users: Move passwd handler from people

[ipfire.org.git] / src / web / users.py

diff --git a/src/web/users.py b/src/web/users.py
index af34078bb823c75bed3d138ad56082fee3d8265a..89e2359debf76caeffe5db0b2b2e86bd4b0c03f0 100644 (file)
--- a/src/web/users.py
+++ b/src/web/users.py
@@ -142,6 +142,53 @@ class AvatarHandler(base.BaseHandler):
                        return f.getvalue()
 
 
+class PasswdHandler(base.BaseHandler):
+       @tornado.web.authenticated
+       def get(self, uid):
+               account = self.backend.accounts.get_by_uid(uid)
+               if not account:
+                       raise tornado.web.HTTPError(404, "Could not find account %s" % uid)
+
+               # Check for permissions
+               if not account.can_be_managed_by(self.current_user):
+                       raise tornado.web.HTTPError(403, "%s cannot manage %s" % (self.current_user, account))
+
+               self.render("users/passwd.html", account=account)
+
+       @tornado.web.authenticated
+       def post(self, uid):
+               account = self.backend.accounts.get_by_uid(uid)
+               if not account:
+                       raise tornado.web.HTTPError(404, "Could not find account %s" % uid)
+
+               # Check for permissions
+               if not account.can_be_managed_by(self.current_user):
+                       raise tornado.web.HTTPError(403, "%s cannot manage %s" % (self.current_user, account))
+
+               # Get current password
+               password = self.get_argument("password")
+
+               # Get new password
+               password1 = self.get_argument("password1")
+               password2 = self.get_argument("password2")
+
+               # Passwords must match
+               if not password1 == password2:
+                       raise tornado.web.HTTPError(400, "Passwords do not match")
+
+               # XXX Check password complexity
+
+               # Check if old password matches
+               if not account.check_password(password):
+                       raise tornado.web.HTTPError(403, "Incorrect password for %s" % account)
+
+               # Save new password
+               account.passwd(password1)
+
+               # Redirect back to user's page
+               self.redirect("/users/%s" % account.uid)
+
+
 class GroupIndexHandler(base.BaseHandler):
        @tornado.web.authenticated
        def get(self):