Ejemplo n.º 1
0
def delete_post(num):
    """
    Delete a post
    """
    if num is None:
        return render_template('noink_message.html', state=get_state(),
            title=_('No entry specified!'),
            message=_('You have not supplied an entry to delete.'))

    entry_db = EntryDB()

    entry = entry_db.find_by_id(num)

    if entry is None:
        return render_template('noink_message.html', state=get_state(),
            title=_('Entry not found!'),
            message=_('The entry "{0}" was not found!'.format(num)))

    if not is_deletable(entry):
        return render_template('noink_message.html', state=get_state(),
            title=_('Unable to delete entry!'),
            message=_('You do not have permission to delete this entry!'))

    if request.method == 'POST':
        if "delete" in request.form:
            entry_db.delete(entry)
            flash(_('Entry "{0}" deleted!'.format(num)))
            return redirect(url_for('list_entries.show'))
        elif "cancel" in request.form:
            return  redirect(url_for("node.show_node", num=num))

    return render_template('delete_post.html', state=get_state(),
            entry=entry, is_edit=True)
Ejemplo n.º 2
0
 def decorated_function(*args, **kwargs):
     s = get_state()
     if mainApp.config['REQUIRE_LOGIN_FOR_DYNAMIC'] and not s.icebox:
         if not current_user.is_authenticated() or not \
                 current_user.is_active():
             return redirect(url_for('login.login_page', next=request.url))
     return f(*args, **kwargs)
Ejemplo n.º 3
0
def show(tag):
    '''
    Renders a page containing those entries defined by tag. If tag is None,
    will yield all entries.
    '''
    page_num = int(request.args.get('page', 0))
    per_page = mainApp.config['NUM_ENTRIES_PER_PAGE'][0]

    entryDB = EntryDB()
    if tag:
        entries = entryDB.find_by_tags([tag])
        static_entries = None
        count = per_page
    else:
        entries = entryDB.find_recent_by_num(per_page, page_num * per_page)
        static_entries = None
        if page_num == 0:
            static_entries = entryDB.find_static()
        count = entryDB.count()

    total_pages = 0
    if count > per_page:
        total_pages = int(ceil(float(count) / float(per_page)))

    return render_template('list_entries.html', entries=entries,
        state=get_state(), page_num=page_num, total_pages=total_pages,
        static_entries=static_entries)
Ejemplo n.º 4
0
def _not_auth():
    return render_template(
        "noink_message.html",
        state=get_state(),
        title=_("Not authorized"),
        message=_("You are not authorized to vew this page!"),
    )
Ejemplo n.º 5
0
def logout_user():
    udb = UserDB()
    if current_user.is_authenticated() and current_user.is_active():
        if udb.logout(current_user):
            flash(_('Logged out.'))
            return redirect(request.args.get("next") or url_for("list_entries.show"))

    return render_template('noink_message.html', state=get_state(),
        title=_('Problem logging out'),
        message=_('There was a problem logging you out (were you logged in?)'))
Ejemplo n.º 6
0
def edit(num):
    """
    Edit post page
    """
    if num is None:
        return render_template('noink_message.html', state=get_state(),
            title=_('No entry specified!'),
            message=_('You have not supplied an entry to edit.'))

    return _edit_post(num)
Ejemplo n.º 7
0
def login_page():
    if request.method == "POST" and "username" in request.form:
        username = request.form["username"]
        password = request.form.get("password", None)
        remember = request.form.get('remember', 'no') == "yes"
        udb = UserDB()
        if udb.authenticate(username, password, remember):
            flash(_('%s logged in.' % username))
            return redirect(request.args.get("next") or \
                url_for("list_entries.show"))
        else:
            flash(_('Problem logging in.'), 'error')
    return render_template('login.html', state=get_state(),
        title=_('Login'), submit_button=_('Login'))
Ejemplo n.º 8
0
def static_page():
    """
    Render the administrative static page
    """
    user_db = UserDB()
    role_db = RoleDB()
    event_log = EventLog()
    icebox = Icebox()

    if current_user.is_authenticated() and current_user.is_active():
        is_admin = user_db.in_group(current_user, mainApp.config['ADMIN_GROUP'])
        all_activities = set()
        for m in role_db.get_roles(current_user):
            acts = role_db.get_activities(m.role_id)
            for act in acts:
                if acts[act]:
                    all_activities.add(act)

        can_admin_static = 'make_static' in all_activities
        can_admin_static_now = 'make_static_now' in all_activities

        if is_admin or can_admin_static:
            if request.method == 'POST':
                if 'sched_rebuild' in request.form:
                    event_log.add('rebuild_static', current_user.id)
                    flash(_('Full site rebuild scheduled.'))
                elif 'incr_build' in request.form:
                    icebox.generate_pages()
                    flash(_('New/updated pages generated.'))
                elif 'rebuild_now' in request.form:
                    if can_admin_static_now:
                        icebox.generate_pages(True)
                        flash(_('Full site rebuilt'))
                    else:
                        flash(_('Not authorized for full site rebuild',
                            'error'))
            return render_template('admin_static.html', state=get_state(),
                    can_admin_static=can_admin_static,
                    can_admin_static_now=can_admin_static_now,
                    title=_('Administrate Static Site'),
                    sched_rebuild_text=_('Schedule a full site rebuild'),
                    sched_rebuild_button=_('Schedule'),
                    incr_build_text=_('Perform an incremental build'),
                    incr_build_button=_('Incremental'),
                    rebuild_now_text=_('Perform a full rebuild now'),
                    rebuild_now_button=_('Rebuild'))
        else:
            return _not_auth()
    else:
        return _not_auth()
Ejemplo n.º 9
0
def admin_new_role():
    """
    Renders the new role page
    """
    role_db = RoleDB()

    if current_user.is_authenticated() and current_user.is_active():
        all_activities = set()
        for m in role_db.get_roles(current_user):
            acts = role_db.get_activities(m.role_id)
            for act in acts:
                if acts[act]:
                    all_activities.add(act)

        if 'new_role' in all_activities:
            role = role_db.create_temp_empty_role()
            if 'cancel' in request.form:
                return redirect(url_for('admin_role.admin_role_page'))
            elif 'submit' in request.form:
                rname = request.form.get('role_name', None)
                role.name = rname
                role.description = request.form.get('description', None)
                updated_acts = request.form.getlist('activities')
                ract = get_activity_dict(False)
                for a in updated_acts:
                    ract[a] = True

                role = role_db.update_temp_role_activities(role, ract)
                if rname is not None and rname != '':
                    r = role_db.get_role(rname)
                    if r is None:
                        try:
                            role = role_db.add_role(role.name,
                                    role.description, ract)
                            flash(_('Role "{0}" added.'.format(rname)))
                            return redirect(url_for(
                                'admin_role.admin_role_page'))
                        except DuplicateRole:
                            flash(_('Role name "{0}" is already in use!'.format(
                                rname)), 'error')

            return render_template('admin_role.html', role=role,
                state=get_state(), title=_('Edit Role'),
                cancel_button=_('Cancel'), submit_button=_('Submit'),
                can_edit_roles=True, activities=activities)
        else:
            return _not_auth()
    else:
        return _not_auth()
Ejemplo n.º 10
0
def admin_new_group():
    """
    Renders the new group page
    """
    user_db = UserDB()
    role_db = RoleDB()

    if current_user.is_authenticated() and current_user.is_active():
        all_activities = set()
        for m in role_db.get_roles(current_user):
            acts = role_db.get_activities(m.role_id)
            for act in acts:
                if acts[act]:
                    all_activities.add(act)

        if 'new_group' in all_activities:
            group = user_db.create_temp_empty_group()
            if 'cancel' in request.form:
                return redirect(url_for('admin_group.admin_group_page'))
            elif 'submit' in request.form:
                gname = request.form.get('group_name', None)
                group.name = gname
                group.description = request.form.get('description', None)
                if gname is not None and gname != '':
                    g = user_db.get_group(gname)
                    if g is None:
                        try:
                            group = user_db.add_group(group.name,
                                   group.description)
                            flash(_('Group "{0}" added.'.format(gname)))
                            return redirect(url_for(
                               'admin_group.admin_group_page'))
                        except DuplicateGroup:
                            flash(_(
                                'Group name "{0}" is already in use!'.format(
                                gname)),
                                'error')
                else:
                    flash(_("Group name cannot be empty!"), 'error')

