X-Git-Url: http://git.cyclocoop.org/%7B%24admin_url%7Dcompta/comptes/journal.php?a=blobdiff_plain;f=main.py;h=d9488c93a927d343f4e07e6d65c172ad4b57dba6;hb=6e512c0dae7df7303cfeaabc0044ecc523311de6;hp=b00b87920d70474c94d81384f8e65f1cfbedff27;hpb=07a7e13f132e72a1586da7a55423abfdbd8d623f;p=cavote.git diff --git a/main.py b/main.py index b00b879..d9488c9 100755 --- a/main.py +++ b/main.py @@ -8,6 +8,7 @@ from datetime import date, timedelta from contextlib import closing import locale locale.setlocale(locale.LC_ALL, '') +import hashlib DATABASE = '/tmp/cavote.db' SECRET_KEY = '{J@uRKO,xO-PK7B,jF?>iHbxLasF9s#zjOoy=+:' @@ -47,20 +48,19 @@ def init_db(): # Login / Logout def valid_login(username, password): - return query_db('select * from users where email = ? and password = ?', [username, password], one=True) + return query_db('select * from users where email = ? and password = ?', [username, crypt(password)], one=True) def connect_user(user): session['user'] = user # :KLUDGE:maethor:120528: Stoquer toute la ligne de la table users dans la session, c'est un peu crade - #session['user']['id'] = user['id'] - #session['user']['name'] = user['name'] - #session['user']['email'] = user['email'] - #session['user']['organization'] = user['organization'] - #if user['is_admin'] == 1: - # session['user']['is_admin'] = True + del session['user']['password'] + del session['user']['key'] def disconnect_user(): session.pop('user', None) +def crypt(passwd): + return hashlib.sha1(passwd).hexdigest() + @app.route('/login', methods=['GET', 'POST']) def login(): if request.method == 'POST': @@ -112,19 +112,30 @@ def login_key(userid, key): def user(userid): if int(userid) != session.get('user').get('id'): abort(401) - return render_template('user.html') + groups = query_db('select * from roles join user_role on id=id_role where id_user = ?', userid) + return render_template('user.html', groups=groups) @app.route('/user/settings/', methods=['GET', 'POST']) def user_edit(userid): if int(userid) != session.get('user').get('id'): abort(401) if request.method == 'POST': - g.db.execute('update users set email = ?, name = ?, organization = ? where id = ?', - [request.form['email'], request.form['name'], request.form['organization'], session['user']['id']]) - g.db.commit() - disconnect_user() # :TODO:maethor:120528: Maybe useless, but this is simple way to refresh session :D - flash(u'Votre profil a été mis à jour !', 'success') - return redirect(url_for('login')) + if query_db('select * from users where email=? and id!=?', [request.form['email'], userid], one=True) is None: + if query_db('select * from users where name=? and id!=?', [request.form['name'], userid], one=True) is None: + g.db.execute('update users set email = ?, name = ?, organization = ? where id = ?', + [request.form['email'], request.form['name'], request.form['organization'], session['user']['id']]) + g.db.commit() + disconnect_user() # :TODO:maethor:120528: Maybe useless, but this is simple way to refresh session :D + user = query_db('select * from users where id=?', [userid], one=True) + if user is None: + flash(u'Une erreur s\'est produite.', 'error') + return redirect(url_for('login')) + connect_user(user) + flash(u'Votre profil a été mis à jour !', 'success') + else: + flash(u'Le nom ' + request.form['name'] + u' est déjà pris ! Veuillez en choisir un autre.', 'error') + else: + flash(u'Il existe déjà un compte pour cette adresse e-mail : ' + request.form['email'], 'error') return render_template('user_edit.html') @app.route('/user/password/', methods=['GET', 'POST']) @@ -133,8 +144,7 @@ def user_password(userid): abort(401) if request.method == 'POST': if request.form['password'] == request.form['password2']: - # :TODO:maethor:120528: Chiffrer le mot de passe ! - g.db.execute('update users set password = ? where id = ?', [request.form['password'], session['user']['id']]) + g.db.execute('update users set password = ? where id = ?', [crypt(request.form['password']), session['user']['id']]) g.db.commit() flash(u'Votre mot de passe a été mis à jour.', 'success') else: @@ -148,7 +158,8 @@ def user_password(userid): def admin_users(): if not session.get('user').get('is_admin'): abort(401) - users = query_db('select * from users order by id desc') + users = query_db('select *, roles.name as rolename from (select *, name as username from users join user_role on id=id_user order by id desc) join roles on id_role=roles.id') + # :TODO:maethor:20120530: Find a way to reduce the dict return render_template('admin_users.html', users=users) @app.route('/admin/users/add', methods=['GET', 'POST']) @@ -165,12 +176,23 @@ def admin_user_add(): g.db.execute('insert into users (email, name, organization, password, is_admin) values (?, ?, ?, ?, ?)', [request.form['email'], request.form['username'], request.form['organization'], password, admin]) g.db.commit() - # :TODO:maethor:120528: Send mail - flash(u'Le nouvel utilisateur a été créé avec succès', 'success') - return redirect(url_for('home')) + user = query_db('select * from users where email = ?', [request.form["email"]], one=True) + if user: + for role in request.form.getlist('roles'): + # :TODO:maethor:120528: Check if this role exist + if query_db('select id from roles where id = ?', role, one=True) is None: + abort(401) + g.db.execute('insert into user_role values (?, ?)', [user['id'], role]) + g.db.commit() + # :TODO:maethor:120528: Send mail + flash(u'Le nouvel utilisateur a été créé avec succès', 'success') + return redirect(url_for('admin_users')) + else: + flash(u'Une erreur s\'est produite.', 'error') else: flash(u"Vous devez spécifier une adresse email.", 'error') - return render_template('admin_user_new.html') + groups = query_db('select * from roles where system=0') + return render_template('admin_user_new.html', groups=groups) #------------- # Roles admin