def recover_account_view(context, request): form = Form(RecoverAccount(), buttons=('recover',)) rendered_form = form.render(null) confirmed = request.registry.queryAdapter(context, IRegistrations, name='confirmed') if confirmed is None: #pragma NO COVERAGE confirmed = ConfirmedRegistrations(context) login_url = view_url(context, request, 'login_url', 'login.html') registry = request.registry message = request.GET.get('message') if 'recover' in request.POST: try: appstruct = form.validate(request.POST.items()) except ValidationFailure, e: #pragma NO COVER rendered_form = e.render() else: email = appstruct['email'] record = confirmed.get_by_email(email) if record is not None: from_addr = registry.settings['cartouche.from_addr'] login = record.login body = RECOVERY_EMAIL % {'login': login, 'login_url': login_url} delivery = registry.queryUtility(IMailDelivery, default=localhost_mta) email_message = Message() email_message['Subject'] = 'Account recovery' email_message.set_payload(body) delivery.send(from_addr, [email], email_message) #else: # DO NOT report lookup errors return HTTPFound(location=login_url)
def confirm_registration_view(context, request): form = Form(Confirm(), buttons=('confirm',)) pending = request.registry.queryAdapter(context, IRegistrations, name='pending') if pending is None: #pragma NO COVERAGE pending = PendingRegistrations(context) if 'confirm' in request.POST: try: appstruct = form.validate(request.POST.items()) except ValidationFailure, e: rendered_form = e.render() else: email = appstruct['email'] token = appstruct['token'] info = pending.get(email) if info is None: return HTTPFound( location=view_url(context, request, 'register_url', 'register.html', message=REGISTER_FIRST, )) if token != info.token: return HTTPFound( location=view_url(context, request, 'confirmation_url', 'confirm_registration.html', email=email, message=CHECK_TOKEN, )) confirmed = request.registry.queryAdapter(context, IRegistrations, name='confirmed') if confirmed is None: #pragma NO COVERAGE confirmed = ConfirmedRegistrations(context) pending.remove(email) uuid = getRandomToken(request) confirmed.set(uuid, email=email, login=email, password=None, security_question=None, security_answer=None, token=None, ) info = confirmed.get(uuid) after_confirmation_url = view_url(context, request, 'after_confirmation_url', 'edit_account.html', ) auto_login = request.registry.queryUtility(IAutoLogin) if auto_login is not None: headers = auto_login(uuid, request) return HTTPFound(location=after_confirmation_url, headers=headers) else: sendGeneratedPassword(request, uuid, confirmed) return HTTPFound(location=after_confirmation_url)
def edit_account_view(context, request): confirmed = request.registry.queryAdapter(context, IRegistrations, name='confirmed') if confirmed is None: #pragma NO COVERAGE confirmed = ConfirmedRegistrations(context) identity = request.environ.get('repoze.who.identity') if identity is None: return HTTPUnauthorized() userid = identity['repoze.who.userid'] account_info = confirmed.get(userid) if account_info is None: return HTTPForbidden() appstruct = { 'login_name': account_info.login, 'email': account_info.email, 'security': { 'question': account_info.security_question or '', 'answer': account_info.security_answer or '', }, } schema = EditAccount().bind(current_login_name=account_info.login, confirmed=confirmed, old_password=account_info.password) form = Form(schema, buttons=('update', )) rendered_form = form.render(appstruct) if 'update' in request.POST: try: appstruct = form.validate(request.POST.items()) except ValidationFailure, e: rendered_form = e.render() else: login = appstruct['login_name'] email = appstruct['email'] pwd_mgr = SSHAPasswordManager() password = pwd_mgr.encodePassword(appstruct['password']) security_question = appstruct['security']['question'] security_answer = appstruct['security']['answer'] confirmed.set( userid, email=email, login=login, password=password, security_question=security_question, security_answer=security_answer, ) return HTTPFound(location=view_url( context, request, 'after_edit_url', request.view_name, ))
