canaille-globuzma/canaille/core/account.py

775 lines
23 KiB
Python
Raw Normal View History

2023-03-17 23:38:56 +00:00
import datetime
import io
2022-01-01 10:56:48 +00:00
from dataclasses import astuple
from dataclasses import dataclass
from typing import List
2021-12-20 22:57:27 +00:00
import pkg_resources
2021-12-01 11:19:28 +00:00
import wtforms
2023-04-09 13:52:55 +00:00
from canaille.app import b64_to_obj
from canaille.app import default_fields
from canaille.app import models
2023-04-09 13:52:55 +00:00
from canaille.app import obj_to_b64
from canaille.app import profile_hash
from canaille.app.flask import current_user
from canaille.app.flask import permissions_needed
from canaille.app.flask import render_htmx_template
from canaille.app.flask import request_is_htmx
from canaille.app.flask import smtp_needed
from canaille.app.flask import user_needed
from canaille.app.forms import TableForm
2023-06-05 16:10:37 +00:00
from canaille.backends import BaseBackend
2021-12-20 22:57:27 +00:00
from flask import abort
from flask import Blueprint
from flask import current_app
from flask import flash
from flask import redirect
from flask import request
from flask import send_file
from flask import session
from flask import url_for
2020-10-22 15:37:01 +00:00
from flask_babel import gettext as _
2023-03-01 14:30:07 +00:00
from flask_babel import refresh
from flask_themer import render_template
2021-12-20 22:57:27 +00:00
from werkzeug.datastructures import CombinedMultiDict
from werkzeug.datastructures import FileStorage
2022-12-20 23:20:20 +00:00
from .forms import FirstLoginForm
2021-12-20 22:57:27 +00:00
from .forms import ForgottenPasswordForm
from .forms import InvitationForm
from .forms import LoginForm
from .forms import MINIMUM_PASSWORD_LENGTH
2021-12-20 22:57:27 +00:00
from .forms import PasswordForm
from .forms import PasswordResetForm
from .forms import profile_form
from .forms import PROFILE_FORM_FIELDS
2021-12-20 22:57:27 +00:00
from .mails import send_invitation_mail
from .mails import send_password_initialization_mail
from .mails import send_password_reset_mail
2020-08-14 11:18:08 +00:00
2021-05-24 15:43:15 +00:00
bp = Blueprint("account", __name__)
2020-08-14 11:18:08 +00:00
2020-08-19 14:20:57 +00:00
@bp.route("/")
def index():
user = current_user()
if not user:
2021-05-24 15:43:15 +00:00
return redirect(url_for("account.login"))
if user.can_edit_self or user.can_manage_users:
2023-06-28 15:56:49 +00:00
return redirect(url_for("account.profile_edition", edited_user=user))
if user.can_use_oidc:
return redirect(url_for("oidc.consents.consents"))
return redirect(url_for("account.about"))
2020-08-19 14:20:57 +00:00
2020-11-13 09:45:01 +00:00
@bp.route("/about")
def about():
try:
version = pkg_resources.get_distribution("canaille").version
except pkg_resources.DistributionNotFound: # pragma: no cover
version = "git"
2020-11-13 09:45:01 +00:00
return render_template("about.html", version=version)
2020-08-19 14:20:57 +00:00
@bp.route("/login", methods=("GET", "POST"))
def login():
if current_user():
2023-06-28 15:56:49 +00:00
return redirect(url_for("account.profile_edition", edited_user=current_user()))
2020-08-19 14:20:57 +00:00
form = LoginForm(request.form or None)
form.render_field_macro_file = "partial/login_field.html"
2023-06-05 16:10:37 +00:00
form["login"].render_kw["placeholder"] = BaseBackend.get().login_placeholder()
2020-08-14 13:26:14 +00:00
2023-06-28 14:11:30 +00:00
if not request.form or form.form_control():
return render_template("login.html", form=form)
2023-06-28 14:11:30 +00:00
user = models.User.get_from_login(form.login.data)
if user and not user.has_password():
2023-06-28 15:56:49 +00:00
return redirect(url_for("account.firstlogin", user=user))
2021-01-23 21:30:43 +00:00
2023-06-28 14:11:30 +00:00
if not form.validate():
models.User.logout()
flash(_("Login failed, please check your information"), "error")
return render_template("login.html", form=form)
session["attempt_login"] = form.login.data
return redirect(url_for("account.password"))
2021-01-23 21:30:43 +00:00
@bp.route("/password", methods=("GET", "POST"))
def password():
