5adb906a0a
basic_auth branch that openid is forked from Commits squashed together (in reverse chronological order): - do the label thing only for boolean fields - made edit_account to autofocus on the first field - added feature to render_divs where if field.label == '' then it will render form.description the same a render_label - added allow_registration check - refactored create_user - removed verification_key from create_user - removed get_user from openid - cleanup after removing openid from template_env.globals - fix for werkzueg 0.9.1 - cleanup after merge - more tests - restored openid extra_validation just for safety - tests for openid - deleted openid extra_validation - passed next parameter in session for openid - fixed a bug that was deleting the messages - implemented openid store using sqlalchemy - ask openid provider for 'nickname' to prefill username in registration form - refactored delete openid url to work with generic urls such as google and to not allow a user to delete a url if it is there only one and they don't have a pw - refactored login to register user workflow, which fixed a problem where the 'or register with a password link' wasn't showing up when the finish_login view called the register view because there wasn't any redirect. - added the ability to remove openid's - added the ability to add openids to an existing account - refactored start_login and finish_login views - modified edit_account.html to use render_divs - modified gmg/edit/views to behave appropriatly if no password authentication is enabled. moved the update email stuff to it's own funtion to make edit_account view cleaner. edit_account now modifies the form depending on the plugins. - minor typos - added retrieving email from openid provider - moved allow_registration check to a decorator - moved check if auth is enabled to a decorator - changed openid user registration to go through login first - cleanup after merge - modified verification emails to use itsdangerous tokens - added error handling on bad token, fixed route, and added tests - added support for user to change email address - added link to login view openid/password in login template - updated openid get_user function - modified get_user function to take kwargs instead of username - no need for user might be email kwarg in check_login_simple - added gen_password_hash and check_password functions to auth/__init__ - added focus to form input - made imports fully qualified - modified basic_auth.check_login to check that the user has a pw_hash first - changed occurances of form.data['whatever'] to form.whatever.data - convert tabs to spaces in register template, remove unsed templates, and fixed trans tags in templates - in process of openid login. it works, but needs major imporvements - make password field required in basic_auth form - check if password field present in basic_auth create_user - modified openid create_user function - modified models based on Elronds suggestions - changed register form action to a variable to be passed in by the view using the template - openid plugin v0, still need to authenticate via openid. - added a register_user function to be able to use in a plugin's register view, and modified auth/views.register to redirect to openid/register if appropriate. - Modified basic_auth plugin to work with modified auth plugin hooks. Added context variables. Removed basic_auth/tools which was previously renamed to basic_auth/lib. - modified auth/__init__ hooks to work better with multiple plugins. Removed auth/lib.py. And added a basic_extra_verification function that all plugins will use. - added models and migrations for openid plugin
271 lines
8.1 KiB
Python
271 lines
8.1 KiB
Python
# GNU MediaGoblin -- federated, autonomous media hosting
|
|
# Copyright (C) 2011, 2012 MediaGoblin contributors. See AUTHORS.
|
|
#
|
|
# This program is free software: you can redistribute it and/or modify
|
|
# it under the terms of the GNU Affero General Public License as published by
|
|
# the Free Software Foundation, either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU Affero General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU Affero General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
from functools import wraps
|
|
|
|
from urlparse import urljoin
|
|
from werkzeug.exceptions import Forbidden, NotFound
|
|
|
|
from mediagoblin import mg_globals as mgg
|
|
from mediagoblin import messages
|
|
from mediagoblin.db.models import MediaEntry, User
|
|
from mediagoblin.tools.response import redirect, render_404
|
|
from mediagoblin.tools.translate import pass_to_ugettext as _
|
|
|
|
|
|
def require_active_login(controller):
|
|
"""
|
|
Require an active login from the user.