def edit_account_view(context, request): confirmed = request.registry.queryAdapter(context, IRegistrations, name='confirmed') if confirmed is None: #pragma NO COVERAGE confirmed = ConfirmedRegistrations(context) identity = request.environ.get('repoze.who.identity') if identity is None: return HTTPUnauthorized() userid = identity['repoze.who.userid'] account_info = confirmed.get(userid) if account_info is None: return HTTPForbidden() appstruct = {'login_name': account_info.login, 'email': account_info.email, 'security': {'question': account_info.security_question or '', 'answer': account_info.security_answer or '', }, } schema = EditAccount().bind(current_login_name=account_info.login, confirmed=confirmed, old_password=account_info.password) form = Form(schema, buttons=('update',)) rendered_form = form.render(appstruct) if 'update' in request.POST: try: appstruct = form.validate(request.POST.items()) except ValidationFailure, e: rendered_form = e.render() else: login = appstruct['login_name'] email = appstruct['email'] pwd_mgr = SSHAPasswordManager() password = pwd_mgr.encodePassword(appstruct['password']) security_question = appstruct['security']['question'] security_answer = appstruct['security']['answer'] confirmed.set(userid, email=email, login=login, password=password, security_question=security_question, security_answer=security_answer, ) return HTTPFound( location=view_url(context, request, 'after_edit_url', request.view_name, ))
def _getConfirmed(self, request): context = request.context confirmed = request.registry.queryAdapter(context, IRegistrations, name='confirmed') if confirmed is None: confirmed = ConfirmedRegistrations(context) return confirmed
def authenticate(self, environ, identity): """ See IAuthenticator. """ login = identity.get('login') password = identity.get('password') if login is not None and password is not None: request = get_current_request() context = getattr(request, 'context', None) registry = get_current_registry() confirmed = registry.queryAdapter(context, IRegistrations, name='confirmed') if confirmed is None: if getattr(context, '_p_jar', None) is None: context = self._getFinder()(environ) while context.__parent__ is not None: context = context.__parent__ confirmed = ConfirmedRegistrations(context) record = confirmed.get_by_login(login) if record and self._pwd_mgr.checkPassword(record.password, password): return record.uuid
def authenticate(self, environ, identity): """ See IAuthenticator. """ login = identity.get('login') password = identity.get('password') if login is not None and password is not None: request = get_current_request() context = getattr(request, 'context', None) registry = get_current_registry() confirmed = registry.queryAdapter(context, IRegistrations, name='confirmed') if confirmed is None: if getattr(context, '_p_jar', None) is None: context = self._getFinder()(environ) while context.__parent__ is not None: context = context.__parent__ confirmed = ConfirmedRegistrations(context) record = confirmed.get_by_login(login) if record and self._pwd_mgr.checkPassword(record.password, password): return record.uuid
def admin_confirmed(context, request): # Edit one pending registration confirmed = request.registry.queryAdapter(context, IRegistrations, name='confirmed') if confirmed is None: confirmed = ConfirmedRegistrations(context) login = request.params['confirmed'] record = confirmed.get_by_login(login) if record is None: return HTTPNotFound() main_template = get_renderer('templates/main.pt') return {'main_template': main_template.implementation(), 'page_title': 'Edit Confirmed Registration', 'login': login, 'uuid': record.uuid, 'password': record.password, 'token': record.token, 'security_question': record.security_question, 'security_answer': record.security_answer, }
def add_admin_user(): __doc__ = """ Make an existing cartouche user a member of the 'admin' group. Usage: %s config_uri login """ try: config_uri, login = sys.argv[1:] except: print __doc__ % sys.argv[0] sys.exit[2] ini_file = config_uri.split('#')[0] if not os.path.isfile(ini_file): print __doc__ % sys.argv[0] print print 'Invalid config file:', ini_file print sys.exit[2] env = bootstrap(config_uri) request, root = env['request'], env['root'] confirmed = request.registry.queryAdapter(root, IRegistrations, name='confirmed') if confirmed is None: confirmed = ConfirmedRegistrations(root) info = confirmed.get_by_login(login) if info is None: print __doc__ % sys.argv[0] print print 'Invalid login:'******'group_users').get('g:admin') or [] if info.uuid not in admins: admins.append(info.uuid) confirmed._getMapping('group_users')['g:admin'] = admins groups = confirmed._getMapping('user_groups').get(info.uuid) or [] groups.append('g:admin') confirmed._getMapping('user_groups')[info.uuid] = groups transaction.commit() env['closer']()
