diff options
Diffstat (limited to 'wqflask')
| -rw-r--r-- | wqflask/wqflask/templates/admin/ind_user_manager.html | 2 | ||||
| -rw-r--r-- | wqflask/wqflask/user_manager.py | 158 |
2 files changed, 93 insertions, 67 deletions
diff --git a/wqflask/wqflask/templates/admin/ind_user_manager.html b/wqflask/wqflask/templates/admin/ind_user_manager.html index dc24bca5..e859b442 100644 --- a/wqflask/wqflask/templates/admin/ind_user_manager.html +++ b/wqflask/wqflask/templates/admin/ind_user_manager.html @@ -51,7 +51,7 @@ <td>Superuser</td> {% if user.superuser %} - <td>Made supervisor {{ timeago(user.superuser_info['timestamp'] + "Z") }} by + <td>Made a superuser {{ timeago(user.superuser_info['timestamp'] + "Z") }} by {{ user.crowner.name_and_org }}. </td> {% else %} diff --git a/wqflask/wqflask/user_manager.py b/wqflask/wqflask/user_manager.py index c092771c..768415b5 100644 --- a/wqflask/wqflask/user_manager.py +++ b/wqflask/wqflask/user_manager.py @@ -58,7 +58,7 @@ def timestamp(): class UserSession(object): - cookie_name = 'session_id' + cookie_name = 'session_id_v2' def __init__(self): cookie = request.cookies.get(self.cookie_name) @@ -70,7 +70,7 @@ class UserSession(object): assert len(session_id) == 36, "Is session_id a uuid?" assert separator == ":", "Expected a : here" assert session_id_signature == actual_hmac_creation(session_id), "Uh-oh, someone tampering with the cookie?" - self.redis_key = "session_id:" + session_id + self.redis_key = self.cookie_name + ":" + session_id print("self.redis_key is:", self.redis_key) self.session_id = session_id self.record = Redis.hgetall(self.redis_key) @@ -266,7 +266,7 @@ def verify_email(): # As long as they have access to the email account # We might as well log them in - session_id_signed = successful_login(user) + session_id_signed = LoginUser().successful_login(user) response = make_response(render_template("new_security/thank_you.html")) response.set_cookie(UserSession.cookie_name, session_id_signed) return response @@ -333,73 +333,99 @@ class DecodeUser(object): @app.route("/n/login", methods=('GET', 'POST')) def login(): - params = request.form if request.form else request.args - print("in login params are:", params) - if not params: - return render_template("new_security/login_user.html") - else: - user = model.User.query.filter_by(email_address=params['email_address']).one() - submitted_password = params['password'] - pwfields = Struct(json.loads(user.password)) - encrypted = Password(submitted_password, - pwfields.salt, - pwfields.iterations, - pwfields.keylength, - pwfields.hashfunc) - print("\n\nComparing:\n{}\n{}\n".format(encrypted.password, pwfields.password)) - valid = pbkdf2.safe_str_cmp(encrypted.password, pwfields.password) - print("valid is:", valid) - - if valid and not user.confirmed: - VerificationEmail(user) - return render_template("new_security/verification_still_needed.html", - subject=VerificationEmail.subject) + lu = LoginUser() + return lu.standard_login() - if valid: - return actual_login(user) +class LoginUser(object): + remember_time = 60 * 60 * 24 * 30 # One month in seconds + def __init__(self): + self.remember_me = False + + def standard_login(self): + """Login through the normal form""" + params = request.form if request.form else request.args + print("in login params are:", params) + if not params: + return render_template("new_security/login_user.html") else: - unsuccessful_login(user) - flash("Invalid email-address or password. Please try again.", "alert-error") - response = make_response(redirect(url_for('login'))) - - return response - -def actual_login(user, assumed_by=None): - """The meat of the logging in process""" - session_id_signed = successful_login(user, assumed_by) - flash("Thank you for logging in {}.".format(user.full_name), "alert-success") - response = make_response(redirect(url_for('index_page'))) - response.set_cookie(UserSession.cookie_name, session_id_signed) - return response - -def successful_login(user, assumed_by=None): - login_rec = model.Login(user) - login_rec.successful = True - login_rec.session_id = str(uuid.uuid4()) - login_rec.assumed_by = assumed_by - #session_id = "session_id:{}".format(login_rec.session_id) - session_id_signature = actual_hmac_creation(login_rec.session_id) - session_id_signed = login_rec.session_id + ":" + session_id_signature - print("session_id_signed:", session_id_signed) - - session = dict(login_time = time.time(), - user_id = user.id, - user_email_address = user.email_address) - - key = "session_id:" + login_rec.session_id - print("Key when signing:", key) - Redis.hmset(key, session) - db_session.add(login_rec) - db_session.commit() - return session_id_signed + user = model.User.query.filter_by(email_address=params['email_address']).one() + submitted_password = params['password'] + pwfields = Struct(json.loads(user.password)) + encrypted = Password(submitted_password, + pwfields.salt, + pwfields.iterations, + pwfields.keylength, + pwfields.hashfunc) + print("\n\nComparing:\n{}\n{}\n".format(encrypted.password, pwfields.password)) + valid = pbkdf2.safe_str_cmp(encrypted.password, pwfields.password) + print("valid is:", valid) + + if valid and not user.confirmed: + VerificationEmail(user) + return render_template("new_security/verification_still_needed.html", + subject=VerificationEmail.subject) + + + if valid: + if params.get('remember'): + print("I will remember you") + self.remember_me = True + + return self.actual_login(user) + + else: + self.unsuccessful_login(user) + flash("Invalid email-address or password. Please try again.", "alert-error") + response = make_response(redirect(url_for('login'))) + + return response + + def actual_login(self, user, assumed_by=None): + """The meat of the logging in process""" + session_id_signed = self.successful_login(user, assumed_by) + flash("Thank you for logging in {}.".format(user.full_name), "alert-success") + response = make_response(redirect(url_for('index_page'))) + if self.remember_me: + max_age = self.remember_time + else: + max_age = None + + response.set_cookie(UserSession.cookie_name, session_id_signed, max_age=max_age) + return response + + def successful_login(self, user, assumed_by=None): + login_rec = model.Login(user) + login_rec.successful = True + login_rec.session_id = str(uuid.uuid4()) + login_rec.assumed_by = assumed_by + #session_id = "session_id:{}".format(login_rec.session_id) + session_id_signature = actual_hmac_creation(login_rec.session_id) + session_id_signed = login_rec.session_id + ":" + session_id_signature + print("session_id_signed:", session_id_signed) + + session = dict(login_time = time.time(), + user_id = user.id, + user_email_address = user.email_address) + + key = UserSession.cookie_name + ":" + login_rec.session_id + print("Key when signing:", key) + Redis.hmset(key, session) + if self.remember_me: + expire_time = self.remember_time + else: + expire_time = 60 * 60 * 24 * 2 # two days + Redis.expire(key, expire_time) + db_session.add(login_rec) + db_session.commit() + return session_id_signed -def unsuccessful_login(user): - login_rec = model.Login(user) - login_rec.successful = False - db_session.add(login_rec) - db_session.commit() + def unsuccessful_login(self, user): + login_rec = model.Login(user) + login_rec.successful = False + db_session.add(login_rec) + db_session.commit() @app.route("/n/logout") def logout(): @@ -483,7 +509,7 @@ def assume_identity(): user_id = params['user_id'] user = model.User.query.get(user_id) assumed_by = g.user_session.user_id - return actual_login(user, assumed_by) + return LoginUser().actual_login(user, assumed_by=assumed_by) @app.route("/n/register", methods=('GET', 'POST')) |