            return render_template('admin_group.html', group=group,
                    state=get_state(), title=_('Edit Group'),
                    cancel_button=_('Cancel'), submit_button=_('Submit'),
                    can_edit_groups=True)
        else:
            return _not_auth()
    else:
        return _not_auth()
Ejemplo n.º 11
0
def show_node(num, name):
    """
    Renders a page given it's entry id
    """
    entry = None
    url = None
    editors = None
    if num < 0 and name:
        entry_db = EntryDB()
        try:
            entry = entry_db.find_by_URL(name)[0]
        except:
            abort(404)
    else:
        entry_db = EntryDB()
        entry = entry_db.find_by_id(num)
    if entry == None and url == None:
        abort(404)

    children = []
    try:
        if entry is not None:
            es = entry_db.find_editors_by_entry(entry.id)
            if len(es) > 0:
                editors = es

            if entry.children:
                children.append(entry)
                children.extend(sorted(entry.children, key=lambda e: e.weight))
            elif entry.parent_id is not None:
                te = entry_db.find_by_id(entry.parent_id)
                children.append(te)
                children.extend(sorted(te.children, key=lambda e: e.weight))
    except:
        editors = None

    #import ipdb; ipdb.set_trace()
    return render_template('node.html', entry=entry, editors=editors,
        state=get_state(), children=children)
Ejemplo n.º 12
0
def event_viewer():
    """
    Render the event viewer.
    """
    page_num = int(request.args.get('page', 0))
    per_page = int(request.args.get('per_page', 20))
    user_db = UserDB()
    role_db = RoleDB()
    event_log = EventLog()

    if current_user.is_authenticated() and current_user.is_active():
        is_admin = user_db.in_group(current_user, mainApp.config['ADMIN_GROUP'])
        all_activities = set()
        for m in role_db.get_roles(current_user):
            acts = role_db.get_activities(m.role_id)
            for act in acts:
                if acts[act]:
                    all_activities.add(act)

        can_view_logs = 'view_logs' in all_activities

        if is_admin or can_view_logs:
            events = event_log.find_recent_by_num(per_page, page_num * per_page)
            count = event_log.count()

            total_pages = 0
            if count > per_page:
                total_pages = int(ceil(float(count) / float(per_page)))

            return render_template('admin_events.html', events=events,
                state=get_state(), page_num=page_num, per_page=per_page,
                title=_('Event log'), total_pages=total_pages)
        else:
            return _not_auth()
    else:
        return _not_auth()
Ejemplo n.º 13
0
def admin_page():
    """
    Renders the admin page
    """
    user_db = UserDB()
    role_db = RoleDB()

    if current_user.is_authenticated() and current_user.is_active():
        links = OrderedDict()

        is_admin = user_db.in_group(current_user, mainApp.config['ADMIN_GROUP'])

        roles_by_group = {}
        all_roles = set()
        all_activities = set()
        for m in role_db.get_roles(current_user):
            if m.group_id not in roles_by_group:
                roles_by_group[m.group_id] = set()
            roles_by_group[m.group_id].add(m.role_id)
            all_roles.add(m.role_id)
            acts = role_db.get_activities(m.role_id)
            for act in acts:
                if acts[act]:
                    all_activities.add(act)

        personal_and_group = _('Personal and Group Settings')
        links[personal_and_group] = []
        #
        # Personal User and Group items
        #
        if 'edit_self' in all_activities:
            links[personal_and_group].append({
                    'url' : url_for("admin_user.admin_user_page"),
                    'text' : _('My User Settings'),
                    'desc' : _('Adjust your personal user settings.')
                })
        if 'new_user' in all_activities:
            links[personal_and_group].append({
                    'url' : url_for("admin_user.new_user"),
                    'text' : _('Create New User'),
                    'desc' : _('Create a new user.')
                })
        if 'view_users' in all_activities:
            links[personal_and_group].append({
                    'url' : url_for("admin_user.list_users"),
                    'text' : _('List All Users'),
                    'desc' : _('View all users and administrate them')
                })
        if 'view_groups' in all_activities:
            links[personal_and_group].append({
                    'url' : url_for("admin_group.admin_group_page"),
                    'text' : _('Edit Groups'),
                    'desc' : _('View and edit all groups')
                })
        if 'view_roles' in all_activities:
            links[personal_and_group].append({
                    'url' : url_for("admin_role.admin_role_page"),
                    'text' : _('Edit roles'),
                    'desc' : _('View and edit all roles')
                })

