Don't change email until user confirms it

apps/account/migrations/0009_user_unconfirmed_email.py

@@ -0,0 +1,18 @@
+# Generated by Django 2.2.4 on 2019-10-10 14:40
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('account', '0008_auto_20190912_1325'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='user',
+            name='unconfirmed_email',
+            field=models.EmailField(blank=True, default=None, max_length=254, null=True, verbose_name='unconfirmed email'),
+        ),
+    ]

apps/account/models.py

@@ -60,6 +60,7 @@ class User(AbstractUser):
                                         blank=True, null=True, default=None)
     email = models.EmailField(_('email address'), blank=True,
                               null=True, default=None)
+    unconfirmed_email = models.EmailField(_('unconfirmed email'), blank=True, null=True, default=None)
     email_confirmed = models.BooleanField(_('email status'), default=False)
     newsletter = models.NullBooleanField(default=True)
 
@@ -112,6 +113,8 @@ class User(AbstractUser):
 
     def confirm_email(self):
         """Method to confirm user email address"""
+        self.email = self.unconfirmed_email
+        self.unconfirmed_email = None
         self.email_confirmed = True
         self.save()
 

apps/account/serializers/common.py

@@ -61,9 +61,12 @@ class UserSerializer(serializers.ModelSerializer):
 
     def update(self, instance, validated_data):
         """Override update method"""
+        old_email = instance.email
         instance = super().update(instance, validated_data)
         if 'email' in validated_data:
             instance.email_confirmed = False
+            instance.email = old_email
+            instance.unconfirmed_email = validated_data['email']
             instance.save()
             # Send verification link on user email for change email address
             if settings.USE_CELERY: