def post(self, user):
# grab the form
form = PostDeleteForm(self.request.params)
# validate csrf
if not self.validate_csrf(form.csrf_token.data):
form.csrf_token.data = self.generate_csrf()
self.r(form, flashes=flash('Please submit the form again.'))
return
# get the post please
try:
post = Key(urlsafe=form.key.data).get()
except:
post = None
# as usual, this really shouldn't
# be None unless unnatural navigation
if post is None:
self.redirect('/')
return
# the post exists, is it owned by the user?
if post.author != user:
self.redirect('/')
return
# check if the user is the owner or not
if post.author != user:
self.redirect('/')
return
# everything checks out so let's remove the post
# first though, we need to remove the comments
# assoc with the post and the likes
# TODO query these entities to make sure they are removed
comments = Comment.query(ancestor=post.key).fetch()
ks = put_multi(comments)
delete_multi(ks)
likes = Like.query(Like.post == post.key).fetch()
ks = put_multi(likes)
delete_multi(ks)
# got everything else removed, let's
# remove the post
try:
post.key.delete()
self.redirect('/')
return
except Exception as e:
# let them try again
form.csrf_token.data = self.generate_csrf()
self.r(form, post, flashes=flash())
return
def post(self):
user = self.validate_user()
if user is not None:
self.redirect('/')
return
form = RegisterForm(self.request.params)
# validate form
if not form.validate():
self.r(form)
return
# validate csrf
if not self.validate_csrf(form.csrf_token.data):
form.csrf_token.data = self.generate_csrf()
self.r(form, flashes=flash('Please submit the form again'))
return
# check for an existing account
# using the lowercase username as a key
# to ensure users are unique
username = form.username.data
username = re.sub(
r'[\!\@\#\$\%\^\&\*\-_=\+\?<>,\.\"\':;\{\}\[\]|\\~\/`]', '',
username)
try:
user = Key("User", lower(username)).get()
except:
user = None
if user is not None:
self.r(form, flashes=flash('That username is taken'))
return
# create the user
try:
user = User(
username=username,
password=pw.gen_hash(form.password.data),
)
user.key = Key("User", lower(user.username))
user.put()
# create a hash with our secret so we know the cookie is legit later
self.generate_sig(user.username)
self.redirect('/?welcome=%s' % user.username)
return
except: # guess something happened eh?
self.r(form, flashes=flash())
return
def index():
form = SecretForm()
if form.validate_on_submit():
secret = Secret(secret_value=form.secret.data, ttl=form.ttl.data, passphrase=form.passphrase.data)
try:
RedisRegistry(secret).save()
admin = Admin.create_admin(secret)
RedisRegistry(admin).save()
except ConnectionError as e:
current_app.logger.error(e)
return 500
flash('Secret created!')
return redirect(url_for('secret.secret_admin', admin_id=admin.obj_id))
return render_template('secrets/index.html', title=_('Create your secret now!'), form=form)
def post(self, user):
# grab the form
form = PostForm(self.request.params)
# check if the person exists in the db or not
try:
user = Key("User", lower(user)).get()
except:
user = None
# shouldn't be None if we got this far
# but check anyway
if user is None:
self.invalidate_sig()
self.redirect('/user/login')
return
# validate form
if not form.validate():
self.r(form)
return
# validate csrf
if not self.validate_csrf(form.csrf_token.data):
form.csrf_token.data = self.generate_csrf()
self.r(form, flashes=flash('Please submit the form again.'))
return
t = form.title.data
try:
# let's create the post
post = Post(
title=t,
author=user.username,
author_lower=lower(user.username),
subject=form.subject.data,
content=form.content.data
)
post.put()
# maybe they want to create another post?
self.r(PostForm(data={'csrf_token': self.generate_csrf()}),
flashes=flash('Your new post can be viewed <a href="/post/view?key=%s">here</a>.' % post.key.urlsafe(), 'success'))
return
except Exception as e:
# give them another chance
form.csrf_token.data = self.generate_csrf()
self.r(form)
return
def post(self):
user = self.validate_user()
if user is not None:
self.redirect('/')
return
form = RegisterForm(self.request.params)
# validate form
if not form.validate():
self.r(form)
return
# validate csrf
if not self.validate_csrf(form.csrf_token.data):
form.csrf_token.data = self.generate_csrf()
self.r(form, flashes=flash('Please submit the form again'))
return
# check for an existing account
# using the lowercase username as a key
# to ensure users are unique
username = form.username.data
username = re.sub(r'[\!\@\#\$\%\^\&\*\-_=\+\?<>,\.\"\':;\{\}\[\]|\\~\/`]', '', username)
try:
user = Key("User", lower(username)).get()
except:
user = None
if user is not None:
self.r(form, flashes=flash('That username is taken'))
return
# create the user
try:
user = User(
username=username,
password=pw.gen_hash(form.password.data),
)
user.key = Key("User", lower(user.username))
user.put()
# create a hash with our secret so we know the cookie is legit later
self.generate_sig(user.username)
self.redirect('/?welcome=%s' % user.username)
return
except: # guess something happened eh?
