def login_user(token): '''api.login_user(token)''' data = load_y_vod_token(token=token) if verify_data_keys(data=data, keys=['email', 'password', 'device']): user = User.query.filter_by( email=data.get('email'), created=True, deleted=False ).first() if user is not None: if not user.activated: return jsonify({'error': '您的账户尚未激活'}) if not user.confirmed: return jsonify({'error': '您的邮箱尚未确认'}) if user.is_suspended: return jsonify({'error': '您的账户已被挂起'}) if not user.locked: if user.verify_password(data.get('password')): user.reset_invalid_login_count() db.session.commit() if user.plays('协管员'): send_email( user.email, 'Y-VOD登录提醒', 'auth/mail/y_vod/login', user=user, device=data.get('device'), timestamp=datetime_now(utc_offset=current_app.config['UTC_OFFSET']) ) add_user_log( user=user, event='登录Y-VOD(来源:{})'.format(data.get('device')), category='access' ) return jsonify(user.y_vod_user_json) user.increase_invalid_login_count() db.session.commit() if user.locked: send_emails( recipients=[staff.email for staff in User.all_can('管理用户').all() \ if staff.has_inner_domain_email], subject='锁定用户:{}'.format(user.name_email), template='auth/mail/y_vod/lock_user', user=user, device=data.get('device'), ) add_user_log(user=user, event='登录失败:密码错误(第{}次,来源:{})'.format( user.invalid_login_count, data.get('device') ), category='access') return jsonify({'error': '密码错误(第{}次,来源:{})'.format( user.invalid_login_count, data.get('device') )}) return jsonify({'error': '您的账户已被锁定'}) return jsonify({'error': '无效的用户名或密码'}) return jsonify({'error': '用户信息无效'})
def login(): '''auth.login()''' if current_user.is_authenticated: return redirect(request.args.get('next') or current_user.index_url) form = LoginForm() if form.validate_on_submit(): user = User.query.filter_by( email=form.email.data.strip().lower(), created=True, activated=True, deleted=False ).first() if user is not None: if not user.locked: if user.verify_password(form.password.data): user.reset_invalid_login_count() db.session.commit() login_user(user, remember=form.remember_me.data) if user.plays('协管员'): send_email( recipient=user.email, subject='登录提醒', template='auth/mail/login', user=user, timestamp=datetime_now(utc_offset=current_app.config['UTC_OFFSET']) ) get_announcements(type_name='登录通知', flash_first=True) add_user_log(user=user, event='登录系统', category='access') return redirect(request.args.get('next') or user.index_url) user.increase_invalid_login_count() db.session.commit() if user.locked: send_emails( recipients=[staff.email for staff in User.all_can('管理用户').all() \ if staff.has_inner_domain_email], subject='锁定用户:{}'.format(user.name_email), template='auth/mail/lock_user', user=user ) flash('登录失败:密码错误(第{}次)'.format(user.invalid_login_count), category='error') add_user_log(user=user, event='登录失败:密码错误(第{}次,来源:{})'.format( user.invalid_login_count, get_geo_info( ip_address=request.headers.get('X-Forwarded-For', request.remote_addr), show_ip=True ) ), category='access') return redirect(url_for('auth.login')) flash('登录失败:您的账户已被锁定', category='error') return redirect(url_for('auth.login')) flash('登录失败:无效的用户名或密码', category='error') return minify(render_template( 'auth/login.html', form=form ))
def activate(): '''auth.activate()''' if current_user.is_authenticated and current_user.confirmed: return redirect(request.args.get('next') or current_user.index_url) form = ActivationForm() if form.validate_on_submit(): user = User.query.filter_by( email=form.email.data.strip().lower(), created=True, activated=False, deleted=False ).first() if user is not None and user.verify_password(form.activation_code.data): user.activate(new_password=form.password.data) db.session.commit() token = user.generate_confirmation_token() send_email( recipient=user.email, subject='确认您的邮箱账户', template='auth/mail/confirm', user=user, token=token ) login_user(user, remember=False) flash('激活成功!', category='success') flash('一封确认邮件已经发送至您的邮箱', category='info') send_emails( recipients=[staff.email for staff in User.all_can('管理用户').all() \ if staff.has_inner_domain_email], subject='新用户:{}'.format(user.name), template='auth/mail/new_user', user=user ) add_user_log(user=user, event='激活账户', category='auth') return redirect(url_for('auth.unconfirmed')) flash('激活信息有误,或账户已处于激活状态', category='error') return minify(render_template( 'auth/activate.html', form=form ))