X-Git-Url: http://git.cyclocoop.org/?a=blobdiff_plain;f=main.py;h=dca985f7f4f35acc8239b413be23b4345466da60;hb=33346b25d357b3ad3242cfac21ab09e92cb2024b;hp=298c72128be38b151d44df9f58a7d72f21df63d2;hpb=92f3176d2fca9034c05c8efd145c0cd0e7b81928;p=cavote.git diff --git a/main.py b/main.py index 298c721..dca985f 100755 --- a/main.py +++ b/main.py @@ -8,6 +8,7 @@ from datetime import date, timedelta from contextlib import closing import locale locale.setlocale(locale.LC_ALL, '') +import hashlib DATABASE = '/tmp/cavote.db' SECRET_KEY = '{J@uRKO,xO-PK7B,jF?>iHbxLasF9s#zjOoy=+:' @@ -47,20 +48,19 @@ def init_db(): # Login / Logout def valid_login(username, password): - return query_db('select * from users where email = ? and password = ?', [username, password], one=True) + return query_db('select * from users where email = ? and password = ?', [username, crypt(password)], one=True) def connect_user(user): - session['user'] = user # :KLUDGE:maethor:120528: Stoquer toute la ligne de la table users dans la session, c'est un peu crade… - #session['user']['id'] = user['id'] - #session['user']['name'] = user['name'] - #session['user']['email'] = user['email'] - #session['user']['organization'] = user['organization'] - #if user['is_admin'] == 1: - # session['user']['is_admin'] = True + session['user'] = user # :KLUDGE:maethor:120528: Stoquer toute la ligne de la table users dans la session, c'est un peu crade + del session['user']['password'] + del session['user']['key'] def disconnect_user(): session.pop('user', None) +def crypt(passwd): + return hashlib.sha1(passwd).hexdigest() + @app.route('/login', methods=['GET', 'POST']) def login(): if request.method == 'POST': @@ -90,7 +90,7 @@ def password_lost(): if user is None: flash('Cet utilisateur n\'existe pas !', 'error') else: - # :TODO:maethor:120528: Générer la clé, la mettre dans la base de données et envoyer le mail + # :TODO:maethor:120528: Generer la cle, la mettre dans la base de données et envoyer le mail flash(u"Un mail a été envoyé à " + user['email'], 'info') return render_template('password_lost.html') @@ -109,23 +109,34 @@ def login_key(userid, key): # User settings @app.route('/user/') -def show_user(userid): +def user(userid): if int(userid) != session.get('user').get('id'): abort(401) - return render_template('show_user.html') + groups = query_db('select * from roles join user_role on id=id_role where id_user = ?', userid) + return render_template('user.html', groups=groups) @app.route('/user/settings/', methods=['GET', 'POST']) -def user_settings(userid): +def user_edit(userid): if int(userid) != session.get('user').get('id'): abort(401) if request.method == 'POST': - g.db.execute('update users set email = ?, name = ?, organization = ? where id = ?', - [request.form['email'], request.form['name'], request.form['organization'], session['user']['id']]) - g.db.commit() - disconnect_user() # :TODO:maethor:120528: Maybe useless, but this is simple way to refresh session :D - flash(u'Votre profil a été mis à jour !', 'success') - return redirect(url_for('login')) - return render_template('user_settings.html') + if query_db('select * from users where email=? and id!=?', [request.form['email'], userid], one=True) is None: + if query_db('select * from users where name=? and id!=?', [request.form['name'], userid], one=True) is None: + g.db.execute('update users set email = ?, name = ?, organization = ? where id = ?', + [request.form['email'], request.form['name'], request.form['organization'], session['user']['id']]) + g.db.commit() + disconnect_user() + user = query_db('select * from users where id=?', [userid], one=True) + if user is None: + flash(u'Une erreur s\'est produite.', 'error') + return redirect(url_for('login')) + connect_user(user) + flash(u'Votre profil a été mis à jour !', 'success') + else: + flash(u'Le nom ' + request.form['name'] + u' est déjà pris ! Veuillez en choisir un autre.', 'error') + else: + flash(u'Il existe déjà un compte pour cette adresse e-mail : ' + request.form['email'], 'error') + return render_template('user_edit.html') @app.route('/user/password/', methods=['GET', 'POST']) def user_password(userid): @@ -133,26 +144,37 @@ def user_password(userid): abort(401) if request.method == 'POST': if request.form['password'] == request.form['password2']: - # :TODO:maethor:120528: Chiffrer le mot de passe ! - g.db.execute('update users set password = ? where id = ?', [request.form['password'], session['user']['id']]) + g.db.execute('update users set