src/web/handlers_auth.py

   1 #!/usr/bin/python
   2
   3 import tornado.web
   4
   5 from .handlers_base import *
   6
   7 class LoginHandler(BaseHandler):
   8         def get(self):
   9                 # If the user is already logged in, we just send him back
  10                 # to the start page.
  11                 if self.current_user:
  12                         self.redirect("/")
  13                         return
  14
  15                 self.render("login.html", failed=False)
  16
  17         def post(self):
  18                 name = self.get_argument("name", None)
  19                 passphrase = self.get_argument("pass", None)
  20
  21                 # Log in the user
  22                 user = self.pakfire.users.auth(name, passphrase)
  23
  24                 # If the login was unsuccessful
  25                 if not user:
  26                         self.set_status(403, "Login failed")
  27                         return self.render("login.html", failed=True)
  28
  29                 # Create a new session for the user.
  30                 with self.db.transaction():
  31                         self.session = self.backend.sessions.create(user,
  32                                 self.current_address, user_agent=self.user_agent)
  33
  34                 # Set a cookie and update the current user.
  35                 self.set_cookie("session_id", self.session.session_id,
  36                         expires=self.session.valid_until)
  37
  38                 # If there is "next" given, we redirect the user accordingly.
  39                 # Otherwise we redirect to the front page.
  40                 next = self.get_argument("next", "/")
  41                 self.redirect(next)
  42
  43
  44 class RegisterHandler(BaseHandler):
  45         def get(self):
  46                 # If the user is already logged in, we just send him back
  47                 # to the start page.
  48                 if self.current_user:
  49                         self.redirect("/")
  50                         return
  51
  52                 self.render("register.html")
  53
  54         def post(self):
  55                 _ = self.locale.translate
  56                 msgs = []
  57
  58                 # Read all information from the request.
  59                 name = self.get_argument("name", None)
  60                 email = self.get_argument("email", None)
  61                 realname = self.get_argument("realname", None)
  62                 pass1 = self.get_argument("pass1", None)
  63                 pass2 = self.get_argument("pass2", None)
  64
  65                 if not name:
  66                         msgs.append(_("No username provided."))
  67                 elif self.pakfire.users.name_is_used(name):
  68                         msgs.append(_("The given username is already taken."))
  69
  70                 if not email:
  71                         msgs.append(_("No email address provided."))
  72                 elif not "@" in email:
  73                         msgs.append(_("Email address is invalid."))
  74                 elif self.pakfire.users.email_is_used(email):
  75                         msgs.append(_("The given email address is already used for another account."))
  76
  77                 # Check if the passphrase is okay.
  78                 if not pass1:
  79                         msgs.append(_("No password provided."))
  80                 elif not pass1 == pass2:
  81                         msgs.append(_("Passwords do not match."))
  82                 else:
  83                         accepted, score = self.backend.users.check_password_strength(pass1)
  84                         if not accepted:
  85                                 msgs.append(_("Your password is too weak."))
  86
  87                 if msgs:
  88                         self.render("register-fail.html", messages=msgs)
  89                         return
  90
  91                 # All provided data seems okay.
  92                 # Register the new user to the database.
  93                 user = self.pakfire.users.register(name, pass1, email, realname,
  94                         self.locale.code)
  95
  96                 self.render("register-success.html", user=user)
  97
  98
  99 class ActivationHandler(BaseHandler):
 100         def get(self, _user):
 101                 user = self.pakfire.users.get_by_name(_user)
 102                 if not user:
 103                         raise tornado.web.HTTPError(404)
 104
 105                 code = self.get_argument("code")
 106
 107                 # Check if the activation code matches and then activate the account.
 108                 if user.activation_code == code:
 109                         user.activate()
 110
 111                         # If an admin activated another account, he impersonates it.
 112                         if self.current_user and self.current_user.is_admin():
 113                                 self.session.start_impersonation(user)
 114
 115                         else:
 116                                 # Automatically login the user.
 117                                 session = sessions.Session.create(self.pakfire, user)
 118
 119                                 # Set a cookie and update the current user.
 120                                 self.set_cookie("session_id", session.id, expires=session.valid_until)
 121                                 self._current_user = user
 122
 123                         self.render("register-activation-success.html", user=user)
 124                         return
 125
 126                 # Otherwise, show an error message.
 127                 self.render("register-activation-fail.html")
 128
 129
 130 class PasswordRecoveryHandler(BaseHandler):
 131         def get(self):
 132                 return self.render("user-forgot-password.html")
 133
 134         def post(self):
 135                 username = self.get_argument("name", None)
 136
 137                 if not username:
 138                         return self.get()
 139
 140                 # XXX TODO
 141
 142
 143 class LogoutHandler(BaseHandler):
 144         @tornado.web.authenticated
 145         def get(self):
 146                 # Destroy the user's session.
 147                 with self.db.transaction():
 148                         self.session.destroy()
 149
 150                 # Remove the cookie, that identifies the user.
 151                 self.clear_cookie("session_id")
 152
 153                 # Redirect the user to the front page.
 154                 self.redirect("/")