        entries = _('Entries')
        links[entries] = []
        #
        # Entries
        #
        if 'new_post' in all_activities:
            links[entries].append({
                    'url' : url_for("post.new_post"),
                    'text' : _('New entry'),
                    'desc' : _('Create a new entry')
                })

        sysadmin = _('System Administrative')
        links[sysadmin] = []
        #
        # System
        #
        if 'view_log' in all_activities:
            links[sysadmin].append({
                    'url' : url_for("admin_events.event_viewer"),
                    'text' : _('View log'),
                    'desc' : _('View the events log')
                })
        if 'make_static' in all_activities:
            links[sysadmin].append({
                    'url' : url_for("admin_static.static_page"),
                    'text' : _('Generate static site'),
                    'desc' : _('Generate the static site')
                })

        return render_template('admin.html', state=get_state(), links=links,
                is_admin=is_admin, title=_('Admin'))

    return render_template('noink_message.html', state=get_state(),
        title=_('Not authorized'),
        message=_('You must be logged in as a user to access this page!'))
Ejemplo n.º 14
0
def _edit_post(eid=None):
    """
    Edit a post
    """
    # FIXME - This method has kind of gotten monsterous. Refactor.
    user_db = UserDB()
    role_db = RoleDB()
    entry_db = EntryDB()

    if current_user.is_authenticated() and current_user.is_active():
        all_groups = set(user_db.get_users_groups(current_user))
        all_roles = role_db.get_roles(current_user)
        role_groups = set(m.group for m in all_roles)
        role_by_groups = dict(((m.group, role_db.get_activities(m.role))
            for m in all_roles))

        # The available groups are ones which they are both a part of AND which
        # they have a role in!
        avail_groups = all_groups & role_groups

        groups = []
        if current_user.primary_group in avail_groups:
            # Make sure primary group is first in the list, if it's there
            #avail_groups.remove(current_user.primary_group)
            groups.append(current_user.primary_group)
        groups.extend(avail_groups)

        parent_group = None
        parent = None
        if 'parent' in request.values:
            parent = entry_db.find_by_id(request.values['parent'])
            parent_group = parent.group

        # If everything else fails, we default to the top level
        if parent_group is None:
            parent_group = user_db.get_group(mainApp.config['TOP_LEVEL_GROUP'])

        if parent_group in avail_groups and parent_group in role_by_groups:
            if role_by_groups[parent_group].get('new_post', False):
                entry = None
                tags = []
                if eid is None:
                    if request.method == "POST":
                        entry = process_entry_object(parent)
                        if "tags" in request.form:
                            tags = [x.strip() for x in
                                    request.form['tags'].split(',') if x != '']
                        if "submit" in request.form:
                            entry_db.add_entry_object(entry)
                            if len(tags) > 0:
                                entry_db.add_tag(tags, entry)
                            return redirect(url_for('node.show_node',
                                num=entry.id))
                else:
                    entry = entry_db.find_by_id(eid)
                    if entry is None:
                        return render_template('noink_message.html',
                            state=get_state(),
                            title=_('Entry not found!'),
                            message=_(
                                'The entry "{0}" was not found!'.format(eid)))
                    if request.method == "POST":
                        entry = update_entry_object(entry)
                        if "tags" in request.form:
                            tags = [x.strip() for x in
                                    request.form['tags'].split(',') if x != '']
                        if "submit" in request.form:
                            entry_db.update_entry(entry)
                            entry_db.update_editor(current_user, entry)
                            if len(tags) > 0:
                                entry_db.add_tag(tags, entry)
                            return redirect(url_for('node.show_node',
                                num=entry.id))
                    else:
                        for tm in entry.tagmap:
                            tags.append(tm.tag.tag)

                return render_template('new_post.html', state=get_state(),
                    groups=groups, entry=entry, tags=tags, is_edit=True,
                    title=_('New Post'), submit_button=_('Submit'),
                    preview_button=_('Preview'))
            else:
                return not_authorized()
        else:
            return not_authorized()

