Flask Python中的登录逻辑无效

Question

I'm using Flask with SQLAlchemy and Flask-Login.

I can successfully login and logout a registered user.

What I find confusing is when I enter an incorrect password on the login page, I'm returned to the login page with a flash message of "Welcome user@email.com", which I would have thought, based on the code, would only appear if I successfully logged in.

@app.route('/login', methods=['GET', 'POST'])
def login():
    form = LoginForm()
        user = User.query.filter_by(email=form.email.data).first()
        if form.validate_on_submit():
            if user and check_password_hash(user.password, form.password.data):
                session['user_id'] = user.id
                flash('Welcome %s' % user.email)
                return redirect(url_for('dashboard'))
            else:
                flash('Wrong email or password')
                return render_template("login.html", form=form)
        flash('The email or password is wrong.')

    return render_template("login.html", form=form)

EDIT : Thanks to Tigra, this is what I ended up with.

In views.py

@app.route('/login', methods=['GET', 'POST'])
def login():
    form = LoginForm()
    user = User.query.filter_by(email=form.email.data).first()
    if request.method == "POST":
        if form.validate():
            # the session can't be modified as it's signed, 
            # so it's a safe place to store the user
            session['user_id'] = user.id
            flash('Welcome %s' % user.email)
            return redirect(url_for('dashboard'))
        else:
            flash('Wrong email or password')
            return render_template("login.html", form=form)
    return render_template("login.html", form=form)

In forms.py

from models import User
from werkzeug import check_password_hash

class LoginForm(Form):
    email = TextField('email', validators = [Required(), Email()])
    password = PasswordField('password', validators = [Required()])
    remember_me = BooleanField('remember_me', default = False)

    def __init__(self, *args, **kwargs):
        Form.__init__(self, *args, **kwargs)
        self.user = None

    def validate(self):
        rv = Form.validate(self)
        if not rv:
            return False

        user = User.query.filter_by(email=self.email.data).first()
        if user is None:
            self.email.errors.append('Unknown username')
            return False

        if not check_password_hash(user.password,self.password.data):
            self.password.errors.append('Invalid password')
            return False

        self.user = user
        return True

Answer 1

You have two problems:

1) You should not make such a check (login/password) after form validation. It should be defined inside form itself, read about custom validators for wtforms

2) Also, make sure, that formatting you presented is actual one, becouse you have at least mistake in presented formatting:

form = LoginForm()
    user = User.query.filter_by(email=form.email.data).first()

So can't be sure there is not more.
Also, your passcheck function is from werzkeug.security?

As for Form custom validation there is one example:
With this approach actual validation fails, not additional check

class LoginForm(SafeForm):
   email=TextField(__("E-Mail"),validators=[Required()])
   password=PasswordField(__("Password"),validators=[Required()])
   submit=SubmitField(__("Login"))

   def __init__(self,*k,**kk):
      self._user=None #for internal user storing
      super(LoginForm,self).__init__(*k,**kk)

   def validate(self):
       self._user=User.query.filter(User.email==self.email.data).first()
       return super(LoginForm,self).validate()

   def validate_email(self,field):
       if self._user is None:
           raise ValidationError(_("E-Mail not recognized"))


   def validate_password(self,field):
       if self._user is None:
           raise ValidationError() #just to be sure
       if not self._user.validate_password(self.password.data): #passcheck embedded into user model
           raise ValidationError(_("Password incorrect"))