def ajax_admin_slots_update(): if loggedin(): if is_admin(session['username']): # update slot length set_setting('slot_length', int(request.json['slot_length'])) return ('', 204) else: abort(403)
def admin_general(): # user needs to be logged in if not loggedin(): return redirect(url_for('login')) username = session['username'] # forbidden if user does not have access (operator for app or admin) if not is_admin(username): abort(403) return render_template('admin_general.html.j2', username=username)
def ajax_admin_slots_add_slot(): if loggedin(): if is_admin(session['username']): # add slot db, c = get_dbc() c.execute('''INSERT INTO slot VALUES (null, ?)''', (request.json['slot'], )) db.commit() return ('', 204) else: abort(403)
def ajax_admin_general_recalculate_session(): # user needs to be logged in if not loggedin(): return redirect(url_for('login')) username = session['username'] # forbidden if user does not have access (operator for app or admin) if not is_admin(username): abort(403) set_setting('next_session', next_session(True)) return ('', 204)
def ajax_admin_slots_remove_slot(): if loggedin(): if is_admin(session['username']): # remove slot db, c = get_dbc() c.execute( '''DELETE FROM slot WHERE start_time = ?''', (request.json['slot'])) db.commit() return ('', 204) else: abort(403)
def ajax_admin_remove_user(): if loggedin(): if is_admin(session['username']): user = request.json['user'] if user_exists(user): # remove user db, c = get_dbc() c.execute( '''DELETE FROM user WHERE username = ?''', (user, )) db.commit() return jsonify(success='True', user=user) # if anything went wrong return jsonify(success='False')
def admin_users(): # user needs to be logged in if not loggedin(): return redirect(url_for('login')) username = session['username'] # forbidden if user does not have access (operator for app or admin) if not is_admin(username): abort(403) # get all users db, c = get_dbc() c.execute('''SELECT username FROM user''') result_users = c.fetchall() users = list((u['username'] for u in result_users)) return render_template('admin_users.html.j2', username=username, users=users)
def admin_slots(): # user needs to be logged in if not loggedin(): return redirect(url_for('login')) username = session['username'] # forbidden if user does not have access (operator for app or admin) if not is_admin(username): abort(403) # get all slots db, c = get_dbc() c.execute('''SELECT start_time FROM slot''') result_slots = c.fetchall() slots = list((s['start_time'] for s in result_slots)) # get slot length slot_length = get_setting('slot_length') return render_template('admin_slots.html.j2', username=username, slots=slots, slot_length=slot_length)
def gconnect(): # Validate state token if request.args.get('state') != login_session['state']: response = make_response(json.dumps('Invalid state parameter.'), 401) response.headers['Content-Type'] = 'application/json' return response # Obtain authorization code code = request.data try: # Upgrade the authorization code into a credentials object oauth_flow = flow_from_clientsecrets(APP_PATH + 'client_secrets.json', scope='') oauth_flow.redirect_uri = 'postmessage' credentials = oauth_flow.step2_exchange(code) except FlowExchangeError: response = make_response( json.dumps('Failed to upgrade the authorization code.'), 401) response.headers['Content-Type'] = 'application/json' return response # Check that the access token is valid. access_token = credentials.access_token url = ('https://www.googleapis.com/oauth2/v1/tokeninfo?access_token=%s' % access_token) h = httplib2.Http() result = json.loads(h.request(url, 'GET')[1]) # If there was an error in the access token info, abort. if result.get('error') is not None: response = make_response(json.dumps(result.get('error')), 500) response.headers['Content-Type'] = 'application/json' return response # Verify that the access token is used for the intended user. gplus_id = credentials.id_token['sub'] if result['user_id'] != gplus_id: response = make_response( json.dumps("Token's user ID doesn't match given user ID."), 401) response.headers['Content-Type'] = 'application/json' return response # Verify that the access token is valid for this app. if result['issued_to'] != CLIENT_ID: response = make_response( json.dumps("Token's client ID does not match app's."), 401) print "Token's client ID does not match app's." response.headers['Content-Type'] = 'application/json' return response stored_access_token = login_session.get('access_token') stored_gplus_id = login_session.get('gplus_id') if stored_access_token is not None and gplus_id == stored_gplus_id: response = make_response( json.dumps('Current user is already connected.'), 200) response.headers['Content-Type'] = 'application/json' return response # Store the access token in the session for later use. login_session['access_token'] = credentials.access_token login_session['gplus_id'] = gplus_id # Get user info userinfo_url = "https://www.googleapis.com/oauth2/v1/userinfo" params = {'access_token': credentials.access_token, 'alt': 'json'} answer = requests.get(userinfo_url, params=params) data = answer.json() login_session['username'] = data['name'] login_session['picture'] = data['picture'] login_session['email'] = data['email'] user_id = get_userid(login_session['email']) if not user_id: user_id = create_user(login_session) login_session['user_id'] = user_id login_session['admin'] = is_admin() output = '' output += '<h1>Willkommen, ' output += login_session['username'] output += '!</h1>' output += '<img src="' output += login_session['picture'] output += ' " style = "width: 300px; height: 300px;border-radius: 150px;' output += '-webkit-border-radius: 150px;-moz-border-radius: 150px;"> ' flash("Du bist jetzt mit %s eingeloggt" % login_session['email']) return output