|
|
"""
|
|
@wraps(controller)
|
|
def new_controller_func(request, *args, **kwargs):
|
|
if request.user and \
|
|
request.user.status == u'needs_email_verification':
|
|
return redirect(
|
|
request, 'mediagoblin.user_pages.user_home',
|
|
user=request.user.username)
|
|
elif not request.user or request.user.status != u'active':
|
|
next_url = urljoin(
|
|
request.urlgen('mediagoblin.auth.login',
|
|
qualified=True),
|
|
request.url)
|
|
|
|
return redirect(request, 'mediagoblin.auth.login',
|
|
next=next_url)
|
|
|
|
return controller(request, *args, **kwargs)
|
|
|
|
return new_controller_func
|
|
|
|
def active_user_from_url(controller):
|
|
"""Retrieve User() from <user> URL pattern and pass in as url_user=...
|
|
|
|
Returns a 404 if no such active user has been found"""
|
|
@wraps(controller)
|
|
def wrapper(request, *args, **kwargs):
|
|
user = User.query.filter_by(username=request.matchdict['user']).first()
|
|
if user is None:
|
|
return render_404(request)
|
|
|
|
return controller(request, *args, url_user=user, **kwargs)
|
|
|
|
return wrapper
|
|
|
|
|
|
def user_may_delete_media(controller):
|
|
"""
|
|
Require user ownership of the MediaEntry to delete.
|
|
"""
|
|
@wraps(controller)
|
|
def wrapper(request, *args, **kwargs):
|
|
uploader_id = kwargs['media'].uploader
|
|
if not (request.user.is_admin or
|
|
request.user.id == uploader_id):
|
|
raise Forbidden()
|
|
|
|
return controller(request, *args, **kwargs)
|
|
|
|
return wrapper
|
|
|
|
|
|
def user_may_alter_collection(controller):
|
|
"""
|
|
Require user ownership of the Collection to modify.
|
|
"""
|
|
@wraps(controller)
|
|
def wrapper(request, *args, **kwargs):
|
|
creator_id = request.db.User.find_one(
|
|
{'username': request.matchdict['user']}).id
|
|
if not (request.user.is_admin or
|
|
request.user.id == creator_id):
|
|
raise Forbidden()
|
|
|
|
return controller(request, *args, **kwargs)
|
|
|
|
return wrapper
|
|
|
|
|
|
def uses_pagination(controller):
|
|
"""
|
|
Check request GET 'page' key for wrong values
|
|
"""
|
|
@wraps(controller)
|
|
def wrapper(request, *args, **kwargs):
|
|
try:
|
|
page = int(request.GET.get('page', 1))
|
|
if page < 0:
|
|
return render_404(request)
|
|
except ValueError:
|
|
return render_404(request)
|
|
|
|
return controller(request, page=page, *args, **kwargs)
|
|
|
|
return wrapper
|
|
|
|
|
|
def get_user_media_entry(controller):
|
|
"""
|
|
Pass in a MediaEntry based off of a url component
|
|
"""
|
|
@wraps(controller)
|
|
def wrapper(request, *args, **kwargs):
|
|
user = User.query.filter_by(username=request.matchdict['user']).first()
|
|
if not user:
|
|
raise NotFound()
|
|
|
|
media = None
|
|
|
|
# might not be a slug, might be an id, but whatever
|
|
media_slug = request.matchdict['media']
|
|
|
|
# if it starts with id: it actually isn't a slug, it's an id.
|
|
if media_slug.startswith(u'id:'):
|
|
try:
|
|
media = MediaEntry.query.filter_by(
|
|
id=int(media_slug[3:]),
|
|
state=u'processed',
|
|
uploader=user.id).first()
|
|
except ValueError:
|
|
raise NotFound()
|
|
else:
|
|
# no magical id: stuff? It's a slug!
|
|
media = MediaEntry.query.filter_by(
|
|
slug=media_slug,
|
|
state=u'processed',
|
|
uploader=user.id).first()
|
|
|
|
if not media:
