X-Git-Url: http://git.cyclocoop.org/?a=blobdiff_plain;f=main.py;h=dca985f7f4f35acc8239b413be23b4345466da60;hb=33346b25d357b3ad3242cfac21ab09e92cb2024b;hp=b00b87920d70474c94d81384f8e65f1cfbedff27;hpb=07a7e13f132e72a1586da7a55423abfdbd8d623f;p=cavote.git diff --git a/main.py b/main.py index b00b879..dca985f 100755 --- a/main.py +++ b/main.py @@ -8,6 +8,7 @@ from datetime import date, timedelta from contextlib import closing import locale locale.setlocale(locale.LC_ALL, '') +import hashlib DATABASE = '/tmp/cavote.db' SECRET_KEY = '{J@uRKO,xO-PK7B,jF?>iHbxLasF9s#zjOoy=+:' @@ -47,20 +48,19 @@ def init_db(): # Login / Logout def valid_login(username, password): - return query_db('select * from users where email = ? and password = ?', [username, password], one=True) + return query_db('select * from users where email = ? and password = ?', [username, crypt(password)], one=True) def connect_user(user): session['user'] = user # :KLUDGE:maethor:120528: Stoquer toute la ligne de la table users dans la session, c'est un peu crade - #session['user']['id'] = user['id'] - #session['user']['name'] = user['name'] - #session['user']['email'] = user['email'] - #session['user']['organization'] = user['organization'] - #if user['is_admin'] == 1: - # session['user']['is_admin'] = True + del session['user']['password'] + del session['user']['key'] def disconnect_user(): session.pop('user', None) +def crypt(passwd): + return hashlib.sha1(passwd).hexdigest() + @app.route('/login', methods=['GET', 'POST']) def login(): if request.method == 'POST': @@ -112,19 +112,30 @@ def login_key(userid, key): def user(userid): if int(userid) != session.get('user').get('id'): abort(401) - return render_template('user.html') + groups = query_db('select * from roles join user_role on id=id_role where id_user = ?', userid) + return render_template('user.html', groups=groups) @app.route('/user/settings/', methods=['GET', 'POST']) def user_edit(userid): if int(userid) != session.get('user').get('id'): abort(401) if request.method == 'POST': - g.db.execute('update users set email = ?, name = ?, organization = ? where id = ?', - [request.form['email'], request.form['name'], request.form['organization'], session['user']['id']]) - g.db.commit() - disconnect_user() # :TODO:maethor:120528: Maybe useless, but this is simple way to refresh session :D - flash(u'Votre profil a été mis à jour !', 'success') - return redirect(url_for('login')) + if query_db('select * from users where email=? and id!=?', [request.form['email'], userid], one=True) is None: + if query_db('select * from users where name=? and id!=?', [request.form['name'], userid], one=True) is None: + g.db.execute('update users set email = ?, name = ?, organization = ? where id = ?', + [request.form['email'], request.form['name'], request.form['organization'], session['user']['id']]) + g.db.commit() + disconnect_user() + user = query_db('select * from users where id=?', [userid], one=True) + if user is None: + flash(u'Une erreur s\'est produite.', 'error') + return redirect(url_for('login')) + connect_user(user) + flash(u'Votre profil a été mis à jour !', 'success') + else: + flash(u'Le nom ' + request.form['name'] + u' est déjà pris ! Veuillez en choisir un autre.', 'error') + else: + flash(u'Il existe déjà un compte pour cette adresse e-mail : ' + request.form['email'], 'error') return render_template('user_edit.html') @app.route('/user/password/', methods=['GET', 'POST']) @@ -133,8 +144,7 @@ def user_password(userid): abort(401) if request.method == 'POST': if request.form['password'] == request.form['password2']: - # :TODO:maethor:120528: Chiffrer le mot de passe ! - g.db.execute('update users set password = ? where id = ?', [request.form['password'], session['user']['id']]) + g.db.execute('update users set password = ? where id = ?', [crypt(request.form['password']), session['user']['id']]) g.db.commit() flash(u'Votre mot de passe a été mis à jour.', 'success') else: @@ -148,8 +158,20 @@ def user_password(userid): def admin_users(): if not session.get('user').get('is_admin'): abort(401) - users = query_db('select * from users order by id desc') - return render_template('admin_users.html', users=users) + tuples = query_db('select *, roles.name as rolename from (select *, id as userid, name as username from users join user_role on id=id_user order by id desc) join roles on id_role=roles.id') + users = dict() + for t in tuples: + if t['userid'] in users: + users[t['userid']]['roles'].append(t["rolename"]) + else: + users[t['userid']] = dict() + users[t['userid']]['userid'] = t['userid'] + users[t['userid']]['email'] = t['email'] + users[t['userid']]['username'] = t['username'] + users[t['userid']]['is_admin'] = t['is_admin'] + users[t['userid']]['roles'] = [t['rolename']] + + return render_template('admin_users.html', users=users.values()) @app.route('/admin/users/add', methods=['GET', 'POST']) def admin_user_add(): @@ -165,12 +187,23 @@ def admin_user_add(): g.db.execute('insert into users (email, name, organization, password, is_admin) values (?, ?, ?, ?, ?)', [request.form['email'], request.form['username'], request.form['organization'], password, admin]) g.db.commit() - # :TODO:maethor:120528: Send mail - flash(u'Le nouvel utilisateur a été créé avec succès', 'success') - return redirect(url_for('home')) + user = query_db('select * from users where email = ?', [request.form["email"]], one=True) + if user: + for role in request.form.getlist('roles'): + # :TODO:maethor:120528: Check if this role exist + if query_db('select id from roles where id = ?', role, one=True) is None: + abort(401) + g.db.execute('insert into user_role values (?, ?)', [user['id'], role]) + g.db.commit() + # :TODO:maethor:120528: Send mail + flash(u'Le nouvel utilisateur a été créé avec succès', 'success') + return redirect(url_for('admin_users')) + else: + flash(u'Une erreur s\'est produite.', 'error') else: flash(u"Vous devez spécifier une adresse email.", 'error') - return render_template('admin_user_new.html') + groups = query_db('select * from roles where system=0') + return render_template('admin_user_new.html', groups=groups) #------------- # Roles admin @@ -233,22 +266,50 @@ def can_see_vote(idvote, iduser=-1): vote = query_db('select * from votes where id=?', [idvote], one=True) if user is None and not vote.is_public: return False - return True # :TODO:maethor:20120529: Check others things + return True # :TODO:maethor:120529: Check others things def can_vote(idvote, iduser=-1): + # :TODO:maethor:120604: Check if user has'nt already vote if not can_see_vote(idvote, iduser): return False - return True # :TODO:maethor:20120529: Check others things + return True # :TODO:maethor:120529: Check others things -@app.route('/vote/') +@app.route('/vote/', methods=['GET', 'POST']) def vote(idvote): vote = query_db('select *, roles.name as rolename from votes join roles on roles.id=votes.id_role where votes.id=?', [idvote], one=True) if vote is None: abort(404) if can_see_vote(idvote, session.get('user').get('id')): - choices = query_db('select * from choices where id_vote=?', [idvote]) + choices = query_db('select name, id from choices where id_vote=?', [idvote]) + if request.method == 'POST': + if can_vote(idvote, session.get('user').get('id')): + for choice in choices: + if str(choice['id']) in request.form.keys(): + g.db.execute('insert into user_choice (id_user, id_choice) values (?, ?)', + [session.get('user').get('id'), choice['id']]) + g.db.commit() + if vote['is_multiplechoice'] == 0: + break + else: + abort(401) + tuples = query_db('select choiceid, choicename, users.id as userid, users.name as username from (select choices.id as choiceid, choices.name as choicename, id_user as userid from choices join user_choice on choices.id = user_choice.id_choice where id_vote = ?) join users on userid = users.id', [idvote]) + users = dict() + for t in tuples: + if t['userid'] in users: + choice = dict() + choice['id'] = t['choiceid'] + choice['name'] = t['choicename'] + users[t['userid']]['choices'].append(choice) + else: + users[t['userid']] = dict() + users[t['userid']]['userid'] = t['userid'] + users[t['userid']]['username'] = t['username'] + choice = dict() + choice['id'] = t['choiceid'] + choice['name'] = t['choicename'] + users[t['userid']]['choices'] = [choice] attachments = query_db('select * from attachments where id_vote=?', [idvote]) - return render_template('vote.html', vote=vote, attachments=attachments, choices=choices, can_vote=can_vote(idvote, session.get('user').get('id'))) + return render_template('vote.html', vote=vote, attachments=attachments, choices=choices, users=users.values(), can_vote=can_vote(idvote, session.get('user').get('id'))) flash('Vous n\'avez pas le droit de voir ce vote, désolé.') return(url_for('home')) @@ -286,7 +347,7 @@ def admin_vote_add(): [request.form['title'], request.form['description'], request.form['category'], date_begin, date_end, transparent, public, multiplechoice, role['id'], session['user']['id']]) g.db.commit() vote = query_db('select * from votes where title = ? and date_begin = ? order by id desc', - [request.form['title'], date_begin], one=True) # :DEBUG:maethor:20120528: Bug possible car le titre n'est pas unique + [request.form['title'], date_begin], one=True) # :DEBUG:maethor:120528: Bug possible car le titre n'est pas unique if vote is None: flash(u'Une erreur est survenue !', 'error') return redirect(url_for('home')) @@ -315,7 +376,7 @@ def admin_vote_edit(voteid): if 'public' in request.form.keys(): public = 1 isopen = 0 - if request.form['status'] == 'Ouvert': # :TODO:maethor:20120529: Check if there is at least 2 choices before + if request.form['status'] == 'Ouvert': # :TODO:maethor:120529: Check if there is at least 2 choices before isopen = 1 g.db.execute('update votes set title = ?, description = ?, category = ?, is_transparent = ?, is_public = ?, is_open = ? where id = ?', [request.form['title'], request.form['description'], request.form['category'], transparent, public, isopen, voteid]) @@ -325,11 +386,12 @@ def admin_vote_edit(voteid): else: flash(u'Vous devez spécifier un titre.', 'error') - # :TODO:maethor:20120529: Calculer la durée du vote (différence date_end - date_begin) + # :TODO:maethor:120529: Calculer la durée du vote (différence date_end - date_begin) vote['duration'] = 15 group = query_db('select name from roles where id = ?', [vote['id_role']], one=True) choices = query_db('select * from choices where id_vote = ?', [voteid]) - return render_template('admin_vote_edit.html', vote=vote, group=group, choices=choices) + attachments = query_db('select * from attachments where id_vote = ?', [voteid]) + return render_template('admin_vote_edit.html', vote=vote, group=group, choices=choices, attachments=attachments) @app.route('/admin/votes/addchoice/', methods=['POST']) def admin_vote_addchoice(voteid): @@ -352,7 +414,7 @@ def admin_vote_editchoice(voteid, choiceid): if request.method == 'POST': g.db.execute('update choices set name=? where id = ? and id_vote = ?', [request.form['title'], choiceid, voteid]) g.db.commit() - elif request.method == 'DELETE': # :COMMENT:maethor:20120528: I can't find how to use it from template + elif request.method == 'DELETE': # :COMMENT:maethor:120528: I can't find how to use it from template g.db.execute('delete from choices where id = ? and id_vote = ?', [choiceid, voteid]) g.db.commt() return redirect(url_for('admin_vote_edit', voteid=voteid)) @@ -368,6 +430,28 @@ def admin_vote_deletechoice(voteid, choiceid): g.db.commit() return redirect(url_for('admin_vote_edit', voteid=voteid)) +@app.route('/admin/votes/addattachment/', methods=['POST']) +def admin_vote_addattachment(voteid): + if not session.get('user').get('is_admin'): + abort(401) + vote = query_db('select * from votes where id = ?', [voteid], one=True) + if vote is None: + abort(404) + g.db.execute('insert into attachments (url, id_vote) values (?, ?)', [request.form['url'], voteid]) + g.db.commit() + return redirect(url_for('admin_vote_edit', voteid=voteid)) + +@app.route('/admin/votes/deleteattachment//') +def admin_vote_deleteattachment(voteid, attachmentid): + if not session.get('user').get('is_admin'): + abort(401) + attachment = query_db('select * from attachments where id = ? and id_vote = ?', [attachmentid, voteid], one=True) + if attachment is None: + abort(404) + g.db.execute('delete from attachments where id = ? and id_vote = ?', [attachmentid, voteid]) + g.db.commit() + return redirect(url_for('admin_vote_edit', voteid=voteid)) + #------ # Main