From 28afb47ca82b0857aad546ef4cbf869de1ca95a5 Mon Sep 17 00:00:00 2001 From: Aleksandar Micovic Date: Mon, 30 May 2011 23:51:30 -0400 Subject: [PATCH 01/10] Added a temporary verification page informing the user they need to authenticate. --- mediagoblin/auth/routing.py | 4 ++- mediagoblin/auth/views.py | 15 ++++++++++ mediagoblin/decorators.py | 2 +- .../mediagoblin/auth/verification_needed.html | 29 +++++++++++++++++++ 4 files changed, 48 insertions(+), 2 deletions(-) create mode 100644 mediagoblin/templates/mediagoblin/auth/verification_needed.html diff --git a/mediagoblin/auth/routing.py b/mediagoblin/auth/routing.py index 59762840..9544b165 100644 --- a/mediagoblin/auth/routing.py +++ b/mediagoblin/auth/routing.py @@ -26,4 +26,6 @@ auth_routes = [ Route('mediagoblin.auth.logout', '/logout/', controller='mediagoblin.auth.views:logout'), Route('mediagoblin.auth.verify_email', '/verify_email/', - controller='mediagoblin.auth.views:verify_email')] + controller='mediagoblin.auth.views:verify_email'), + Route('mediagoblin.auth.verify_email_notice', '/verification_required/', + controller='mediagoblin.auth.views:verify_email_notice')] diff --git a/mediagoblin/auth/views.py b/mediagoblin/auth/views.py index 6b5ce88c..edac74a8 100644 --- a/mediagoblin/auth/views.py +++ b/mediagoblin/auth/views.py @@ -168,3 +168,18 @@ def verify_email(request): {'request': request, 'user': user, 'verification_successful': verification_successful})) + +def verify_email_notice(request): + """ + Verify warning view. + + When the user tries to do some action that requires their account + to be verified beforehand, this view is called upon! + """ + + template = request.template_env.get_template( + 'mediagoblin/auth/verification_needed.html') + return Response( + template.render( + {'request': request})) + diff --git a/mediagoblin/decorators.py b/mediagoblin/decorators.py index ff3f0b5e..bb625667 100644 --- a/mediagoblin/decorators.py +++ b/mediagoblin/decorators.py @@ -41,7 +41,7 @@ def require_active_login(controller): # here because an *active* user is required. return exc.HTTPFound( location="%s?next=%s" % ( - request.urlgen("mediagoblin.auth.login"), + request.urlgen("mediagoblin.auth.verify_email_notice"), request.path_info)) return controller(request, *args, **kwargs) diff --git a/mediagoblin/templates/mediagoblin/auth/verification_needed.html b/mediagoblin/templates/mediagoblin/auth/verification_needed.html new file mode 100644 index 00000000..26ea84dc --- /dev/null +++ b/mediagoblin/templates/mediagoblin/auth/verification_needed.html @@ -0,0 +1,29 @@ +{# +# GNU MediaGoblin -- federated, autonomous media hosting +# Copyright (C) 2011 Free Software Foundation, Inc +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +#} +{% extends "mediagoblin/base.html" %} + +{% block mediagoblin_content %} +

