def edit_user_profile_page(id):
setup_translation()
is_admin = bool(current_user.has_roles('admin'))
if is_admin:
can_edit_privileges = True
can_delete = True
can_edit_user_active_status = True
else:
can_edit_privileges = current_user.can_do('edit_user_privileges')
can_delete = current_user.can_do('delete_user') and current_user.can_do('access_sessions') and current_user.can_do('edit_sessions')
can_edit_user_active_status = current_user.can_do('edit_user_active_status')
if not id:
flash(word('The user account did not exit.'), 'danger')
return redirect(url_for('user_list'))
user = db.session.execute(select(UserModel).options(db.joinedload(UserModel.roles)).filter_by(id=id)).unique().scalar_one()
if not user:
flash(word('The user account did not exit.'), 'danger')
return redirect(url_for('user_list'))
if not is_admin:
protected_user = False
for role in user.roles:
if role.name in ('admin', 'developer', 'advocate'):
protected_user = True
break
if protected_user:
flash(word('You do not have sufficient privileges to edit this user.'), 'danger')
return redirect(url_for('user_list'))
the_tz = user.timezone if user.timezone else get_default_timezone()
if user is None or user.social_id.startswith('disabled$'):
return redirect(url_for('user_list'))
if 'disable_mfa' in request.args and int(request.args['disable_mfa']) == 1:
user.otp_secret = None
db.session.commit()
#docassemble.webapp.daredis.clear_user_cache()
return redirect(url_for('edit_user_profile_page', id=id))
if 'reset_email_confirmation' in request.args and int(request.args['reset_email_confirmation']) == 1:
user.confirmed_at = None
db.session.commit()
#docassemble.webapp.daredis.clear_user_cache()
return redirect(url_for('edit_user_profile_page', id=id))
if can_delete and daconfig.get('admin can delete account', True) and user.id != current_user.id:
if 'delete_account' in request.args and int(request.args['delete_account']) == 1:
server.user_interviews(user_id=id, secret=None, exclude_invalid=False, action='delete_all', delete_shared=False)
delete_user_data(id, server.server_redis, server.server_redis_user)
db.session.commit()
flash(word('The user account was deleted.'), 'success')
return redirect(url_for('user_list'))
if 'delete_account_complete' in request.args and int(request.args['delete_account_complete']) == 1:
server.user_interviews(user_id=id, secret=None, exclude_invalid=False, action='delete_all', delete_shared=True)
delete_user_data(id, server.server_redis, server.server_redis_user)
db.session.commit()
flash(word('The user account was deleted.'), 'success')
return redirect(url_for('user_list'))
the_role_id = []
for role in user.roles:
the_role_id.append(role.id)
if len(the_role_id) == 0:
the_role_id = [db.session.execute(select(Role.id).filter_by(name='user')).scalar_one()]
form = EditUserProfileForm(request.form, obj=user, role_id=the_role_id)
if request.method == 'POST' and form.cancel.data:
flash(word('The user profile was not changed.'), 'success')
return redirect(url_for('user_list'))
if user.social_id.startswith('local$') or daconfig.get('allow external auth with admin accounts', False):
form.role_id.choices = [(r.id, r.name) for r in db.session.execute(select(Role.id, Role.name).where(Role.name != 'cron').order_by('name'))]
privileges_note = None
else:
form.role_id.choices = [(r.id, r.name) for r in db.session.execute(select(Role.id, Role.name).where(and_(Role.name != 'cron', Role.name != 'admin')).order_by('name'))]
privileges_note = word("Note: only users with e-mail/password accounts can be given admin privileges.")