def admin_confirmed(context, request): # Edit one pending registration confirmed = request.registry.queryAdapter(context, IRegistrations, name='confirmed') if confirmed is None: confirmed = ConfirmedRegistrations(context) login = request.params['confirmed'] record = confirmed.get_by_login(login) if record is None: return HTTPNotFound() main_template = get_renderer('templates/main.pt') return { 'main_template': main_template.implementation(), 'page_title': 'Edit Confirmed Registration', 'login': login, 'uuid': record.uuid, 'password': record.password, 'token': record.token, 'security_question': record.security_question, 'security_answer': record.security_answer, }
def admin_overview(context, request): pending = request.registry.queryAdapter(context, IRegistrations, name='pending') if pending is None: pending = PendingRegistrations(context) confirmed = request.registry.queryAdapter(context, IRegistrations, name='confirmed') if confirmed is None: confirmed = ConfirmedRegistrations(context) main_template = get_renderer('templates/main.pt') return { 'main_template': main_template.implementation(), 'pending': sorted(pending), 'confirmed': sorted(confirmed), }
def add_admin_user(): __doc__ = """ Make an existing cartouche user a member of the 'admin' group. Usage: %s config_uri login """ try: config_uri, login = sys.argv[1:] except: print __doc__ % sys.argv[0] sys.exit[2] ini_file = config_uri.split('#')[0] if not os.path.isfile(ini_file): print __doc__ % sys.argv[0] print print 'Invalid config file:', ini_file print sys.exit[2] env = bootstrap(config_uri) request, root = env['request'], env['root'] confirmed = request.registry.queryAdapter(root, IRegistrations, name='confirmed') if confirmed is None: confirmed = ConfirmedRegistrations(root) info = confirmed.get_by_login(login) if info is None: print __doc__ % sys.argv[0] print print 'Invalid login:'******'group_users').get('g:admin') or [] if info.uuid not in admins: admins.append(info.uuid) confirmed._getMapping('group_users')['g:admin'] = admins groups = confirmed._getMapping('user_groups').get(info.uuid) or [] groups.append('g:admin') confirmed._getMapping('user_groups')[info.uuid] = groups transaction.commit() env['closer']()
def confirm_registration_view(context, request): form = Form(Confirm(), buttons=('confirm', )) pending = request.registry.queryAdapter(context, IRegistrations, name='pending') if pending is None: #pragma NO COVERAGE pending = PendingRegistrations(context) if 'confirm' in request.POST: try: appstruct = form.validate(request.POST.items()) except ValidationFailure, e: rendered_form = e.render() else: email = appstruct['email'] token = appstruct['token'] info = pending.get(email) if info is None: return HTTPFound(location=view_url( context, request, 'register_url', 'register.html', message=REGISTER_FIRST, )) if token != info.token: return HTTPFound(location=view_url( context, request, 'confirmation_url', 'confirm_registration.html', email=email, message=CHECK_TOKEN, )) confirmed = request.registry.queryAdapter(context, IRegistrations, name='confirmed') if confirmed is None: #pragma NO COVERAGE confirmed = ConfirmedRegistrations(context) pending.remove(email) uuid = getRandomToken(request) confirmed.set( uuid, email=email, login=email, password=None, security_question=None, security_answer=None, token=None, ) info = confirmed.get(uuid) after_confirmation_url = view_url( context, request, 'after_confirmation_url', 'edit_account.html', ) auto_login = request.registry.queryUtility(IAutoLogin) if auto_login is not None: headers = auto_login(uuid, request) return HTTPFound(location=after_confirmation_url, headers=headers) else: sendGeneratedPassword(request, uuid, confirmed) return HTTPFound(location=after_confirmation_url)