+ Verfication needed!
+ Please check your email to verify your account. +

+ +

+ Still haven't received an email? Click here to resend it. +

+{% endblock %} From bcec749b52c287a6d361fd06bfbd833e03e5b478 Mon Sep 17 00:00:00 2001 From: Aleksandar Micovic Date: Tue, 31 May 2011 15:26:00 -0400 Subject: [PATCH 02/10] Fixed bug where someone who wasn't logged in was asked to verify their emails. --- mediagoblin/decorators.py | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/mediagoblin/decorators.py b/mediagoblin/decorators.py index bb625667..bc12d61c 100644 --- a/mediagoblin/decorators.py +++ b/mediagoblin/decorators.py @@ -36,12 +36,13 @@ def require_active_login(controller): Require an active login from the user. """ def new_controller_func(request, *args, **kwargs): - if not request.user or not request.user.get('status') == u'active': - # TODO: Indicate to the user that they were redirected - # here because an *active* user is required. + if request.user and request.user.get('status') == u'needs_email_verification': + return exc.HTTPFound( + location = request.urlgen('mediagoblin.auth.verify_email_notice')) + elif not request.user or request.user.get('status') != u'active': return exc.HTTPFound( location="%s?next=%s" % ( - request.urlgen("mediagoblin.auth.verify_email_notice"), + request.urlgen("mediagoblin.auth.login"), request.path_info)) return controller(request, *args, **kwargs) From b93a6a229e1c7a7eef76e8322104912378f79a96 Mon Sep 17 00:00:00 2001 From: Aleksandar Micovic Date: Tue, 31 May 2011 17:14:23 -0400 Subject: [PATCH 03/10] Added the ability to regenerate a verification key. --- mediagoblin/auth/routing.py | 4 +- mediagoblin/auth/views.py | 41 +++++++++++++++++++ mediagoblin/db/models.py | 8 ++++ .../mediagoblin/auth/verification_needed.html | 2 +- 4 files changed, 53 insertions(+), 2 deletions(-) diff --git a/mediagoblin/auth/routing.py b/mediagoblin/auth/routing.py index 9544b165..069e3019 100644 --- a/mediagoblin/auth/routing.py +++ b/mediagoblin/auth/routing.py @@ -28,4 +28,6 @@ auth_routes = [ Route('mediagoblin.auth.verify_email', '/verify_email/', controller='mediagoblin.auth.views:verify_email'), Route('mediagoblin.auth.verify_email_notice', '/verification_required/', - controller='mediagoblin.auth.views:verify_email_notice')] + controller='mediagoblin.auth.views:verify_email_notice'), + Route('mediagoblin.auth.resend_verification', '/resend_verification/', + controller='mediagoblin.auth.views:resend_activation')] diff --git a/mediagoblin/auth/views.py b/mediagoblin/auth/views.py index edac74a8..22fdd46b 100644 --- a/mediagoblin/auth/views.py +++ b/mediagoblin/auth/views.py @@ -183,3 +183,44 @@ def verify_email_notice(request): template.render( {'request': request})) +def resend_activation(request): + """ + The reactivation view + + Resend the activation email. + """ + + request.user.generate_new_verification_key() + + # Copied shamelessly from the register view above. + + email_template = request.template_env.get_template( + 'mediagoblin/auth/verification_email.txt') + + # TODO: There is no error handling in place + send_email( + mgoblin_globals.email_sender_address, + [request.user['email']], + # TODO + # Due to the distributed nature of GNU MediaGoblin, we should + # find a way to send some additional information about the + # specific GNU MediaGoblin instance in the subject line. For + # example "GNU MediaGoblin @ Wandborg - [...]". + 'GNU MediaGoblin - Verify email', + email_template.render( + username=request.user['username'], + verification_url='http://{host}{uri}?userid={userid}&token={verification_key}'.format( + host=request.host, + uri=request.urlgen('mediagoblin.auth.verify_email'), + userid=unicode(request.user['_id']), + verification_key=request.user['verification_key']))) + + + # TODO: For now, we use the successful registration page until we get a + # proper messaging system. + + template = request.template_env.get_template( + 'mediagoblin/auth/register_success.html') + return exc.HTTPFound( + location=request.urlgen('mediagoblin.auth.register_success')) + diff --git a/mediagoblin/db/models.py b/mediagoblin/db/models.py index 37420834..0e933fb7 100644 --- a/mediagoblin/db/models.py +++ b/mediagoblin/db/models.py @@ -64,6 +64,14 @@ class User(Document): return auth_lib.bcrypt_check_password( password, self['pw_hash']) + def generate_new_verification_key(self): + """ + Create a new verification key, overwriting the old one. + """ + + self['verification_key'] = unicode(uuid.uuid4()) + self.save(validate=False) + class MediaEntry(Document): __collection__ = 'media_entries' diff --git a/mediagoblin/templates/mediagoblin/auth/verification_needed.html b/mediagoblin/templates/mediagoblin/auth/verification_needed.html index 26ea84dc..4104da19 100644 --- a/mediagoblin/templates/mediagoblin/auth/verification_needed.html +++ b/mediagoblin/templates/mediagoblin/auth/verification_needed.html @@ -24,6 +24,6 @@

- Still haven't received an email? Click here to resend it. + Still haven't received an email? Click here to resend it.

