
whichever row came first:

- Internal login checked the password against that row, so an internal
  user could not log in when an LDAP or OAuth2 account with the same
  email was found first. Flask-Security's lookup now prefers the internal
  account; ignoring case, it prefers the one matching exactly, then the
  oldest. A missing email or username identifies no account.
- A password reset was sent for whichever account had the email, and a
  reset token for an account from another source was accepted, giving it
  a local password and logging it in. Reset instructions are now sent
  for the internal account, and a token for any other account is
  refused.
- The About box showed the configuration to any user whose email was
  that of an administrator's account, whatever its source. It now checks
  the user's own role.

The test runner excluded every test module whose name started with one
on its desktop mode list, so excluding test_reset_password also excluded
test_reset_password_auth_source. Each entry now excludes only the module
it names, and the server mode only modules are listed.

2026-10-25 16:01:14 +05:30

..

__init__.py

Act only on the internal account when accounts from other sources share its email or username. #10676

2026-10-25 16:01:14 +05:30

test_about_admin_auth_source.py

Act only on the internal account when accounts from other sources share its email or username. #10676

2026-10-25 16:01:14 +05:30