X-Git-Url: https://git.cyclocoop.org/?a=blobdiff_plain;f=main.py;h=4662b59beecf0db8685d075335176b61189f01a5;hb=4517694972e64e0b3a26b6bc9a7fc39d7ac8af38;hp=f749cc43107229300be7b02bbff5350b7ea3db0f;hpb=122a152acb069f3658230a9c6f1ac62114554cf2;p=cavote.git diff --git a/main.py b/main.py index f749cc4..4662b59 100755 --- a/main.py +++ b/main.py @@ -12,8 +12,6 @@ locale.setlocale(locale.LC_ALL, '') DATABASE = '/tmp/cavote.db' SECRET_KEY = '{J@uRKO,xO-PK7B,jF?>iHbxLasF9s#zjOoy=+:' DEBUG = True -USERNAME = 'admin' -PASSWORD = 'admin' app = Flask(__name__) app.config.from_object(__name__) @@ -49,40 +47,123 @@ def init_db(): # Login / Logout def valid_login(username, password): - return username == app.config['USERNAME'] and password == app.config['PASSWORD'] + return query_db('select * from users where email = ? and password = ?', [username, password], one=True) + +def connect_user(user): + session['user'] = user # :KLUDGE:maethor:120528: Stoquer toute la ligne de la table users dans la session, c'est un peu crade… + #session['user']['id'] = user['id'] + #session['user']['name'] = user['name'] + #session['user']['email'] = user['email'] + #session['user']['organization'] = user['organization'] + #if user['is_admin'] == 1: + # session['user']['is_admin'] = True + +def disconnect_user(): + session.pop('user', None) @app.route('/login', methods=['GET', 'POST']) def login(): - error = None if request.method == 'POST': - if valid_login(request.form['username'], request.form['password']): - session['username'] = request.form['username'] - if session['username'] == 'admin': - session['is_admin'] = True - flash('You were logged in') - return redirect(url_for('home')) + user = valid_login(request.form['username'], request.form['password']) + if user is None: + flash('Invalid username/password', 'error') else: - error = "Invalid username/password" - return render_template('login.html', error=error) + connect_user(user) + flash('You were logged in', 'success') + return redirect(url_for('home')) + return render_template('login.html') @app.route('/logout') def logout(): - session.pop('username', None) - session.pop('is_admin', None) - flash('You were logged out') + disconnect_user() + flash('You were logged out', 'info') return redirect(url_for('home')) +#----------------- +# Change password + +@app.route('/password/lost', methods=['GET', 'POST']) +def password_lost(): + info = None + if request.method == 'POST': + user = query_db('select * from users where email = ?', [request.form['email']], one=True) + if user is None: + flash('Cet utilisateur n\'existe pas !', 'error') + else: + # :TODO:maethor:120528: Générer la clé, la mettre dans la base de données et envoyer le mail + flash(u"Un mail a été envoyé à " + user['email'], 'info') + return render_template('password_lost.html') + +@app.route('/login//') +def login_key(userid, key): + user = query_db('select * from users where id = ? and key = ?', [userid, key], one=True) + if user is None or key == "invalid": + abort(404) + else: + connect_user(user) + # :TODO:maethor:120528: Remplacer la clé pour qu'elle ne puisse plus être utilisée (invalid) + flash(u"Veuillez mettre à jour votre mot de passe", 'info') + return redirect(url_for('user_password'), userid=user['userid']) + #--------------- # User settings -@app.route('/user/settings/') -def show_settings(username): - if username != session['username']: + +@app.route('/user/') +def show_user(userid): + if int(userid) != session.get('user').get('id'): abort(401) + return render_template('show_user.html') +@app.route('/user/settings/', methods=['GET', 'POST']) +def user_settings(userid): + if int(userid) != session.get('user').get('id'): + abort(401) + if request.method == 'POST': + g.db.execute('update users set email = ?, name = ?, organization = ? where id = ?', + [request.form['email'], request.form['name'], request.form['organization'], session['user']['id']]) + g.db.commit() + disconnect_user() # :TODO:maethor:120528: Maybe useless, but this is simple way to refresh session :D + flash(u'Votre profil a été mis à jour !', 'success') + return redirect(url_for('login')) + return render_template('user_settings.html') + +@app.route('/user/password/', methods=['GET', 'POST']) +def user_password(userid): + if int(userid) != session.get('user').get('id'): + abort(401) + if request.method == 'POST': + if request.form['password'] == request.form['password2']: + # :TODO:maethor:120528: Chiffrer le mot de passe ! + g.db.execute('update users set password = ? where id = ?', [request.form['password'], session['user']['id']]) + g.db.commit() + flash(u'Votre mot de passe a été mis à jour.', 'success') + else: + flash(u'Les mots de passe sont différents.', 'error') + return render_template('user_settings.html') #------------ # User admin +@app.route('/users/admin/add', methods=['GET', 'POST']) +def add_user(): + if not session.get('user').get('is_admin'): + abort(401) + if request.method == 'POST': + if request.form['email']: + # :TODO:maethor:120528: Check fields + password = "toto" # :TODO:maethor:120528: Generate password + admin = 0 + if 'admin' in request.form.keys(): + admin = 1 + g.db.execute('insert into users (email, name, organization, password, is_admin) values (?, ?, ?, ?, ?)', + [request.form['email'], request.form['username'], request.form['organization'], password, admin]) + g.db.commit() + # :TODO:maethor:120528: Send mail + flash(u'Le nouvel utilisateur a été créé avec succès', 'success') + return redirect(url_for('home')) + else: + flash(u"Vous devez spécifier une adresse email.", 'error') + return render_template('add_user.html') #------------ # Votes list @@ -103,32 +184,31 @@ def show_votes(votes): #------------- # Votes admin -@app.route('/votes/admin/new') -def new_vote(): - if not session.get('is_admin'): - abort(401) - return render_template('new_vote.html') - -@app.route('/votes/admin/add', methods=['POST']) +@app.route('/votes/admin/add', methods=['GET', 'POST']) def add_vote(): - if not session.get('is_admin'): + if not session.get('user').get('is_admin'): abort(401) - date_begin = date.today() - date_end = date.today() + timedelta(days=int(request.form['days'])) - transparent = 0 - public = 0 - multiplechoice = 0 - if 'transparent' in request.form.keys(): - transparent = 1 - if 'public' in request.form.keys(): - public = 1 - if 'multiplechoice' in request.form.keys(): - multiplechoice = 1 - g.db.execute('insert into votes (title, description, date_begin, date_end, is_transparent, is_public, is_multiplechoice) values (?, ?, ?, ?, ?, ?, ?)', - [request.form['title'], request.form['description'], date_begin, date_end, transparent, public, multiplechoice]) - g.db.commit() - flash('New entry was successfully posted') - return redirect(url_for('home')) + if request.method == 'POST': + if request.form['title']: + date_begin = date.today() + date_end = date.today() + timedelta(days=int(request.form['days'])) + transparent = 0 + public = 0 + multiplechoice = 0 + if 'transparent' in request.form.keys(): + transparent = 1 + if 'public' in request.form.keys(): + public = 1 + if 'multiplechoice' in request.form.keys(): + multiplechoice = 1 + g.db.execute('insert into votes (title, description, date_begin, date_end, is_transparent, is_public, is_multiplechoice) values (?, ?, ?, ?, ?, ?, ?)', + [request.form['title'], request.form['description'], date_begin, date_end, transparent, public, multiplechoice]) + g.db.commit() + flash('New entry was successfully posted', 'info') + return redirect(url_for('home')) + else: + flash(u'Vous devez spécifier un titre.', 'error') + return render_template('new_vote.html') #------ # Main