    return render_template('noink_message.html', state=get_state(),
        title=_('Not authorized'),
        message=_('You must be logged in as a user to access this page!'))
Ejemplo n.º 15
0
def not_authorized():
    return render_template('noink_message.html', state=get_state(),
                title=_('Not authorized'),
                message=_('You are not authorized to post here!'))
Ejemplo n.º 16
0
def list_users():
    """
    Renders the list users page
    """
    page_num = int(request.args.get("page", 0))
    per_page = mainApp.config["NUM_ENTRIES_PER_PAGE"][0]
    user_db = UserDB()
    role_db = RoleDB()

    if current_user.is_authenticated() and current_user.is_active():
        is_admin = user_db.in_group(current_user, mainApp.config["ADMIN_GROUP"])
        all_activities = set()
        for m in role_db.get_roles(current_user):
            acts = role_db.get_activities(m.role_id)
            for act in acts:
                if acts[act]:
                    all_activities.add(act)

        can_edit_users = "edit_user" in all_activities

        if is_admin or "view_users" in all_activities:
            if request.method == "POST":
                if "new" in request.form:
                    return redirect(url_for("admin_user.new_user"))
                elif "delete" in request.form:
                    uids = request.form.getlist("select")
                    for uid in uids:
                        try:
                            user_db.delete(int(uid))
                            flash(_('User with ID "{0}" deleted.'.format(uid)))
                        except UserNotFound:
                            flash(_('"{0}" user id not found!'.format(uid)), "error")
                elif "update" in request.form:
                    uids = {int(i): True for i in request.form.getlist("active")}
                    if len(uids) > 0:
                        users = user_db.get_all_users()
                        for u in users:
                            if u.id in uids:
                                u.active = True
                            else:
                                u.active = False
                            user_db.update_user(u)
                # import ipdb; ipdb.set_trace()
            users = user_db.get_all_users()
            total_pages = 0
            if len(users) > per_page:
                total_pages = int(ceil(float(len(users)) / float(per_page)))

            return render_template(
                "list_users.html",
                users=users,
                state=get_state(),
                page_num=page_num,
                total_pages=total_pages,
                can_edit_users=can_edit_users,
                is_admin=is_admin,
                title=_("Users"),
                delete_button=_("Delete"),
                update_button=_("Update"),
                new_button=_("New User"),
                del_title=_("Delete User(s)"),
                cancel_button=_("Cancel"),
                del_warn=_("Deleting users is a permanent action. " "Are you sure?"),
            )
        else:
            return _not_auth()
    else:
        return _not_auth()
Ejemplo n.º 17
0
def new_user():
    """
    Dialog for new user.
    """
    user_db = UserDB()
    role_db = RoleDB()

    if current_user.is_authenticated() and current_user.is_active():

        is_admin = user_db.in_group(current_user, mainApp.config["ADMIN_GROUP"])

        all_activities = set()
        for m in role_db.get_roles(current_user):
            acts = role_db.get_activities(m.role_id)
            for act in acts:
                if acts[act]:
                    all_activities.add(act)

        if "new_user" in all_activities:
            user = user_db.create_temp_empty_user()
            groups = user_db.get_all_groups()

            if "cancel" in request.form:
                return redirect(request.args.get("next") or url_for("admin.admin_page"))
            elif "update" in request.form:
                password = _check_password(request.form.get("password", None), request.form.get("pcheck", None))
                user.name = _check_username(request.form.get("name", None))
                user.fullname = request.form.get("fullname", None)
                user.bio = request.form.get("bio", None)
                g = user_db.get_group(request.form.get("primary_group", None))
                user.primary_group_id = g.id
                user.active = request.form.get("active", None) == "on"
                # Validation
                if user.name is not None:
                    if password is not None:
                        if g is not None:
                            u = user_db.add(user.name, password, user.fullname, user.bio, g, user.active)
                            flash(_('User "{0}" added.'.format(u.name)))
                            return redirect(url_for("admin_user.admin_user_page", uid=u.id))
                        else:
                            flash(_("Invalid group"))
                    else:
                        flash(_("Passwords do not match!"))
                else:
                    flash(_("Username invalid"))

            return render_template(
                "admin_new_user.html",
                state=get_state(),
                user=user,
                groups=groups,
                title=_("Add new user"),
                can_edit_users=True,
                is_admin=is_admin,
                submit_button=_("Add"),
                cancel_button=_("Cancel"),
            )
        else:
            return _not_auth()

