Merge branch 'master' of gitorious.org:mediagoblin/mediagoblin

mediagoblin/plugins/piwigo/__init__.py

@@ -17,6 +17,8 @@
 import logging
 
 from mediagoblin.tools import pluginapi
+from mediagoblin.tools.session import SessionManager
+from .tools import PWGSession
 
 _log = logging.getLogger(__name__)
 
@@ -32,6 +34,9 @@ def setup_plugin():
 
     pluginapi.register_routes(routes)
 
+    PWGSession.session_manager = SessionManager("pwg_id", "plugins.piwigo")
+
+
 hooks = {
     'setup': setup_plugin
 }

mediagoblin/plugins/piwigo/forms.py

@@ -26,3 +26,19 @@ class AddSimpleForm(wtforms.Form):
     # tags = wtforms.FieldList(wtforms.TextField())
     category = wtforms.IntegerField()
     level = wtforms.IntegerField()
+
+
+_md5_validator = wtforms.validators.Regexp(r"^[0-9a-fA-F]{32}$")
+
+
+class AddForm(wtforms.Form):
+    original_sum = wtforms.TextField(None,
+        [_md5_validator,
+         wtforms.validators.Required()])
+    thumbnail_sum = wtforms.TextField(None,
+        [wtforms.validators.Optional(False),
+         _md5_validator])
+    file_sum = wtforms.TextField(None, [_md5_validator])
+    name = wtforms.TextField()
+    date_creation = wtforms.TextField()
+    categories = wtforms.TextField()

mediagoblin/plugins/piwigo/tools.py

@@ -18,8 +18,9 @@ import logging
 
 import six
 import lxml.etree as ET
-from werkzeug.exceptions import MethodNotAllowed
+from werkzeug.exceptions import MethodNotAllowed, BadRequest
 
+from mediagoblin.tools.request import setup_user_in_request
 from mediagoblin.tools.response import Response
 
 
@@ -106,3 +107,46 @@ class CmdTable(object):
             _log.warn("Method %s only allowed for POST", cmd_name)
             raise MethodNotAllowed()
         return func
+
+
+def check_form(form):
+    if not form.validate():
+        _log.error("form validation failed for form %r", form)
+        for f in form:
+            if len(f.error):
+                _log.error("Errors for %s: %r", f.name, f.errors)
+        raise BadRequest()
+    dump = []
+    for f in form:
+        dump.append("%s=%r" % (f.name, f.data))
+    _log.debug("form: %s", " ".join(dump))
+
+
+class PWGSession(object):
+    session_manager = None
+
+    def __init__(self, request):
+        self.request = request
+        self.in_pwg_session = False
+
+    def __enter__(self):
+        # Backup old state
+        self.old_session = self.request.session
+        self.old_user = self.request.user
+        # Load piwigo session into state
+        self.request.session = self.session_manager.load_session_from_cookie(
+            self.request)
+        setup_user_in_request(self.request)
+        self.in_pwg_session = True
+        return self
+
+    def  __exit__(self, *args):
+        # Restore state
+        self.request.session = self.old_session
+        self.request.user = self.old_user
+        self.in_pwg_session = False
+
+    def save_to_cookie(self, response):
+        assert self.in_pwg_session
+        self.session_manager.save_session_to_cookie(self.request.session,
+            self.request, response)

mediagoblin/plugins/piwigo/views.py

@@ -20,11 +20,12 @@ import re
 from werkzeug.exceptions import MethodNotAllowed, BadRequest, NotImplemented
 from werkzeug.wrappers import BaseResponse
 
-from mediagoblin import mg_globals
 from mediagoblin.meddleware.csrf import csrf_exempt
 from mediagoblin.submit.lib import check_file_field
-from .tools import CmdTable, PwgNamedArray, response_xml
+from mediagoblin.auth.lib import fake_login_attempt
-from .forms import AddSimpleForm
+from .tools import CmdTable, PwgNamedArray, response_xml, check_form, \
+    PWGSession
+from .forms import AddSimpleForm, AddForm
 
 
 _log = logging.getLogger(__name__)
@@ -34,13 +35,25 @@ _log = logging.getLogger(__name__)
 def pwg_login(request):
     username = request.form.get("username")
     password = request.form.get("password")
-    _log.info("Login for %r/%r...", username, password)
+    _log.debug("Login for %r/%r...", username, password)
+    user = request.db.User.query.filter_by(username=username).first()
+    if not user:
+        _log.info("User %r not found", username)
+        fake_login_attempt()
+        return False
+    if not user.check_login(password):
+        _log.warn("Wrong password for %r", username)
+        return False
+    _log.info("Logging %r in", username)
+    request.session["user_id"] = user.id
+    request.session.save()
     return True
 
 
 @CmdTable("pwg.session.logout")
 def pwg_logout(request):
     _log.info("Logout")
+    request.session.delete()
     return True
 
 
@@ -51,7 +64,11 @@ def pwg_getversion(request):
 
 @CmdTable("pwg.session.getStatus")
 def pwg_session_getStatus(request):
-    return {'username': "fake_user"}
+    if request.user:
+        username = request.user.username
+    else:
+        username = "guest"
+    return {'username': username}
 
 
 @CmdTable("pwg.categories.getList")
@@ -133,17 +150,13 @@ def pwg_images_addChunk(request):
     return True
 
 
-def possibly_add_cookie(request, response):
+@CmdTable("pwg.images.add", True)
-    # TODO: We should only add a *real* cookie, if
+def pwg_images_add(request):
-    # authenticated. And if there is no cookie already.
+    _log.info("add: %r", request.form)
-    if True:
+    form = AddForm(request.form)
-        response.set_cookie(
+    check_form(form)
-            'pwg_id',
+
-            "some_fake_for_now",
+    return {'image_id': 123456, 'url': ''}
-            path=request.environ['SCRIPT_NAME'],
-            domain=mg_globals.app_config.get('csrf_cookie_domain'),
-            secure=(request.scheme.lower() == 'https'),
-            httponly=True)
 
 
 @csrf_exempt
@@ -158,13 +171,13 @@ def ws_php(request):
                   request.args, request.form)
         raise NotImplemented()
 
-    result = func(request)
+    with PWGSession(request) as session:
+        result = func(request)
 
-    if isinstance(result, BaseResponse):
+        if isinstance(result, BaseResponse):
-        return result
+            return result
 
-    response = response_xml(result)
+        response = response_xml(result)
+        session.save_to_cookie(response)
 
-    possibly_add_cookie(request, response)
+        return response
-
-    return response