{% endblock %} From 5866d1a8fbe31709fe21b2c830f7ee3eab7b3775 Mon Sep 17 00:00:00 2001 From: Christopher Allan Webber Date: Tue, 31 May 2011 19:29:36 -0500 Subject: [PATCH 04/10] Give a "proper" view for resending verification email --- mediagoblin/auth/routing.py | 5 +++- mediagoblin/auth/views.py | 17 +++++++------ .../auth/resent_verification_email.html | 24 +++++++++++++++++++ 3 files changed, 38 insertions(+), 8 deletions(-) create mode 100644 mediagoblin/templates/mediagoblin/auth/resent_verification_email.html diff --git a/mediagoblin/auth/routing.py b/mediagoblin/auth/routing.py index 069e3019..a8909fbb 100644 --- a/mediagoblin/auth/routing.py +++ b/mediagoblin/auth/routing.py @@ -30,4 +30,7 @@ auth_routes = [ Route('mediagoblin.auth.verify_email_notice', '/verification_required/', controller='mediagoblin.auth.views:verify_email_notice'), Route('mediagoblin.auth.resend_verification', '/resend_verification/', - controller='mediagoblin.auth.views:resend_activation')] + controller='mediagoblin.auth.views:resend_activation'), + Route('mediagoblin.auth.resend_verification_success', + '/resend_verification_success/', + controller='mediagoblin.auth.views:resend_activation_success')] diff --git a/mediagoblin/auth/views.py b/mediagoblin/auth/views.py index 22fdd46b..15cd65e5 100644 --- a/mediagoblin/auth/views.py +++ b/mediagoblin/auth/views.py @@ -140,6 +140,7 @@ def logout(request): return exc.HTTPFound( location=request.urlgen("index")) + def verify_email(request): """ Email verification view @@ -183,6 +184,7 @@ def verify_email_notice(request): template.render( {'request': request})) + def resend_activation(request): """ The reactivation view @@ -215,12 +217,13 @@ def resend_activation(request): userid=unicode(request.user['_id']), verification_key=request.user['verification_key']))) - - # TODO: For now, we use the successful registration page until we get a - # proper messaging system. - - template = request.template_env.get_template( - 'mediagoblin/auth/register_success.html') return exc.HTTPFound( - location=request.urlgen('mediagoblin.auth.register_success')) + location=request.urlgen('mediagoblin.auth.resend_verification_success')) + +def resend_activation_success(request): + template = request.template_env.get_template( + 'mediagoblin/auth/resent_verification_email.html') + return Response( + template.render( + {'request': request})) diff --git a/mediagoblin/templates/mediagoblin/auth/resent_verification_email.html b/mediagoblin/templates/mediagoblin/auth/resent_verification_email.html new file mode 100644 index 00000000..da3a9e99 --- /dev/null +++ b/mediagoblin/templates/mediagoblin/auth/resent_verification_email.html @@ -0,0 +1,24 @@ +{# +# GNU MediaGoblin -- federated, autonomous media hosting +# Copyright (C) 2011 Free Software Foundation, Inc +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as published by +# the Free Software Foundation, either version 3 of the License, or +# (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . +#} +{% extends "mediagoblin/base.html" %} + +{% block mediagoblin_content %} +