def reset_password_view(context, request): form = Form(ResetPassword(), buttons=('reset',)) rendered_form = form.render(null) confirmed = request.registry.queryAdapter(context, IRegistrations, name='confirmed') if confirmed is None: #pragma NO COVERAGE confirmed = ConfirmedRegistrations(context) login_url = view_url(context, request, 'login_url', 'login.html') reset_url = resource_url(context, request, request.view_name) registry = request.registry message = request.GET.get('message') if 'reset' in request.POST: try: appstruct = form.validate(request.POST.items()) except ValidationFailure as e: rendered_form = e.render() else: login = appstruct['login_name'] token = appstruct['token'] record = confirmed.get_by_login(login) if record is None: # DO NOT report lookup errors return HTTPFound(location=login_url) if token == '': # send the e-mail new_token = getRandomToken(request) confirmed.set(record.uuid, email=record.email, login=login, password=record.password, security_question=record.security_question, security_answer=record.security_answer, token=new_token, ) from_addr = registry.settings['cartouche.from_addr'] body = RESET_EMAIL % {'token': new_token, 'reset_url': reset_url} delivery = registry.queryUtility(IMailDelivery, default=localhost_mta) message = Message() message['Subject'] = 'Password reset confirmation' message.set_payload(body) delivery.send(from_addr, [record.email], message) return HTTPFound(location=reset_url) else: if token != record.token: message = CHECK_TOKEN # fall through to 'GET' else: confirmed.set(record.uuid, email=record.email, login=record.login, password=None, # clear it to allow update security_question=record.security_question, security_answer=record.security_answer, token=None, # clear it ) after_reset_url = view_url(context, request, 'after_reset_url', 'edit_account.html', ) auto_login = request.registry.queryUtility(IAutoLogin) if auto_login is not None: headers = auto_login(record.uuid, request) return HTTPFound(location=after_reset_url, headers=headers) else: # TODO: generate random password and send e-mail. sendGeneratedPassword(request, record.uuid, confirmed) return HTTPFound(location=after_reset_url) main_template = get_renderer('templates/main.pt') return {'main_template': main_template.implementation(), 'message': message, 'rendered_form': rendered_form, 'recover_account_url': view_url(context, request, 'recover_account_url', 'recover_account.html'), }
def reset_password_view(context, request): form = Form(ResetPassword(), buttons=('reset',)) rendered_form = form.render(null) confirmed = request.registry.queryAdapter(context, IRegistrations, name='confirmed') if confirmed is None: #pragma NO COVERAGE confirmed = ConfirmedRegistrations(context) login_url = view_url(context, request, 'login_url', 'login.html') reset_url = resource_url(context, request, request.view_name) registry = request.registry message = request.GET.get('message') if 'reset' in request.POST: try: appstruct = form.validate(request.POST.items()) except ValidationFailure, e: rendered_form = e.render() else: login = appstruct['login_name'] token = appstruct['token'] record = confirmed.get_by_login(login) if record is None: # DO NOT report lookup errors return HTTPFound(location=login_url) if token == '': # send the e-mail new_token = getRandomToken(request) confirmed.set(record.uuid, email=record.email, login=login, password=record.password, security_question=record.security_question, security_answer=record.security_answer, token=new_token, ) from_addr = registry.settings['cartouche.from_addr'] body = RESET_EMAIL % {'token': new_token, 'reset_url': reset_url} delivery = registry.queryUtility(IMailDelivery, default=localhost_mta) message = Message() message['Subject'] = 'Password reset confirmation' message.set_payload(body) delivery.send(from_addr, [record.email], message) return HTTPFound(location=reset_url) else: if token != record.token: message = CHECK_TOKEN # fall through to 'GET' else: confirmed.set(record.uuid, email=record.email, login=record.login, password=None, # clear it to allow update security_question=record.security_question, security_answer=record.security_answer, token=None, # clear it ) after_reset_url = view_url(context, request, 'after_reset_url', 'edit_account.html', ) auto_login = request.registry.queryUtility(IAutoLogin) if auto_login is not None: headers = auto_login(record.uuid, request) return HTTPFound(location=after_reset_url, headers=headers) else: # TODO: generate random password and send e-mail. sendGeneratedPassword(request, record.uuid, confirmed) return HTTPFound(location=after_reset_url)