form.timezone.choices = [(x, x) for x in sorted(list(zoneinfo.available_timezones()))]
form.timezone.default = the_tz
if str(form.timezone.data) == 'None' or str(form.timezone.data) == '':
form.timezone.data = the_tz
form.uses_mfa.data = bool(user.otp_secret is not None)
admin_id = db.session.execute(select(Role.id).filter_by(name='admin')).scalar_one()
if request.method == 'POST' and form.validate(user.id, admin_id):
if not can_edit_user_active_status:
form.active.data = user.active
form.populate_obj(user)
if can_edit_privileges:
roles_to_remove = []
the_role_id = []
for role in user.roles:
if not is_admin and role.name in ('admin', 'developer', 'advocate'):
continue
roles_to_remove.append(role)
for role in roles_to_remove:
user.roles.remove(role)
for role in db.session.execute(select(Role).order_by('id')).scalars():
if not is_admin and role.name in ('admin', 'developer', 'advocate'):
continue
if role.id in form.role_id.data:
user.roles.append(role)
the_role_id.append(role.id)
db.session.commit()
flash(word('The information was saved.'), 'success')
return redirect(url_for('user_list'))
confirmation_feature = bool(user.id > 2)
script = """
<script>
$(".dadeleteaccount").click(function(event){
if (!confirm(""" + json.dumps(word("Are you sure you want to permanently delete this user's account?")) + """)){
event.preventDefault();
return false;
}
});
</script>"""
form.role_id.process_data(the_role_id)
if user.active:
form.active.default = 'checked'
response = make_response(render_template('users/edit_user_profile_page.html', version_warning=None, page_title=word('Edit User Profile'), tab_title=word('Edit User Profile'), form=form, confirmation_feature=confirmation_feature, privileges_note=privileges_note, is_self=(user.id == current_user.id), extra_js=Markup(script), is_admin=is_admin, can_edit_privileges=can_edit_privileges, can_delete=can_delete, can_edit_user_active_status=can_edit_user_active_status), 200)
response.headers['Cache-Control'] = 'no-store, no-cache, must-revalidate, post-check=0, pre-check=0, max-age=0'
return response
def edit_user_profile_page(id):
user = UserModel.query.options(
db.joinedload('roles')).filter_by(id=id).first()
the_tz = user.timezone if user.timezone else get_default_timezone()
if user is None or user.social_id.startswith('disabled$'):
abort(404)
if 'disable_mfa' in request.args and int(request.args['disable_mfa']) == 1:
user.otp_secret = None
db.session.commit()
#docassemble.webapp.daredis.clear_user_cache()
return redirect(url_for('edit_user_profile_page', id=id))
if 'reset_email_confirmation' in request.args and int(
request.args['reset_email_confirmation']) == 1:
user.confirmed_at = None
db.session.commit()
#docassemble.webapp.daredis.clear_user_cache()
return redirect(url_for('edit_user_profile_page', id=id))
if daconfig.get('admin can delete account',
True) and user.id != current_user.id:
if 'delete_account' in request.args and int(
request.args['delete_account']) == 1:
from docassemble.webapp.server import user_interviews, r, r_user
from docassemble.webapp.backend import delete_user_data
user_interviews(user_id=id,
secret=None,
exclude_invalid=False,
action='delete_all',
delete_shared=False)
delete_user_data(id, r, r_user)
db.session.commit()
flash(word('The user account was deleted.'), 'success')
return redirect(url_for('user_list'))
if 'delete_account_complete' in request.args and int(
request.args['delete_account_complete']) == 1:
from docassemble.webapp.server import user_interviews, r, r_user
from docassemble.webapp.backend import delete_user_data
user_interviews(user_id=id,
secret=None,
exclude_invalid=False,
action='delete_all',
delete_shared=True)
delete_user_data(id, r, r_user)
db.session.commit()
flash(word('The user account was deleted.'), 'success')
return redirect(url_for('user_list'))
the_role_id = list()
for role in user.roles:
the_role_id.append(text_type(role.id))
if len(the_role_id) == 0:
the_role_id = [text_type(Role.query.filter_by(name='user').first().id)]
form = EditUserProfileForm(request.form, obj=user, role_id=the_role_id)
if request.method == 'POST' and form.cancel.data:
flash(word('The user profile was not changed.'), 'success')
return redirect(url_for('user_list'))
if user.social_id.startswith('local$'):
form.role_id.choices = [(r.id, r.name)
for r in db.session.query(Role).filter(
Role.name != 'cron').order_by('name')]
privileges_note = None
else:
form.role_id.choices = [(r.id, r.name) for r in db.session.query(
Role).filter(and_(Role.name != 'cron',
Role.name != 'admin')).order_by('name')]
privileges_note = word(
"Note: only users with e-mail/password accounts can be given admin privileges."
)
form.timezone.choices = [
(x, x) for x in sorted([tz for tz in pytz.all_timezones])
]
form.timezone.default = the_tz
if text_type(form.timezone.data) == 'None' or text_type(
form.timezone.data) == '':
form.timezone.data = the_tz
if user.otp_secret is None:
form.uses_mfa.data = False
else:
form.uses_mfa.data = True
admin_id = Role.query.filter_by(name='admin').first().id
if request.method == 'POST' and form.validate(user.id, admin_id):
form.populate_obj(user)
roles_to_remove = list()
the_role_id = list()
for role in user.roles:
roles_to_remove.append(role)
for role in roles_to_remove:
user.roles.remove(role)
for role in Role.query.order_by('id'):
if role.id in form.role_id.data:
user.roles.append(role)
the_role_id.append(role.id)
db.session.commit()
#docassemble.webapp.daredis.clear_user_cache()
flash(word('The information was saved.'), 'success')
return redirect(url_for('user_list'))
form.role_id.default = the_role_id
confirmation_feature = True if user.id > 2 else False
script = """
<script>
$(".dadeleteaccount").click(function(event){
if (!confirm(""" + json.dumps(
word("Are you sure you want to permanently delete this user's account?"
)) + """)){
event.preventDefault();
return false;
}
});
</script>"""
response = make_response(
render_template('users/edit_user_profile_page.html',
version_warning=None,
page_title=word('Edit User Profile'),
tab_title=word('Edit User Profile'),
form=form,
confirmation_feature=confirmation_feature,
privileges_note=privileges_note,
is_self=(user.id == current_user.id),
extra_js=Markup(script)), 200)
response.headers[
'Cache-Control'] = 'no-store, no-cache, must-revalidate, post-check=0, pre-check=0, max-age=0'
return response