Login/logout

templates/layout.html

@@ -14,6 +14,8 @@
 <div class="page">
 	<h1>Supysonic</h1>
 
+	<p>{% if session.get('userid') %}<a href="{{ url_for('logout') }}">Log out</a>{% else %}<a href="{{ url_for('login') }}">Log in</a>{% endif %}</p>
+
 	{% if get_flashed_messages() %}
 	<div class="flash">
 		{% for message in get_flashed_messages() %}

templates/login.html

@@ -0,0 +1,9 @@
+{% extends "layout.html" %}
+{% block body %}
+<form method="post">
+	<label for="user">User</label><input type="text" id="user" name="user" value="{{ request.form.user }}" /><br />
+	<label for="password">Password</label><input type="password" id="password" name="password" /><br />
+	<input type="submit" />
+</form>
+{% endblock %}
+

user.py

@@ -1,67 +1,105 @@
-# coding: utf-8
+# coding: utf-8
-
+
-from flask import Flask, request, flash, render_template, redirect, url_for
+from flask import Flask, request, session, flash, render_template, redirect, url_for
-import string, random, hashlib
+import string, random, hashlib
-import uuid
+import uuid
-
+
-from web import app
+from web import app
-import db
+import db
-
+
-@app.route('/user')
+@app.route('/user')
-def user_index():
+def user_index():
-	return render_template('users.html', users = db.User.query.all())
+	return render_template('users.html', users = db.User.query.all())
-
+
-@app.route('/user/add', methods = [ 'GET', 'POST' ])
+@app.route('/user/add', methods = [ 'GET', 'POST' ])
-def add_user():
+def add_user():
-	if request.method == 'GET':
+	if request.method == 'GET':
-		return render_template('adduser.html')
+		return render_template('adduser.html')
-
+
-	error = False
+	error = False
-	(name, passwd, passwd_confirm, mail, admin) = map(request.form.get, [ 'name', 'passwd', 'passwd_confirm', 'mail', 'admin' ])
+	(name, passwd, passwd_confirm, mail, admin) = map(request.form.get, [ 'name', 'passwd', 'passwd_confirm', 'mail', 'admin' ])
-	if name in (None, ''):
+	if name in (None, ''):
-		flash('The name is required.')
+		flash('The name is required.')
-		error = True
+		error = True
-	elif db.User.query.filter(db.User.name == name).first():
+	elif db.User.query.filter(db.User.name == name).first():
-		flash('There is already a user with that name. Please pick another one.')
+		flash('There is already a user with that name. Please pick another one.')
-		error = True
+		error = True
-	if passwd in (None, ''):
+	if passwd in (None, ''):
-		flash('Please provide a password.')
+		flash('Please provide a password.')
-		error = True
+		error = True
-	elif passwd != passwd_confirm:
+	elif passwd != passwd_confirm:
-		flash("The passwords don't match.")
+		flash("The passwords don't match.")
-		error = True
+		error = True
-	if admin is None:
+	if admin is None:
-		admin = True if db.User.query.filter(db.User.admin == True).count() == 0 else False
+		admin = True if db.User.query.filter(db.User.admin == True).count() == 0 else False
-	else:
+	else:
-		admin = True
+		admin = True
-	if error:
+	if error:
-		return render_template('adduser.html')
+		return render_template('adduser.html')
-
+
-	salt = ''.join(random.choice(string.printable.strip()) for i in xrange(6))
+	salt = ''.join(random.choice(string.printable.strip()) for i in xrange(6))
-	crypt = hashlib.sha1(salt + passwd).hexdigest()
+	crypt = hashlib.sha1(salt + passwd).hexdigest()
-	user = db.User(name = name, mail = mail, password = crypt, salt = salt, admin = admin)
+	user = db.User(name = name, mail = mail, password = crypt, salt = salt, admin = admin)
-	db.session.add(user)
+	db.session.add(user)
-	db.session.commit()
+	db.session.commit()
-	flash("User '%s' successfully added" % name)
+	flash("User '%s' successfully added" % name)
-
+
-	return redirect(url_for('index'))
+	return redirect(url_for('user_index'))
-
+
-@app.route('/user/del/<id>')
+@app.route('/user/del/<id>')
-def del_user(id):
+def del_user(id):
-	try:
+	try:
-		idid = uuid.UUID(id)
+		idid = uuid.UUID(id)
-	except ValueError:
+	except ValueError:
-		flash('Invalid user id')
+		flash('Invalid user id')
-		return redirect(url_for('index'))
+		return redirect(url_for('index'))
-
+
-	user = db.User.query.get(idid)
+	user = db.User.query.get(idid)
-	if user is None:
+	if user is None:
-		flash('No such user')
+		flash('No such user')
-		return redirect(url_for('index'))
+		return redirect(url_for('index'))
-
+
-	db.session.delete(user)
+	db.session.delete(user)
-	db.session.commit()
+	db.session.commit()
-	flash("Deleted user '%s'" % user.name)
+	flash("Deleted user '%s'" % user.name)
-
+
-	return redirect(url_for('index'))
+	return redirect(url_for('user_index'))
-
+
+@app.route('/user/login', methods = [ 'GET', 'POST'])
+def login():
+	return_url = request.args.get('returnUrl') or url_for('index')
+	if session.get('userid'):
+		flash('Already logged in')
+		return redirect(return_url)
+
+	if request.method == 'GET':
+		return render_template('login.html')
+
+	user, password = map(request.form.get, [ 'user', 'password' ])
+	error = False
+	if user in ('', None):
+		flash('Missing user name')
+		error = True
+	if password in ('', None):
+		flash('Missing password')
+		error = True
+	if not error:
+		dbuser = db.User.query.filter(db.User.name == user).first()
+		if not dbuser:
+			flash('Unknown user')
+		elif hashlib.sha1(dbuser.salt + password).hexdigest() != dbuser.password:
+			flash('Wrong password')
+		else:
+			session['userid'] = str(dbuser.id)
+			session['admin'] = dbuser.admin
+			flash('Logged in!')
+			return redirect(return_url)
+
+	return render_template('login.html')
+
+@app.route('/user/logout')
+def logout():
+	session.clear()
+	flash('Logged out!')
+	return redirect(url_for('login'))
+

web.py

@@ -1,7 +1,6 @@
 # coding: utf-8
 
-from flask import Flask, request, flash, render_template, redirect, url_for
+from flask import Flask, request, session, flash, render_template, redirect, url_for
-from sqlalchemy.orm.exc import NoResultFound
 import os.path
 import uuid
 
@@ -12,14 +11,19 @@ import db
 from scanner import Scanner
 
 @app.before_request
-def init_check():
+def init_and_login_check():
 	if request.path.startswith('/rest/'):
 		return
 
-	if db.User.query.filter(db.User.admin == True).count() == 0 and request.endpoint != 'add_user':
+	admin_count = db.User.query.filter(db.User.admin == True).count()
+	if admin_count == 0 and request.endpoint != 'add_user':
 		flash('Not configured. Please create the first admin user')
 		return redirect(url_for('add_user'))
 
+	if not (admin_count == 0 and request.endpoint == 'add_user') and not session.get('userid') and request.endpoint != 'login':
+		flash('Please login')
+		return redirect(url_for('login', returnUrl = request.url[len(request.url_root)-1:]))
+
 @app.teardown_request
 def teardown(exception):
 	db.session.remove()