+ Resent your verification email. +

+{% endblock %} From a72c504b257c7e2a2c3fec7da67bad5e0f6095be Mon Sep 17 00:00:00 2001 From: Christopher Allan Webber Date: Tue, 31 May 2011 19:30:05 -0500 Subject: [PATCH 05/10] Just adjusting some spacing so we don't go over 80 chars --- mediagoblin/decorators.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/mediagoblin/decorators.py b/mediagoblin/decorators.py index bc12d61c..a5bede54 100644 --- a/mediagoblin/decorators.py +++ b/mediagoblin/decorators.py @@ -36,9 +36,11 @@ def require_active_login(controller): Require an active login from the user. """ def new_controller_func(request, *args, **kwargs): - if request.user and request.user.get('status') == u'needs_email_verification': + if request.user and \ + request.user.get('status') == u'needs_email_verification': return exc.HTTPFound( - location = request.urlgen('mediagoblin.auth.verify_email_notice')) + location = request.urlgen( + 'mediagoblin.auth.verify_email_notice')) elif not request.user or request.user.get('status') != u'active': return exc.HTTPFound( location="%s?next=%s" % ( From 73a1bc85f1beb257169c777452eb878fa7e684a1 Mon Sep 17 00:00:00 2001 From: Christopher Allan Webber Date: Tue, 31 May 2011 19:31:23 -0500 Subject: [PATCH 06/10] Moving import to outside of this function --- mediagoblin/auth/views.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mediagoblin/auth/views.py b/mediagoblin/auth/views.py index 15cd65e5..906d6f13 100644 --- a/mediagoblin/auth/views.py +++ b/mediagoblin/auth/views.py @@ -14,6 +14,7 @@ # You should have received a copy of the GNU Affero General Public License # along with this program. If not, see . +import bson.objectid from webob import Response, exc from mediagoblin.auth import lib as auth_lib @@ -148,7 +149,6 @@ def verify_email(request): validates GET parameters against database and unlocks the user account, if you are lucky :) """ - import bson.objectid user = request.db.User.find_one( {'_id': bson.objectid.ObjectId(unicode(request.GET.get('userid')))}) From 155f24f9f5ac1c944addddf84c7a129d55f63263 Mon Sep 17 00:00:00 2001 From: Christopher Allan Webber Date: Tue, 31 May 2011 19:37:28 -0500 Subject: [PATCH 07/10] If a user doesn't provide a userid and a token to the verify_email function, might as well 404 --- mediagoblin/auth/views.py | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/mediagoblin/auth/views.py b/mediagoblin/auth/views.py index 906d6f13..4ccd3d86 100644 --- a/mediagoblin/auth/views.py +++ b/mediagoblin/auth/views.py @@ -149,12 +149,16 @@ def verify_email(request): validates GET parameters against database and unlocks the user account, if you are lucky :) """ + # If we don't have userid and token parameters, we can't do anything; 404 + if not request.GET.has_key('userid') or not request.GET.has_key('token'): + return exc.HTTPNotFound() + user = request.db.User.find_one( - {'_id': bson.objectid.ObjectId(unicode(request.GET.get('userid')))}) + {'_id': bson.objectid.ObjectId(unicode(request.GET['userid']))}) verification_successful = bool - if user and user['verification_key'] == unicode(request.GET.get('token')): + if user and user['verification_key'] == unicode(request.GET['token']): user['status'] = u'active' user['email_verified'] = True verification_successful = True From 4d4b49a84e2791da6b12ef580565251c379264b6 Mon Sep 17 00:00:00 2001 From: Christopher Allan Webber Date: Tue, 31 May 2011 19:54:26 -0500 Subject: [PATCH 08/10] 0.0.2 of GNU MediaGoblin! --- setup.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/setup.py b/setup.py index 752f1b57..097dd7f2 100644 --- a/setup.py +++ b/setup.py @@ -18,7 +18,7 @@ from setuptools import setup, find_packages setup( name = "mediagoblin", - version = "0.0.1", + version = "0.0.2", packages=find_packages(exclude=['ez_setup', 'examples', 'tests']), zip_safe=False, # scripts and dependencies @@ -45,7 +45,7 @@ setup( test_suite='nose.collector', license = 'AGPLv3', - author = 'Christopher Webber', + author = 'Free Software Foundation and contributors', author_email = 'cwebber@gnu.org', entry_points = """\ [console_scripts] From e0f8487005f4e9adca41648d35bb8dc6db850032 Mon Sep 17 00:00:00 2001 From: Christopher Allan Webber Date: Thu, 2 Jun 2011 08:47:30 -0500 Subject: [PATCH 09/10] Elrond put that ObjectId thing in the db.util module and wants us to use that one ;) --- mediagoblin/auth/views.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/mediagoblin/auth/views.py b/mediagoblin/auth/views.py index 4ccd3d86..0c125544 100644 --- a/mediagoblin/auth/views.py +++ b/mediagoblin/auth/views.py @@ -14,9 +14,9 @@ # You should have received a copy of the GNU Affero General Public License # along with this program. If not, see . -import bson.objectid from webob import Response, exc +from mediagoblin.db.util import ObjectId from mediagoblin.auth import lib as auth_lib from mediagoblin.auth import forms as auth_forms from mediagoblin.util import send_email @@ -154,7 +154,7 @@ def verify_email(request): return exc.HTTPNotFound() user = request.db.User.find_one( - {'_id': bson.objectid.ObjectId(unicode(request.GET['userid']))}) + {'_id': ObjectId(unicode(request.GET['userid']))}) verification_successful = bool From a77d952aa6659f0291f856495b18a43dd7e28508 Mon Sep 17 00:00:00 2001 From: Christopher Allan Webber Date: Thu, 2 Jun 2011 09:02:13 -0500 Subject: [PATCH 10/10] No need for a method for generating the verification key as a method on the class, can just do that in the view --- mediagoblin/auth/views.py | 6 ++++-- mediagoblin/db/models.py | 8 -------- 2 files changed, 4 insertions(+), 10 deletions(-) diff --git a/mediagoblin/auth/views.py b/mediagoblin/auth/views.py index 0c125544..e9d75f8b 100644 --- a/mediagoblin/auth/views.py +++ b/mediagoblin/auth/views.py @@ -14,6 +14,8 @@ # You should have received a copy of the GNU Affero General Public License # along with this program. If not, see . +import uuid + from webob import Response, exc from mediagoblin.db.util import ObjectId @@ -195,8 +197,8 @@ def resend_activation(request): Resend the activation email. """ - - request.user.generate_new_verification_key() + request.user['verification_key'] = unicode(uuid.uuid4()) + request.user.save() # Copied shamelessly from the register view above. diff --git a/mediagoblin/db/models.py b/mediagoblin/db/models.py index 0b85430a..3da97a49 100644 --- a/mediagoblin/db/models.py +++ b/mediagoblin/db/models.py @@ -64,14 +64,6 @@ class User(Document): return auth_lib.bcrypt_check_password( password, self['pw_hash']) - def generate_new_verification_key(self): - """ - Create a new verification key, overwriting the old one. - """ - - self['verification_key'] = unicode(uuid.uuid4()) - self.save(validate=False) - class MediaEntry(Document): __collection__ = 'media_entries'