def apilogin():
auth = request.authorization
if not auth or not auth.username:
return make_response(
'Username required!', 401,
{'WWW-Authenticate': 'Basic realm="Username required!"'})
if not auth.password:
return make_response(
'Password required!', 401,
{'WWW-Authenticate': 'Basic realm="Password required!"'})
if av.is_username_valid(auth.username) and av.is_password_valid(
auth.password):
uc = UserController()
user = uc.getuser(username=auth.username)
if user:
if check_password_hash(user.password, auth.password):
token = jwt.encode(
{
'username':
auth.username,
'exp':
datetime.datetime.utcnow() +
datetime.timedelta(minutes=60)
}, app.config['SECRET_KEY'])
return jsonify({'token': token})
return make_response('Invalid user or password!', 401,
{'WWW-Authenticate': 'Basic realm="Invalid user!"'})
def login():
msg = None
form = LoginForm()
remember = False
nexturl = request.args.get('next', None)
if form.validate_on_submit():
uc = UserController()
user = uc.getuser(username=form.username.data)
if user:
if check_password_hash(user.password, form.password.data):
if form.remember.data:
remember = True
login_user(user, remember=remember)
if nexturl:
return redirect(nexturl)
return redirect(url_for('home'))
msg = "Invalid username or password!"
return render_template('login.html', form=form, msg=msg, nexturl=nexturl)
def user(user_id):
if not current_user.is_authenticated:
abort(401)
form = UsersFormEdit()
uc = UserController()
user = uc.getuser(uid=user_id)
if not user:
abort(404)
if current_user.group != 'admin':
if current_user.username != user.username:
abort(401)
if form.validate_on_submit():
user_data = {}
if form.delete.data == 'Y':
user_data['uid'] = user.id
uc.deleteuser(user_data)
return redirect(url_for('users', page_num=1))
else:
user_data['username'] = form.username.data
user_data['uid'] = user.id
user_data['group'] = form.group.data
uc.edituser(user_data)
return redirect(url_for('users', page_num=1))
form.username.data = user.username
form.group.data = user.group
delete = request.args.get('delete', None)
if delete:
form.delete.data = 'Y'
else:
form.delete.data = 'N'
return render_template('user.html',
username=current_user.username,
form=form,
uid=user.id)
def load_user(user_id):
uc = UserController()
return uc.getuser(uid=int(user_id))