better login and change pwd

auth.py

@@ -52,11 +52,16 @@ def login():
             if user.group_id>0:
                 login_user(user)
                 return redirect(url_for("lists.home"))
-        flash("Invalid key credentials.")
+        # flash("Invalid key credentials.")
         Log.info(f"Authorization failure for user '{request.form["name"]}' ")
 
     
-    resp = make_response(render_template("login.html"))
+    login_failed = request.method == "POST"
+    resp = make_response(render_template(
+        "login.html",
+        name_placeholder="Sorry" if login_failed else "Name",
+        password_placeholder="Try again" if login_failed else "Password",
+    ))
     resp.set_cookie('username', '')
     return resp
     
@@ -100,14 +105,16 @@ def change_pwd():
         pwd_old = request.form["password_old"]
         pwd_new1 = request.form["password_new1"]
         pwd_new2 = request.form["password_new2"]
-        if current_user.check_password(pwd_old):
+        if not current_user.check_password(pwd_old):
-            if pwd_new1 == pwd_new2:
+            flash("Invalid old credentials")
-                current_user.set_password(pwd_new2)
+            Log.info(f"Authorization failure for user '{current_user.name}' ")
-                db.session.commit()
+        elif pwd_new1 != pwd_new2:
-                return redirect(url_for("lists.home"))
             flash("New Passwords are not identical")
-        flash("Invalid credentials")
+        else:
-        Log.info(f"Authorization failure for user '{request.form["name"]}' ")
+            current_user.set_password(pwd_new2)
+            db.session.commit()
+            return redirect(url_for("lists.home"))
+
+        return redirect(url_for("auth.change_pwd"))
 
-        return render_template(url_for("lists.home"))
     return render_template("change_pwd.html")

templates/change_pwd.html

@@ -1,6 +1,11 @@
 {% extends "base.html" %}
 {% block content %}
 <h3 class="text-center mb-4"><img style="width: 3em; height: 3em" src="/static/login.svg"></h3>
+{% with messages = get_flashed_messages() %}
+  {% for message in messages %}
+    <div class="alert alert-danger" role="alert">{{ message }}</div>
+  {% endfor %}
+{% endwith %}
 <form method="post">
 
   <input class="form-control mb-3" name="password_old" type="password" placeholder="Old Password" required>

templates/login.html

@@ -13,8 +13,8 @@
   </div>
 </div>
 <form method="post">
-  <input class="form-control mb-3" name="name" placeholder="Name" required>
+  <input class="form-control mb-3" name="name" placeholder="{{ name_placeholder }}" required>
-  <input class="form-control mb-3" name="password" type="password" placeholder="Password" required>
+  <input class="form-control mb-3" name="password" type="password" placeholder="{{ password_placeholder }}" required>
     <input
     type="image"
     src="/static/save.svg"