self.r(form, flashes=flash())
return
def set_password(token):
if current_user.is_authenticated:
flash(_('Looks like you have already activated your account.'))
return redirect(url_for('secret.index'))
user = User.verify_set_password_token(token)
if not user:
abort(404)
form = SetPasswordForm()
if form.validate_on_submit():
user.set_password(form.password.data)
db.session.commit()
flash(_('Your password has been setup.'))
return redirect(url_for('auth.login'))
return render_template('auth/set_password.html', form=form)
def reset_password_request():
if current_app.config['LOGIN_DISABLED']:
abort(404)
if current_user.is_authenticated:
return redirect(url_for('secret.index'))
form = ResetPasswordRequestForm()
if form.validate_on_submit():
user = User.query.filter_by(email=form.email.data).first()
if user:
send_password_reset_email(user)
flash(
_('Check your email for the instructions to reset your password'))
return redirect(url_for('auth.login'))
return render_template('auth/reset_password_request.html',
title=_('Reset Password'),
form=form)
def get(self, user):
# get the title of the post
k = self.request.get('key', None)
if k is None:
self.redirect('/')
return
try:
# get the post please
post = Key(urlsafe=k).get()
except:
# key is invalid
post = None
# unnatural nav
if post is None:
self.r(flashes=flash('Post does not exist'))
return
# check if the user is the owner or not
if post.author != user:
self.redirect('/')
return
# get the form ready
form = PostEditForm(data={
'csrf_token': self.generate_csrf(),
'key': k,
'title': post.title,
'subject': post.subject,
'content': post.content
})
self.r(form, post)
def register():
if current_app.config['REGISTRATION_DISABLED'] or current_app.config[
'LOGIN_DISABLED']:
abort(404)
if current_user.is_authenticated:
return redirect(url_for('secret.index'))
form = RegistrationForm()
if form.validate_on_submit():
user = User(username=form.username.data, email=form.email.data)
db.session.add(user)
db.session.commit()
send_account_activation_token(user)
flash(
_('Congratulations, you are now a registered user! Check your e-mail to activate account.'
))
return redirect(url_for('auth.login'))
return render_template('auth/register.html',
title=_('Register'),
form=form)
def post(self):
user = self.validate_user()
if user is not None:
self.redirect('/')
return
form = LoginForm(self.request.params)
# validate form
if not form.validate():
self.r(form)
return
# validate csrf
if not self.validate_csrf(form.csrf_token.data):
form.csrf_token.data = self.generate_csrf()
self.r(form, flashes=flash('Please submit the form again'))
return
# check whether user account exists
username = form.username.data
try:
user = Key("User", lower(username)).get()
except:
user = None
if user is None:
self.r(form, flashes=flash('Could not sign in. Verify username and password are correct and try again.'))
return
# check whether passwords are correct or not
if not pw.is_pw(form.password.data, user.password):
self.r(form, flashes=flash('Could not sign in. Verify username and password are correct and try again.'))
return
# create a hash with our secret so we know the cookie is legit later
self.generate_sig(user.username)
self.redirect('/?welcome=%s' % user.username)
return
def secret_admin(admin_id):
admin = RedisRegistry.load(admin_id, Admin)
secret = RedisRegistry.load(admin.secret_id, Secret) if admin else False
if secret:
sms_form = SendPassphrase()
email_form = SendSecretLink()
burn_form = BurnSecretForm()
if sms_form.submit_sms.data and sms_form.validate():
flash('SMS sent!')
if email_form.submit_email.data and email_form.validate():
flash('Email sent!')
send_secret_link_email(recivers=[email_form.email.data], secret=secret)
if burn_form.submit.data and burn_form.validate():
if RedisRegistry(secret).destroy():
current_app.logger.debug(request.form)
flash('Secret destroyed!')
