def post(self, user_id):
args = parser.parse_args()
user = g.user_info["username"]
if not args["old_password"]:
return {
"status": False,
"message":
"The specified old_password parameter does not exist"
}, 200
if not args["new_password"]:
return {
"status": False,
"message":
"The specified now_password parameter does not exist"
}, 200
db = DB()
status, result = db.select_by_id("user", user_id)
if status is True and result:
if not verify_password(result["username"], args["old_password"]):
return {"status": False, "message": "Old password error"}, 200
else:
# 基于RSA加密算法获取密码
password = rsa_decrypt(args["new_password"])
if password is False:
return {
"status": False,
"message": "Decrypt is failure"
}, 500
# 加密新密码
password_hash = custom_app_context.encrypt(password)
result["password"] = password_hash
update_status, update_result = db.update_by_id(
"user", json.dumps(result, ensure_ascii=False), user_id)
db.close_mysql()
if update_status is not True:
logger.error("Reset %s password error: %s" %
(user_id, update_result))
return {"status": False, "message": update_result}, 500
audit_log(user, user_id, "", "user", "reset by owner")
return {"status": True, "message": ""}, 201
else:
db.close_mysql()
logger.error("Select user error: %s" % result)
return {"status": False, "message": result}, 500
def post(self):
args = parser.parse_args()
args["id"] = uuid_prefix("u")
db = DB()
status, result = db.select(
"user", "where data -> '$.username'='%s'" % args["username"])
if status is True:
if len(result) == 0:
# 基于RSA加密算法获取密码
password = rsa_decrypt(args["password"])
if password is False:
return {
"status": False,
"message": "Decrypt is failure "
}, 500
password_hash = custom_app_context.encrypt(password)
args["password"] = password_hash
users = args
# 默认新添加的用户都是默认用户
role_id = get_common_user()
if isinstance(role_id, dict):
return role_id
users["role"].append(role_id)
insert_status, insert_result = db.insert(
"user", json.dumps(users, ensure_ascii=False))
db.close_mysql()
if insert_status is not True:
logger.error("Add user error: %s" % insert_result)
return {"status": False, "message": insert_result}, 500
return {"status": True, "message": ""}, 201
else:
db.close_mysql()
return {
"status": False,
"message": "The user name already exists"
}, 200
else:
db.close_mysql()
logger.error("Select user error: %s" % result)
return {"status": False, "message": result}, 500
def verify_password(username, password_rsa):
db = DB()
status, result = db.select("user",
"where data -> '$.username'='%s'" % username)
db.close_mysql()
if status is True and result:
try:
# 数据库中获取离散哈希数据
password_hash = result[0].get("password")
# 基于RSA加密算法获取密码
password = rsa_decrypt(password_rsa)
if password is False:
return False
# 基于离散哈希的密码认证
status = custom_app_context.verify(password, password_hash)
return status
except Exception as e:
logger.error("Verify password error: %s" % e)
return False
else:
logger.error("Verify password error: %s" % result)
return False
def put(self, user_id):
user = g.user_info["username"]
args = parser.parse_args()
args["id"] = user_id
db = DB()
# 判断是否存在
select_status, select_result = db.select_by_id("user", user_id)
if select_status is not True:
db.close_mysql()
logger.error("Modify user error: %s" % select_result)
return {"status": False, "message": select_result}, 500
if not select_result:
db.close_mysql()
return {
"status": False,
"message": "%s does not exist" % user_id
}, 404
# 判断名字否已经存在
status, result = db.select(
"user", "where data -> '$.username'='%s'" % args["username"])
if status is True:
if result:
if user_id != result[0].get("id"):
db.close_mysql()
return {
"status": False,
"message": "The user name already exists"
}, 200
# 获取之前的加密密码
if args["password"]:
# 基于RSA加密算法获取密码
password = rsa_decrypt(args["password"])
if password is False:
return {"status": False, "message": "Decrypt is failure "}, 500
password_hash = custom_app_context.encrypt(password)
args["password"] = password_hash
else:
status, result = db.select_by_id("user", user_id)
if status is True:
if result:
args["password"] = result.get("password")
else:
db.close_mysql()
return {
"status": False,
"message": "%s does not exist" % user_id
}, 404
else:
db.close_mysql()
return {"status": False, "message": result}, 500
# 更新用户信息
users = args
status, result = db.update_by_id("user",
json.dumps(users, ensure_ascii=False),
user_id)
db.close_mysql()
if status is not True:
logger.error("Modify user error: %s" % result)
return {"status": False, "message": result}, 500
audit_log(user, user_id, "", "user", "edit")
return {"status": True, "message": ""}, 200