X-Git-Url: http://git.cyclocoop.org/?a=blobdiff_plain;f=main.py;h=a807a510240b08bf96879aaadd961ab453fc901b;hb=ceddf4b06d5bc343c8de8016ead00ab99abdfeac;hp=9556f961fc79e69c2b6d4e3ba970cbc787d687ce;hpb=a07002ee9cb472f8317a87e9167f79fa34a5e85e;p=cavote.git diff --git a/main.py b/main.py index 9556f96..a807a51 100755 --- a/main.py +++ b/main.py @@ -8,6 +8,7 @@ from datetime import date, timedelta from contextlib import closing import locale locale.setlocale(locale.LC_ALL, '') +import hashlib DATABASE = '/tmp/cavote.db' SECRET_KEY = '{J@uRKO,xO-PK7B,jF?>iHbxLasF9s#zjOoy=+:' @@ -47,20 +48,19 @@ def init_db(): # Login / Logout def valid_login(username, password): - return query_db('select * from users where email = ? and password = ?', [username, password], one=True) + return query_db('select * from users where email = ? and password = ?', [username, crypt(password)], one=True) def connect_user(user): session['user'] = user # :KLUDGE:maethor:120528: Stoquer toute la ligne de la table users dans la session, c'est un peu crade - #session['user']['id'] = user['id'] - #session['user']['name'] = user['name'] - #session['user']['email'] = user['email'] - #session['user']['organization'] = user['organization'] - #if user['is_admin'] == 1: - # session['user']['is_admin'] = True + del session['user']['password'] + del session['user']['key'] def disconnect_user(): session.pop('user', None) +def crypt(passwd): + return hashlib.sha1(passwd).hexdigest() + @app.route('/login', methods=['GET', 'POST']) def login(): if request.method == 'POST': @@ -144,8 +144,7 @@ def user_password(userid): abort(401) if request.method == 'POST': if request.form['password'] == request.form['password2']: - # :TODO:maethor:120528: Chiffrer le mot de passe ! - g.db.execute('update users set password = ? where id = ?', [request.form['password'], session['user']['id']]) + g.db.execute('update users set password = ? where id = ?', [crypt(request.form['password']), session['user']['id']]) g.db.commit() flash(u'Votre mot de passe a été mis à jour.', 'success') else: @@ -159,9 +158,20 @@ def user_password(userid): def admin_users(): if not session.get('user').get('is_admin'): abort(401) - users = query_db('select *, roles.name as rolename from (select *, name as username from users join user_role on id=id_user order by id desc) join roles on id_role=roles.id') - # :TODO:maethor:20120530: Find a way to reduce the dict - return render_template('admin_users.html', users=users) + tuples = query_db('select *, roles.name as rolename from (select *, id as userid, name as username from users join user_role on id=id_user order by id desc) join roles on id_role=roles.id') + users = dict() + for t in tuples: + if t['userid'] in users: + users[t['userid']]['roles'].append(t["rolename"]) + else: + users[t['userid']] = dict() + users[t['userid']]['userid'] = t['userid'] + users[t['userid']]['email'] = t['email'] + users[t['userid']]['username'] = t['username'] + users[t['userid']]['is_admin'] = t['is_admin'] + users[t['userid']]['roles'] = [t['rolename']] + + return render_template('admin_users.html', users=users.values()) @app.route('/admin/users/add', methods=['GET', 'POST']) def admin_user_add(): @@ -256,12 +266,12 @@ def can_see_vote(idvote, iduser=-1): vote = query_db('select * from votes where id=?', [idvote], one=True) if user is None and not vote.is_public: return False - return True # :TODO:maethor:20120529: Check others things + return True # :TODO:maethor:120529: Check others things def can_vote(idvote, iduser=-1): if not can_see_vote(idvote, iduser): return False - return True # :TODO:maethor:20120529: Check others things + return True # :TODO:maethor:120529: Check others things @app.route('/vote/') def vote(idvote): @@ -309,7 +319,7 @@ def admin_vote_add(): [request.form['title'], request.form['description'], request.form['category'], date_begin, date_end, transparent, public, multiplechoice, role['id'], session['user']['id']]) g.db.commit() vote = query_db('select * from votes where title = ? and date_begin = ? order by id desc', - [request.form['title'], date_begin], one=True) # :DEBUG:maethor:20120528: Bug possible car le titre n'est pas unique + [request.form['title'], date_begin], one=True) # :DEBUG:maethor:120528: Bug possible car le titre n'est pas unique if vote is None: flash(u'Une erreur est survenue !', 'error') return redirect(url_for('home')) @@ -338,7 +348,7 @@ def admin_vote_edit(voteid): if 'public' in request.form.keys(): public = 1 isopen = 0 - if request.form['status'] == 'Ouvert': # :TODO:maethor:20120529: Check if there is at least 2 choices before + if request.form['status'] == 'Ouvert': # :TODO:maethor:120529: Check if there is at least 2 choices before isopen = 1 g.db.execute('update votes set title = ?, description = ?, category = ?, is_transparent = ?, is_public = ?, is_open = ? where id = ?', [request.form['title'], request.form['description'], request.form['category'], transparent, public, isopen, voteid]) @@ -348,11 +358,12 @@ def admin_vote_edit(voteid): else: flash(u'Vous devez spécifier un titre.', 'error') - # :TODO:maethor:20120529: Calculer la durée du vote (différence date_end - date_begin) + # :TODO:maethor:120529: Calculer la durée du vote (différence date_end - date_begin) vote['duration'] = 15 group = query_db('select name from roles where id = ?', [vote['id_role']], one=True) choices = query_db('select * from choices where id_vote = ?', [voteid]) - return render_template('admin_vote_edit.html', vote=vote, group=group, choices=choices) + attachments = query_db('select * from attachments where id_vote = ?', [voteid]) + return render_template('admin_vote_edit.html', vote=vote, group=group, choices=choices, attachments=attachments) @app.route('/admin/votes/addchoice/', methods=['POST']) def admin_vote_addchoice(voteid): @@ -375,7 +386,7 @@ def admin_vote_editchoice(voteid, choiceid): if request.method == 'POST': g.db.execute('update choices set name=? where id = ? and id_vote = ?', [request.form['title'], choiceid, voteid]) g.db.commit() - elif request.method == 'DELETE': # :COMMENT:maethor:20120528: I can't find how to use it from template + elif request.method == 'DELETE': # :COMMENT:maethor:120528: I can't find how to use it from template g.db.execute('delete from choices where id = ? and id_vote = ?', [choiceid, voteid]) g.db.commt() return redirect(url_for('admin_vote_edit', voteid=voteid)) @@ -391,6 +402,28 @@ def admin_vote_deletechoice(voteid, choiceid): g.db.commit() return redirect(url_for('admin_vote_edit', voteid=voteid)) +@app.route('/admin/votes/addattachment/', methods=['POST']) +def admin_vote_addattachment(voteid): + if not session.get('user').get('is_admin'): + abort(401) + vote = query_db('select * from votes where id = ?', [voteid], one=True) + if vote is None: + abort(404) + g.db.execute('insert into attachments (url, id_vote) values (?, ?)', [request.form['url'], voteid]) + g.db.commit() + return redirect(url_for('admin_vote_edit', voteid=voteid)) + +@app.route('/admin/votes/deleteattachment//') +def admin_vote_deleteattachment(voteid, attachmentid): + if not session.get('user').get('is_admin'): + abort(401) + attachment = query_db('select * from attachments where id = ? and id_vote = ?', [attachmentid, voteid], one=True) + if attachment is None: + abort(404) + g.db.execute('delete from attachments where id = ? and id_vote = ?', [attachmentid, voteid]) + g.db.commit() + return redirect(url_for('admin_vote_edit', voteid=voteid)) + #------ # Main