return redirect(url_for('secret.index'))
return render_template('secrets/secret_admin.html',
secret=secret,
secret_id=secret.obj_id,
admin_id=admin_id,
email_form=email_form,
sms_form=sms_form,
burn_form=burn_form
)
abort(404)
def login():
if current_app.config['LOGIN_DISABLED']:
abort(404)
if current_user.is_authenticated:
return redirect(url_for('secret.index'))
form = LoginForm()
if form.validate_on_submit():
user = User.query.filter_by(username=form.username.data).first()
if user is None or not user.check_password(form.password.data):
flash(_('Invalid username or password'), category='danger')
return redirect(url_for('auth.login'))
login_user(user, remember=form.remember_me.data)
next_page = request.args.get('next')
if not next_page or url_parse(next_page).netloc != '':
next_page = url_for('secret.index')
return redirect(next_page)
return render_template(
'auth/login.html',
title=_('Sign In'),
form=form,
not_register=current_app.config['REGISTRATION_DISABLED'])
def get(self):
welcome = self.request.get('welcome', None)
flashes = []
limit = 10
offset = self.request.get_range('offset',
min_value=0,
max_value=100000,
default=0)
# let's get the most recent posts
posts = Post.query().order(-Post.created).fetch(limit, offset=offset)
if len(posts) is 0 and offset > 0:
flashes = flash('No more posts available.')
offset -= limit
posts = Post.query().order(-Post.created).fetch(limit,
offset=offset)
if welcome is not None:
flashes = flash('Welcome, %s!' % welcome, 'success', flashes)
self.r(posts, offset, limit, flashes=flashes)
def post(self, user):
# grab the form
form = PostEditForm(self.request.params)
# validate csrf
if not self.validate_csrf(form.csrf_token.data):
form.csrf_token.data = self.generate_csrf()
self.r(form, flashes=flash('Please submit the form again.'))
return
# validate form
if not form.validate():
self.r(form)
return
# get the post please
post = Key(urlsafe=form.key.data).get()
if post is None:
self.r(flashes=flash('Post does not exist'))
return
# check if the user is the owner or not
if post.author != user:
self.redirect('/')
return
try:
t = form.title.data
post.title = t
post.title_lower = lower(t)
post.subject = form.subject.data
post.content = form.content.data
post.put()
self.redirect('/author/%s' % post.author)
return
except Exception as e:
form.csrf_token.data = self.generate_csrf()
self.r(form)
return
def post(self, user):
# grab the form
form = CommentForm(self.request.params)
if not form.validate():
form.csrf_token.data = self.generate_csrf()
self.r(form)
return
# get the comment
try:
comment = Key(urlsafe=form.key.data).get()
except:
# invalid key
comment = None
if comment is None:
self.redirect('/')
return
if comment.author != user:
self.redirect('/')
return
# better be a post here or else!
post = comment.key.parent().get()
if post is None:
self.redirect('/')
return
# update the comment
try:
comment.content = form.comment.data
comment.put()
self.redirect('/post/view?key=%s' % post.key.urlsafe())
return
except:
# let's give them another chance
form.csrf_token.data = self.generate_csrf()
self.r(form, flashes=flash())
return
def get(self):
flashes = []
limit = 10
offset = self.request.get_range('offset',
min_value=0,
max_value=100000,
default=0)
user = self.request.path.split('/')[2]
user = unquote(user)
# let's get the most recent posts
posts = Post.query(
Post.author_lower == lower(user)).order(-Post.created).fetch(
limit, offset=offset)
if len(posts) is 0 and offset > 0:
flashes = flash('No more posts available.')
offset -= limit
posts = Post.query().order(-Post.created).fetch(limit,
offset=offset)
self.r(posts, offset, limit, user, flashes=flashes)
def post(self, user):
# let's get the form
form = CommentDeleteForm(self.request.params)
# validate the form please
if not form.validate():
self.redirect(self.request.referer)
return
try:
# grab the comment
comment = Key(urlsafe=form.key.data).get()
except:
# really this shouldn't be None
# unless unnatural nav
comment = None
# go back home
if comment is None:
self.redirect('/')
return
# this isn't the users comment!
if comment.author != user:
self.redirect('/')
return
# alright let's delete the comment
try:
comment.key.delete()
self.redirect('/')
return
except Exception as e:
# we'll give them another chance
form.csrf_token.data = self.generate_csrf()
self.r(form, comment, flashes=flash())
return
def post(self, user):
# grab the form
form = CommentForm(self.request.params)
if not form.validate():
form.csrf_token.data = self.generate_csrf()
self.r(form)
return
# get the comment
try:
comment = Key(urlsafe=form.key.data).get()
except:
# invalid key
comment = None
if comment is None:
self.redirect('/')
return
if comment.author != user:
self.redirect('/')
return
# better be a post here or else!
post = comment.key.parent().get()
if post is None:
self.redirect('/')
return
# update the comment
try:
comment.content = form.comment.data
comment.put()
self.redirect('/post/view?key=%s' % post.key.urlsafe())
return
except:
# let's give them another chance
form.csrf_token.data = self.generate_csrf()
self.r(form, flashes=flash())
return