From 848cfb281442fd1c4a1a64f4c7afc1e7b852a7b2 Mon Sep 17 00:00:00 2001 From: Alban Date: Sat, 17 Nov 2012 02:09:20 +0100 Subject: [PATCH] Login/logout --- templates/layout.html | 2 + templates/login.html | 9 +++ user.py | 172 ++++++++++++++++++++++++++---------------- web.py | 12 ++- 4 files changed, 124 insertions(+), 71 deletions(-) create mode 100755 templates/login.html diff --git a/templates/layout.html b/templates/layout.html index 585ea5b..02e1018 100755 --- a/templates/layout.html +++ b/templates/layout.html @@ -14,6 +14,8 @@

Supysonic

+

{% if session.get('userid') %}Log out{% else %}Log in{% endif %}

+ {% if get_flashed_messages() %}
{% for message in get_flashed_messages() %} diff --git a/templates/login.html b/templates/login.html new file mode 100755 index 0000000..59ea841 --- /dev/null +++ b/templates/login.html @@ -0,0 +1,9 @@ +{% extends "layout.html" %} +{% block body %} +
+
+
+ +
+{% endblock %} + diff --git a/user.py b/user.py index 3182869..1d161b2 100755 --- a/user.py +++ b/user.py @@ -1,67 +1,105 @@ -# coding: utf-8 - -from flask import Flask, request, flash, render_template, redirect, url_for -import string, random, hashlib -import uuid - -from web import app -import db - -@app.route('/user') -def user_index(): - return render_template('users.html', users = db.User.query.all()) - -@app.route('/user/add', methods = [ 'GET', 'POST' ]) -def add_user(): - if request.method == 'GET': - return render_template('adduser.html') - - error = False - (name, passwd, passwd_confirm, mail, admin) = map(request.form.get, [ 'name', 'passwd', 'passwd_confirm', 'mail', 'admin' ]) - if name in (None, ''): - flash('The name is required.') - error = True - elif db.User.query.filter(db.User.name == name).first(): - flash('There is already a user with that name. Please pick another one.') - error = True - if passwd in (None, ''): - flash('Please provide a password.') - error = True - elif passwd != passwd_confirm: - flash("The passwords don't match.") - error = True - if admin is None: - admin = True if db.User.query.filter(db.User.admin == True).count() == 0 else False - else: - admin = True - if error: - return render_template('adduser.html') - - salt = ''.join(random.choice(string.printable.strip()) for i in xrange(6)) - crypt = hashlib.sha1(salt + passwd).hexdigest() - user = db.User(name = name, mail = mail, password = crypt, salt = salt, admin = admin) - db.session.add(user) - db.session.commit() - flash("User '%s' successfully added" % name) - - return redirect(url_for('index')) - -@app.route('/user/del/') -def del_user(id): - try: - idid = uuid.UUID(id) - except ValueError: - flash('Invalid user id') - return redirect(url_for('index')) - - user = db.User.query.get(idid) - if user is None: - flash('No such user') - return redirect(url_for('index')) - - db.session.delete(user) - db.session.commit() - flash("Deleted user '%s'" % user.name) - - return redirect(url_for('index')) - +# coding: utf-8 + +from flask import Flask, request, session, flash, render_template, redirect, url_for +import string, random, hashlib +import uuid + +from web import app +import db + +@app.route('/user') +def user_index(): + return render_template('users.html', users = db.User.query.all()) + +@app.route('/user/add', methods = [ 'GET', 'POST' ]) +def add_user(): + if request.method == 'GET': + return render_template('adduser.html') + + error = False + (name, passwd, passwd_confirm, mail, admin) = map(request.form.get, [ 'name', 'passwd', 'passwd_confirm', 'mail', 'admin' ]) + if name in (None, ''): + flash('The name is required.') + error = True + elif db.User.query.filter(db.User.name == name).first(): + flash('There is already a user with that name. Please pick another one.') + error = True + if passwd in (None, ''): + flash('Please provide a password.') + error = True + elif passwd != passwd_confirm: + flash("The passwords don't match.") + error = True + if admin is None: + admin = True if db.User.query.filter(db.User.admin == True).count() == 0 else False + else: + admin = True + if error: + return render_template('adduser.html') + + salt = ''.join(random.choice(string.printable.strip()) for i in xrange(6)) + crypt = hashlib.sha1(salt + passwd).hexdigest() + user = db.User(name = name, mail = mail, password = crypt, salt = salt, admin = admin) + db.session.add(user) + db.session.commit() + flash("User '%s' successfully added" % name) + + return redirect(url_for('user_index')) + +@app.route('/user/del/') +def del_user(id): + try: + idid = uuid.UUID(id) + except ValueError: + flash('Invalid user id') + return redirect(url_for('index')) + + user = db.User.query.get(idid) + if user is None: + flash('No such user') + return redirect(url_for('index')) + + db.session.delete(user) + db.session.commit() + flash("Deleted user '%s'" % user.name) + + return redirect(url_for('user_index')) + +@app.route('/user/login', methods = [ 'GET', 'POST']) +def login(): + return_url = request.args.get('returnUrl') or url_for('index') + if session.get('userid'): + flash('Already logged in') + return redirect(return_url) + + if request.method == 'GET': + return render_template('login.html') + + user, password = map(request.form.get, [ 'user', 'password' ]) + error = False + if user in ('', None): + flash('Missing user name') + error = True + if password in ('', None): + flash('Missing password') + error = True + if not error: + dbuser = db.User.query.filter(db.User.name == user).first() + if not dbuser: + flash('Unknown user') + elif hashlib.sha1(dbuser.salt + password).hexdigest() != dbuser.password: + flash('Wrong password') + else: + session['userid'] = str(dbuser.id) + session['admin'] = dbuser.admin + flash('Logged in!') + return redirect(return_url) + + return render_template('login.html') + +@app.route('/user/logout') +def logout(): + session.clear() + flash('Logged out!') + return redirect(url_for('login')) + diff --git a/web.py b/web.py index ca44d05..deee9d8 100755 --- a/web.py +++ b/web.py @@ -1,7 +1,6 @@ # coding: utf-8 -from flask import Flask, request, flash, render_template, redirect, url_for -from sqlalchemy.orm.exc import NoResultFound +from flask import Flask, request, session, flash, render_template, redirect, url_for import os.path import uuid @@ -12,14 +11,19 @@ import db from scanner import Scanner @app.before_request -def init_check(): +def init_and_login_check(): if request.path.startswith('/rest/'): return - if db.User.query.filter(db.User.admin == True).count() == 0 and request.endpoint != 'add_user': + admin_count = db.User.query.filter(db.User.admin == True).count() + if admin_count == 0 and request.endpoint != 'add_user': flash('Not configured. Please create the first admin user') return redirect(url_for('add_user')) + if not (admin_count == 0 and request.endpoint == 'add_user') and not session.get('userid') and request.endpoint != 'login': + flash('Please login') + return redirect(url_for('login', returnUrl = request.url[len(request.url_root)-1:])) + @app.teardown_request def teardown(exception): db.session.remove()