    return _not_auth()
Ejemplo n.º 18
0
def admin_user_page(uid):
    """
    Renders the user admin page
    """
    user_db = UserDB()
    role_db = RoleDB()

    if current_user.is_authenticated() and current_user.is_active():
        # Gather permissions for currently logged in user
        # cur_all_groups = set(user_db.get_users_groups(current_user))
        cur_rolemap = role_db.get_roles(current_user)
        admin_group = user_db.get_group(mainApp.config["ADMIN_GROUP"])
        is_admin = user_db.in_group(current_user, admin_group)
        gs = set(user_db.get_all_groups())

        avail_roles = role_db.get_all_roles()
        avail_roles_by_group = dict()
        for g in gs:
            avail_roles_by_group[g.id] = list(avail_roles)

        cur_roles_by_group = _get_roles_by_group(cur_rolemap, avail_roles_by_group)

        user = None
        group = []
        if uid is None:
            uid = current_user.id
            # We do this because ptherwise we get a proxy to the object
            user = user_db.get_user(current_user.id)
        else:
            user = user_db.get_user(uid)

        if user is None:
            return render_template(
                "noink_message.html",
                state=get_state(),
                title=_("User not found!"),
                message=_('User with ID "{0}" was not found!'.format(uid)),
            )
        else:
            group = user_db.get_users_groups(user)

        all_groups = set(user_db.get_users_groups(user))
        rolemap = role_db.get_roles(user)

        avail_groups = list(gs - all_groups)

        user_roles = set()
        for m in rolemap:
            user_roles.add(m.role)

        roles_by_group = _get_roles_by_group(rolemap, avail_roles_by_group)

        #
        # DETERMINE PERMISSIONS MORE SPECIFICALLY
        #
        can_edit_users = False
        if admin_group.id in cur_roles_by_group:
            for rm in cur_roles_by_group[admin_group.id]:
                acts = role_db.get_activities(rm.role)
                can_edit_users = acts.get("edit_user")