|
|
# Didn't find anything? Okay, 404.
|
|
raise NotFound()
|
|
|
|
return controller(request, media=media, *args, **kwargs)
|
|
|
|
return wrapper
|
|
|
|
|
|
def get_user_collection(controller):
|
|
"""
|
|
Pass in a Collection based off of a url component
|
|
"""
|
|
@wraps(controller)
|
|
def wrapper(request, *args, **kwargs):
|
|
user = request.db.User.find_one(
|
|
{'username': request.matchdict['user']})
|
|
|
|
if not user:
|
|
return render_404(request)
|
|
|
|
collection = request.db.Collection.find_one(
|
|
{'slug': request.matchdict['collection'],
|
|
'creator': user.id})
|
|
|
|
# Still no collection? Okay, 404.
|
|
if not collection:
|
|
return render_404(request)
|
|
|
|
return controller(request, collection=collection, *args, **kwargs)
|
|
|
|
return wrapper
|
|
|
|
|
|
def get_user_collection_item(controller):
|
|
"""
|
|
Pass in a CollectionItem based off of a url component
|
|
"""
|
|
@wraps(controller)
|
|
def wrapper(request, *args, **kwargs):
|
|
user = request.db.User.find_one(
|
|
{'username': request.matchdict['user']})
|
|
|
|
if not user:
|
|
return render_404(request)
|
|
|
|
collection_item = request.db.CollectionItem.find_one(
|
|
{'id': request.matchdict['collection_item'] })
|
|
|
|
# Still no collection item? Okay, 404.
|
|
if not collection_item:
|
|
return render_404(request)
|
|
|
|
return controller(request, collection_item=collection_item, *args, **kwargs)
|
|
|
|
return wrapper
|
|
|
|
|
|
def get_media_entry_by_id(controller):
|
|
"""
|
|
Pass in a MediaEntry based off of a url component
|
|
"""
|
|
@wraps(controller)
|
|
def wrapper(request, *args, **kwargs):
|
|
media = MediaEntry.query.filter_by(
|
|
id=request.matchdict['media_id'],
|
|
state=u'processed').first()
|
|
# Still no media? Okay, 404.
|
|
if not media:
|
|
return render_404(request)
|
|
|
|
given_username = request.matchdict.get('user')
|
|
if given_username and (given_username != media.get_uploader.username):
|
|
return render_404(request)
|
|
|
|
return controller(request, media=media, *args, **kwargs)
|
|
|
|
return wrapper
|
|
|
|
|
|
def get_workbench(func):
|
|
"""Decorator, passing in a workbench as kwarg which is cleaned up afterwards"""
|
|
|
|
@wraps(func)
|
|
def new_func(*args, **kwargs):
|
|
with mgg.workbench_manager.create() as workbench:
|
|
return func(*args, workbench=workbench, **kwargs)
|
|
|
|
return new_func
|
|
|
|
|
|
def allow_registration(controller):
|
|
""" Decorator for if registration is enabled"""
|
|
@wraps(controller)
|
|
def wrapper(request, *args, **kwargs):
|
|
if not mgg.app_config["allow_registration"]:
|
|
messages.add_message(
|
|
request,
|
|
messages.WARNING,
|
|
_('Sorry, registration is disabled on this instance.'))
|
|
return redirect(request, "index")
|
|
|
|
return controller(request, *args, **kwargs)
|
|
|
|
return wrapper
|
|
|
|
|
|
def auth_enabled(controller):
|
|
"""Decorator for if an auth plugin is enabled"""
|
|
@wraps(controller)
|
|
def wrapper(request, *args, **kwargs):
|
|
if not mgg.app.auth:
|
|
messages.add_message(
|
|
request,
|
|
messages.WARNING,
|
|
_('Sorry, authentication is disabled on this instance.'))
|
|
return redirect(request, 'index')
|
|
|
|
return controller(request, *args, **kwargs)
|
|
|
|
return wrapper
|