password = ? where id = ?', [crypt(request.form['password']), session['user']['id']]) g.db.commit() flash(u'Votre mot de passe a été mis à jour.', 'success') else: flash(u'Les mots de passe sont différents.', 'error') - return render_template('user_settings.html') + return render_template('user_edit.html') #------------ # User admin -@app.route('/users/admin/list') +@app.route('/admin/users') def admin_users(): if not session.get('user').get('is_admin'): abort(401) - users = query_db('select * from users order by id desc') - return render_template('admin_users.html', users=users) + tuples = query_db('select *, roles.name as rolename from (select *, id as userid, name as username from users join user_role on id=id_user order by id desc) join roles on id_role=roles.id') + users = dict() + for t in tuples: + if t['userid'] in users: + users[t['userid']]['roles'].append(t["rolename"]) + else: + users[t['userid']] = dict() + users[t['userid']]['userid'] = t['userid'] + users[t['userid']]['email'] = t['email'] + users[t['userid']]['username'] = t['username'] + users[t['userid']]['is_admin'] = t['is_admin'] + users[t['userid']]['roles'] = [t['rolename']] + + return render_template('admin_users.html', users=users.values()) -@app.route('/users/admin/add', methods=['GET', 'POST']) -def add_user(): +@app.route('/admin/users/add', methods=['GET', 'POST']) +def admin_user_add(): if not session.get('user').get('is_admin'): abort(401) if request.method == 'POST': @@ -165,25 +187,36 @@ def add_user(): g.db.execute('insert into users (email, name, organization, password, is_admin) values (?, ?, ?, ?, ?)', [request.form['email'], request.form['username'], request.form['organization'], password, admin]) g.db.commit() - # :TODO:maethor:120528: Send mail - flash(u'Le nouvel utilisateur a été créé avec succès', 'success') - return redirect(url_for('home')) + user = query_db('select * from users where email = ?', [request.form["email"]], one=True) + if user: + for role in request.form.getlist('roles'): + # :TODO:maethor:120528: Check if this role exist + if query_db('select id from roles where id = ?', role, one=True) is None: + abort(401) + g.db.execute('insert into user_role values (?, ?)', [user['id'], role]) + g.db.commit() + # :TODO:maethor:120528: Send mail + flash(u'Le nouvel utilisateur a été créé avec succès', 'success') + return redirect(url_for('admin_users')) + else: + flash(u'Une erreur s\'est produite.', 'error') else: flash(u"Vous devez spécifier une adresse email.", 'error') - return render_template('add_user.html') + groups = query_db('select * from roles where system=0') + return render_template('admin_user_new.html', groups=groups) #------------- # Roles admin -@app.route('/roles') -def show_roles(): +@app.route('/admin/roles') +def admin_roles(): if not session.get('user').get('is_admin'): abort(401) roles = query_db('select * from roles') - return render_template('show_roles.html', roles=roles) + return render_template('admin_roles.html', roles=roles) -@app.route('/roles/admin/add', methods=['POST']) -def add_role(): +@app.route('/admin/roles/add', methods=['POST']) +def admin_role_add(): if not session.get('user').get('is_admin'): abort(401) if request.method == 'POST': @@ -192,10 +225,10 @@ def add_role(): g.db.commit() else: flash(u"Vous devez spécifier un nom.", "error") - return redirect(url_for('show_roles')) + return redirect(url_for('admin_roles')) -@app.route('/roles/admin/delete/') -def del_role(idrole): +@app.route('/admin/roles/delete/') +def admin_role_del(idrole): if not session.get('user').get('is_admin'): abort(401) role = query_db('select * from roles where id = ?', [idrole], one=True) @@ -205,13 +238,13 @@ def del_role(idrole): abort(401) g.db.execute('delete from roles where id = ?', [idrole]) g.db.commit() - return redirect(url_for('show_roles')) + return redirect(url_for('admin_roles')) #------------ # Votes list @app.route('/votes/') -def show_votes(votes): +def votes(votes): today = date.today() active_button = votes basequery = 'select *, roles.name as rolename from votes join roles on roles.id=votes.id_role where is_open=1' @@ -223,7 +256,7 @@ def show_votes(votes): votes = query_db(basequery + ' and date_end >= (?) order by id desc', [today]) else: abort(404) - return render_template('show_votes.html', votes=votes, active_button=active_button) + return render_template('votes.html', votes=votes, active_button=active_button) #------ # Vote @@ -233,37 +266,65 @@ def can_see_vote(idvote, iduser=-1): vote = query_db('select * from votes where id=?', [idvote], one=True) if user is None and not vote.is_public: return False - return True # :TODO:maethor:20120529: Check others things + return True # :TODO:maethor:120529: Check others things def can_vote(idvote, iduser=-1): + # :TODO:maethor:120604: Check if user has'nt already vote if not can_see_vote(idvote, iduser): return False - return True # :TODO:maethor:20120529: Check others things + return True # :TODO:maethor:120529: Check others things -@app.route('/vote/') -def show_vote(idvote): +@app.route('/vote/', methods=['GET', 'POST']) +def vote(idvote): vote = query_db('select *, roles.name as rolename from votes join roles on roles.id=votes.id_role where votes.id=?', [idvote], one=True) if vote is None: abort(404) if can_see_vote(idvote, session.get('user').get('id')): - choices = query_db('select * from choices where id_vote=?', [idvote]) + choices = query_db('select name, id from choices where id_vote=?', [idvote]) + if request.method == 'POST': + if can_vote(idvote, session.get('user').get('id')): + for choice in choices: + if str(choice['id']) in request.form.keys(): + g.db.execute('insert into user_choice (id_user, id_choice) values (?, ?)', + [session.get('user').get('id'), choice['id']]) + g.db.commit() + if vote['is_multiplechoice'] == 0: + break + else: + abort(401) + tuples = query_db('select choiceid, choicename, users.id as userid, users.name as username from (select choices.id as choiceid, choices.name as choicename, id_user as userid from choices join user_choice on choices.id = user_choice.id_choice where id_vote = ?) join users on userid = users.id', [idvote]) + users = dict() + for t in tuples: + if t['userid'] in users: + choice = dict() + choice['id'] = t['choiceid'] + choice['name'] = t['choicename'] + users[t['userid']]['choices'].append(choice) + else: + users[t['userid']] = dict() + users[t['userid']]['userid'] = t['userid'] + users[t['userid']]['username'] = t['username'] + choice = dict() + choice['id'] = t['choiceid'] + choice['name'] = t['choicename'] + users[t['userid']]['choices'] = [choice] attachments = query_db('select * from attachments where id_vote=?', [idvote]) - return render_template('vote.html', vote=vote, attachments=attachments, choices=choices, can_vote=can_vote(idvote, session.get('user').get('id'))) + return render_template('vote.html', vote=vote, attachments=attachments, choices=choices, users=users.values(), can_vote=can_vote(idvote, session.get('user').get('id'))) flash('Vous n\'avez pas le droit de voir ce vote, désolé.') return(url_for('home')) #------------- # Votes admin -@app.route('/votes/admin/list') +@app.route('/admin/votes/list') def admin_votes(): if not session.get('user').get('is_admin'): abort(401) votes = query_db('select *, roles.name as rolename from votes join roles on roles.id=votes.id_role order by id desc') return render_template('admin_votes.html', votes=votes) -@app.route('/votes/admin/add', methods=['GET', 'POST']) -def add_vote(): +@app.route('/admin/votes/add', methods=['GET', 'POST']) +def admin_vote_add(): if not session.get('user').get('is_admin'): abort(401) if request.method == 'POST': @@ -286,20 +347,20 @@ def add_vote(): [request.form['title'], request.form['description'], request.form['category'], date_begin, date_end, transparent, public, multiplechoice, role['id'], session['user']['id']]) g.db.commit() vote = query_db('select * from votes where title = ? and date_begin = ? order by id desc', - [request.form['title'], date_begin], one=True) # :DEBUG:maethor:20120528: Bug possible car le titre n'est pas unique + [request.form['title'], date_begin], one=True) # :DEBUG:maethor:120528: Bug possible car le titre n'est pas unique if vote is None: flash(u'Une erreur est survenue !', 'error') return redirect(url_for('home')) else: flash(u"Le vote a été créé", 'info') - return redirect(url_for('edit_vote', voteid=vote['id'])) + return redirect(url_for('admin_vote_edit', voteid=vote['id'])) else: flash(u'Vous devez spécifier un titre.', 'error') groups = query_db('select * from roles') - return render_template('new_vote.html', groups=groups) + return render_template('admin_vote_new.html', groups=groups) -@app.route('/votes/admin/edit/', methods=['GET', 'POST']) -def edit_vote(voteid): +@app.route('/admin/votes/edit/', methods=['GET', 'POST']) +def admin_vote_edit(voteid): if not session.get('user').get('is_admin'): abort(401) vote = query_db('select * from votes where id = ?', [voteid], one=True) @@ -315,7 +376,7 @@ def edit_vote(voteid): if 'public' in request.form.keys(): public = 1 isopen = 0 - if request.form['status'] == 'Ouvert': # :TODO:maethor:20120529: Check if there is at least 2 choices before + if request.form['status'] == 'Ouvert': # :TODO:maethor:120529: Check if there is at least 2 choices before isopen = 1 g.db.execute('update votes set title = ?, description = ?, category = ?, is_transparent = ?, is_public = ?, is_open = ? where id = ?', [request.form['title'], request.form['description'], request.form['category'], transparent, public, isopen, voteid]) @@ -325,14 +386,15 @@ def edit_vote(voteid): else: flash(u'Vous devez spécifier un titre.', 'error') - # :TODO:maethor:20120529: Calculer la durée du vote (différence date_end - date_begin) + # :TODO:maethor:120529: Calculer la durée du vote (différence date_end - date_begin) vote['duration'] = 15 group = query_db('select name from roles where id = ?', [vote['id_role']], one=True) choices = query_db('select * from choices where id_vote = ?', [voteid]) - return render_template('edit_vote.html', vote=vote, group=group, choices=choices) + attachments = query_db('select * from attachments where id_vote = ?', [voteid]) + return render_template('admin_vote_edit.html', vote=vote, group=group, choices=choices, attachments=attachments) -@app.route('/votes/admin/addchoice/', methods=['POST']) -def add_choice(voteid): +@app.route('/admin/votes/addchoice/', methods=['POST']) +def admin_vote_addchoice(voteid): if not session.get('user').get('is_admin'): abort(401) vote = query_db('select * from votes where id = ?', [voteid], one=True) @@ -340,10 +402,10 @@ def add_choice(voteid): abort(404) g.db.execute('insert into choices (name, id_vote) values (?, ?)', [request.form['title'], voteid]) g.db.commit() - return redirect(url_for('edit_vote', voteid=voteid)) + return redirect(url_for('admin_vote_edit', voteid=voteid)) -@app.route('/votes/admin/editchoice//', methods=['POST', 'DELETE']) -def edit_choice(voteid, choiceid): +@app.route('/admin/votes/editchoice//', methods=['POST', 'DELETE']) +def admin_vote_editchoice(voteid, choiceid): if not session.get('user').get('is_admin'): abort(401) choice = query_db('select * from choices where id = ? and id_vote = ?', [choiceid, voteid], one=True) @@ -352,13 +414,13 @@ def edit_choice(voteid, choiceid): if request.method == 'POST': g.db.execute('update choices set name=? where id = ? and id_vote = ?', [request.form['title'], choiceid, voteid]) g.db.commit() - elif request.method == 'DELETE': # :COMMENT:maethor:20120528: I can't find how to use it from template + elif request.method == 'DELETE': # :COMMENT:maethor:120528: I can't find how to use it from template g.db.execute('delete from choices where id = ? and id_vote = ?', [choiceid, voteid]) g.db.commt() - return redirect(url_for('edit_vote', voteid=voteid)) + return redirect(url_for('admin_vote_edit', voteid=voteid)) -@app.route('/votes/admin/deletechoice//') -def delete_choice(voteid, choiceid): +@app.route('/admin/votes/deletechoice//') +def admin_vote_deletechoice(voteid, choiceid): if not session.get('user').get('is_admin'): abort(401) choice = query_db('select * from choices where id = ? and id_vote = ?', [choiceid, voteid], one=True) @@ -366,7 +428,29 @@ def delete_choice(voteid, choiceid): abort(404) g.db.execute('delete from choices where id = ? and id_vote = ?', [choiceid, voteid]) g.db.commit() - return redirect(url_for('edit_vote', voteid=voteid)) + return redirect(url_for('admin_vote_edit', voteid=voteid)) + +@app.route('/admin/votes/addattachment/', methods=['POST']) +def admin_vote_addattachment(voteid): + if not session.get('user').get('is_admin'): + abort(401) + vote = query_db('select * from votes where id = ?', [voteid], one=True) + if vote is None: + abort(404) + g.db.execute('insert into attachments (url, id_vote) values (?, ?)', [request.form['url'], voteid]) + g.db.commit() + return redirect(url_for('admin_vote_edit', voteid=voteid)) + +@app.route('/admin/votes/deleteattachment//') +def admin_vote_deleteattachment(voteid, attachmentid): + if not session.get('user').get('is_admin'): + abort(401) + attachment = query_db('select * from attachments where id = ? and id_vote = ?', [attachmentid, voteid], one=True) + if attachment is None: + abort(404) + g.db.execute('delete from attachments where id = ? and id_vote = ?', [attachmentid, voteid]) + g.db.commit() + return redirect(url_for('admin_vote_edit', voteid=voteid)) #------ # Main