        if is_admin or uid == current_user.id:
            if request.method == "POST":
                if "form_id" in request.form:
                    if request.form["form_id"] == "general":
                        #
                        # PASSWORD UPDATE
                        #
                        if request.form.get("password", "") != "":
                            password = _check_password(
                                request.form.get("password", None), request.form.get("pcheck", None)
                            )
                            if password != "" and password is not None:
                                user_db.update_password(user, password)
                                flash(_("Updated password"))
                            else:
                                flash(_("Passwords do not match!"))
                        #
                        # NAME UPDATE
                        #
                        if request.form.get("name", user.name) != user.name:
                            new_name = _check_username(request.form.get("name", user.name))
                            if new_name != user.name and new_name is not None:
                                user.name = new_name
                                flash(_("User name updated"))
                            else:
                                flash(_('"{0}" user already exists!'.format(new_name)), "error")
                        #
                        # FULLNAME & BIO UPDATE
                        #
                        user.fullname = request.form.get("fullname", user.fullname)
                        user.bio = request.form.get("bio", user.bio)
                        #
                        # PRIMARY GROUP
                        #
                        primary_group = request.form.get("primary_group", None)
                        if primary_group is not None and primary_group != user.primary_group.name:
                            if user_db.update_primary(user, primary_group):
                                flash(_("Updated primary group"))
                            else:
                                flash(_("Failed to update primary group"), "error")
                        #
                        # ACTIVE
                        #
                        active = request.form.get("active", None) == "on"
                        if isinstance(active, bool):
                            if active != user.active:
                                user.active = active
                                flash(_("User active setting changed"))
                        #
                        # UPDATE DATABASE
                        #
                        user_db.update_user(user)
                    elif request.form["form_id"] == "groups":
                        #
                        # UPDATE GROUP MEMBERSHIPS
                        #
                        if "delete" in request.form:
                            rm_g = user_db.get_group(int(request.form["delete"]))
                            if isinstance(rm_g, Group):
                                if user_db.remove_from_group(user, rm_g):
                                    flash(_('User removed from group "{0}".'.format(rm_g.name)))
                                    group = user_db.get_users_groups(user)
                                    all_groups = set(group)
                                    avail_groups = list(gs - all_groups)
                                else:
                                    print("HERE")
                                    flash(
                                        _(
                                            'Unable to remove user "{0}" from'
                                            ' group "{1}".'.format(user.name, rm_g.name)
                                        )
                                    )
                            else:
                                flash(
                                    _(
                                        'Unable to remove user "{0}" from'
                                        'group "{1}".'.format(user.name, request.form["delete"])
                                    )
                                )
                        elif "add" in request.form:
                            add_g = user_db.get_group(request.form.get("add_group", None))
                            if isinstance(add_g, Group):
                                user_db.add_to_group(user, add_g)
                                group = user_db.get_users_groups(user)
                                all_groups = set(group)
                                avail_groups = list(gs - all_groups)
                                if add_g in group:
                                    flash(_('Added user to group "{0}".'.format(add_g.name)))
                                else:
                                    flash(
                                        _('Problem adding user "{0} to ' 'group "{1}"!'.format(user.name, add_g.name)),
                                        "error",
                                    )
                            else:
                                flash(_('Unable to find group "{0}"!'.format(request.form["add"])), "error")
                    elif request.form["form_id"] == "roles":
                        #
                        # UPDATE ROLE MEMBERSHIP
                        #
                        if "delete" in request.form:
                            rm_r = role_db.get_role(int(request.form["delete"]))
                            g = user_db.get_group(int(request.form.get("group", -1)))
                            if isinstance(rm_r, Role) and isinstance(g, Group):
                                rolemap = role_db.get_rolemapping(user, g, rm_r)
                                if rolemap is not None:
                                    role_db.revoke_role(user, g, rm_r)
                                    roles_by_group[g.id].remove(rolemap)
                                    avail_roles_by_group[g.id].append(rm_r)
                                    flash(_('Role "{0}" revoked.'.format(rm_r.name)))
                                else:
                                    flash(_("Role not assigned to user."), "error")
                            else:
                                flash(_("Problem finding role or group.", "error"))
                        elif "add" in request.form:
                            g = user_db.get_group(int(request.form.get("group", -1)))
                            r = role_db.get_role(request.form.get("add_role", None))
                            if isinstance(r, Role) and isinstance(g, Group):
                                role_db.assign_role(user, g, r)
                                rolemap = role_db.get_rolemapping(user, g, r)
                                if r in avail_roles_by_group[g.id]:
                                    avail_roles_by_group[g.id].remove(r)
                                if g.id not in roles_by_group:
                                    roles_by_group[g.id] = []
                                if rolemap not in roles_by_group[g.id]:
                                    roles_by_group[g.id].append(rolemap)
                                flash(
                                    _(
                                        'Role "{0}" assigned for user "{1}"'
                                        ' with group "{2}".'.format(r.name, user.name, g.name)
                                    )
                                )
                            else:
                                flash(_("Problem finding role or group.", "error"))
                    else:
                        return render_template(
                            "noink_message.html",
                            state=get_state(),
                            title=_("Form error"),
                            message=_(
                                "There was a problem identifying form "
                                "elements. If this problem persists, contact"
                                " your site administrator"
                            ),
                        )
            # render the admin user page for uid user
            return render_template(
                "admin_user.html",
                state=get_state(),
                user=user,
                groups=group,
                avail_groups=avail_groups,
                is_admin=is_admin,
                role_map=rolemap,
                avail_roles=avail_roles,
                roles_by_group=roles_by_group,
                title=_("User Account"),
                avail_roles_by_group=avail_roles_by_group,
                can_edit_users=can_edit_users,
                submit_button=_("Update"),
            )

    return _not_auth()
Ejemplo n.º 19
0
def admin_role_page(rid):
    """
    Renders the role admin page
    """
    user_db = UserDB()
    role_db = RoleDB()

    if current_user.is_authenticated() and current_user.is_active():
        is_admin = user_db.in_group(current_user, mainApp.config['ADMIN_GROUP'])
        all_activities = set()
        for m in role_db.get_roles(current_user):
            acts = role_db.get_activities(m.role_id)
            for act in acts:
                if acts[act]:
                    all_activities.add(act)

        can_view_roles = 'view_roles' in all_activities
        can_edit_roles = 'edit_roles' in all_activities

        if is_admin or can_view_roles:
            if rid is None:
                if request.method == 'POST':
                    if 'delete' in request.form:
                        rids = request.form.getlist('select')
                        for rid in rids:
                            try:
                                role_db.delete_role(int(rid))
                                flash(_('Role with ID "{0}" deleted'.format(
                                    rid)))
                            except RoleNotFound:
                                flash(_('"{0}" role id not found!'.format(
                                    rid)), 'error')
                    elif 'new' in request.form:
                        return redirect(url_for('admin_role.admin_new_role'))
                roles = role_db.get_all_roles()
                return render_template('list_roles.html', roles=roles,
                        state=get_state(), can_view_roles=can_view_roles,
                        can_edit_roles=can_edit_roles, title=_('All Roles'),
                        delete_button=_('Delete'), new_button=_('New'),
                        cancel_button=_('Cancel'), activities=activities,
                        del_title=_('Delete Roles(s)'),
                        del_warn=_('Deleting roles is a permanent action. '\
                                'Are you sure?'))
            else:
                if request.method == "POST":
                    if 'cancel' in request.form:
                        return redirect(url_for('admin_role.admin_role_page'))
                    elif 'submit' in request.form:
                        role = role_db.get_role(rid)
                        if role is not None:
                            role.name = request.form.get('role_name',
                                    role.name)
                            role.description = request.form.get('description',
                                    role.description)
                            updated_acts = request.form.getlist('activities')
                            ract = get_activity_dict(False)
                            for a in updated_acts:
                                ract[a] = True
                            role = role_db.update_temp_role_activities(
                                    role, ract)
                            role_db.update_role(role)
                            return redirect(url_for(
                                'admin_role.admin_role_page'))

                role = role_db.get_role(rid)
                if role is not None:
                    return render_template('admin_role.html', role=role,
                        state=get_state(), title=_('Edit Role'),
                        cancel_button=_('Cancel'), submit_button=_('Submit'),
                        can_edit_roles=True, activities=activities)
        else:
            return _not_auth()
    else:
        return _not_auth()
Ejemplo n.º 20
0
def admin_group_page(gid):
    """
    Renders the group page
    """
    user_db = UserDB()
    role_db = RoleDB()

    if current_user.is_authenticated() and current_user.is_active():
        is_admin = user_db.in_group(current_user, mainApp.config['ADMIN_GROUP'])
        all_activities = set()
        for m in role_db.get_roles(current_user):
            acts = role_db.get_activities(m.role_id)
            for act in acts:
                if acts[act]:
                    all_activities.add(act)

        can_view_groups = 'view_groups' in all_activities
        can_edit_groups = 'edit_group' in all_activities

        if is_admin or can_view_groups:
            if gid is None:
                if request.method == "POST":
                    if 'delete' in request.form:
                        gids = request.form.getlist('select')
                        for gid in gids:
                            try:
                                user_db.delete_group(int(gid))
                                flash(_('Group with ID "{0}" deleted.'.format(
                                    gid)))
                            except GroupNotFound:
                                flash(_('"{0}" group id not found!'.format(
                                    gid)), 'error')
                    elif 'new' in request.form:
                        return redirect(url_for('admin_group.admin_new_group'))
                groups = user_db.get_all_groups()
                return render_template('list_groups.html', groups=groups,
                        state=get_state(), can_view_groups=can_view_groups,
                        can_edit_groups=can_edit_groups, title=_('All Groups'),
                        delete_button=_('Delete'), new_button=_('New'),
                        cancel_button=_('Cancel'),
                        del_title=_('Delete Group(s)'),
                        del_warn=_('Deleting groups is a permanent action. '\
                                'Are you sure?'))
            else:
                if request.method == "POST":
                    if 'cancel' in request.form:
                        return redirect(url_for('admin_group.admin_group_page'))
                    elif 'submit' in request.form:
                        group = user_db.get_group(gid)
                        if group is not None:
                            group.name = request.form.get('group_name',
                                    group.name)
                            group.description = request.form.get('description',
                                    group.description)
                            user_db.update_group(group)

                group = user_db.get_group(gid)

                if group is not None:
                    return render_template('admin_group.html', group=group,
                            state=get_state(), title=_('Edit Group'),
                            cancel_button=_('Cancel'),
                            submit_button=_('Submit'),
                            can_edit_groups=can_edit_groups)
                else:
                    flash(_('Group "{0}" not found!'.format(gid)), 'error')
                    return redirect(url_for("admin_group.admin_group_page"))
        else:
            return _not_auth()
    else:
        return _not_auth()