if "attempt_login" not in session:
2021-05-24 15:43:15 +00:00
return redirect(url_for("account.login"))
2021-01-23 21:30:43 +00:00
form = PasswordForm(request.form or None)
form.render_field_macro_file = "partial/login_field.html"
2021-01-23 21:30:43 +00:00
2023-06-28 14:11:30 +00:00
if not request.form or form.form_control():
return render_template(
"password.html", form=form, username=session["attempt_login"]
)
user = models.User.get_from_login(session["attempt_login"])
if user and not user.has_password():
2023-06-28 15:56:49 +00:00
return redirect(url_for("account.firstlogin", user=user))
2023-06-28 14:11:30 +00:00
if not form.validate() or not user:
models.User.logout()
flash(_("Login failed, please check your information"), "error")
return render_template(
"password.html", form=form, username=session["attempt_login"]
)
success, message = user.check_password(form.password.data)
if not success:
models.User.logout()
flash(message or _("Login failed, please check your information"), "error")
return render_template(
"password.html", form=form, username=session["attempt_login"]
)
2020-08-17 07:45:35 +00:00
2023-06-28 14:11:30 +00:00
del session["attempt_login"]
user.login()
flash(
_("Connection successful. Welcome %(user)s", user=user.formatted_name[0]),
"success",
2021-01-23 21:30:43 +00:00
)
2023-06-28 14:11:30 +00:00
return redirect(url_for("account.index"))
2020-08-14 11:18:08 +00:00
2020-08-16 17:39:14 +00:00
@bp.route("/logout")
2020-08-14 13:26:14 +00:00
def logout():
2020-10-31 17:22:24 +00:00
user = current_user()
2023-06-28 15:56:49 +00:00
2020-10-31 17:22:24 +00:00
if user:
flash(
_(
"You have been disconnected. See you next time %(user)s",
user=user.formatted_name[0],
),
2020-11-01 10:33:56 +00:00
"success",
2020-10-31 17:22:24 +00:00
)
user.logout()
2020-08-16 17:39:14 +00:00
return redirect("/")
2020-10-20 09:44:45 +00:00
2023-06-28 15:56:49 +00:00
@bp.route("/firstlogin/<user:user>", methods=("GET", "POST"))
def firstlogin(user):
if user.has_password():
abort(404)
2022-12-20 23:20:20 +00:00
form = FirstLoginForm(request.form or None)
if not request.form:
2023-06-28 15:56:49 +00:00
return render_template("firstlogin.html", form=form, user=user)
2023-03-28 18:30:29 +00:00
form.validate()
success = all(
send_password_initialization_mail(user, email) for email in user.emails
)
if success:
flash(
_(
2023-06-28 15:56:49 +00:00
"A password initialization link has been sent at your email address. "
"You should receive it within a few minutes."
),
"success",
)
else:
flash(_("Could not send the password initialization email"), "error")
2023-06-28 15:56:49 +00:00
return render_template("firstlogin.html", form=form)
@bp.route("/users", methods=["GET", "POST"])
2021-12-02 17:23:14 +00:00
@permissions_needed("manage_users")
2020-11-01 10:33:56 +00:00
def users(user):
table_form = TableForm(
models.User, fields=user.read | user.write, formdata=request.form
)
if request.form and not table_form.validate():
abort(404)
return render_htmx_template(
"users.html",
menuitem="users",
table_form=table_form,
)
2020-11-01 10:33:56 +00:00
2022-01-01 10:56:48 +00:00
@dataclass
class Invitation:
creation_date_isoformat: str
user_name: str
user_name_editable: bool
email: str
2022-01-01 10:56:48 +00:00
groups: List[str]
@property
def creation_date(self):
2023-03-17 23:38:56 +00:00
return datetime.datetime.fromisoformat(self.creation_date_isoformat)
2022-01-01 10:56:48 +00:00
def has_expired(self):
DEFAULT_INVITATION_DURATION = 2 * 24 * 60 * 60
2023-03-17 23:38:56 +00:00
return datetime.datetime.now(
datetime.timezone.utc
) - self.creation_date > datetime.timedelta(
2022-01-01 10:56:48 +00:00
seconds=current_app.config.get(
"INVITATION_EXPIRATION", DEFAULT_INVITATION_DURATION
)
)
def b64(self):
return obj_to_b64(astuple(self))
def profile_hash(self):
return profile_hash(*astuple(self))
2021-12-01 11:19:28 +00:00
@bp.route("/invite", methods=["GET", "POST"])
@smtp_needed()
2021-12-02 17:23:14 +00:00
@permissions_needed("manage_users")
2021-12-01 11:19:28 +00:00
def user_invitation(user):
form = InvitationForm(request.form or None)
email_sent = None
2021-12-01 11:19:28 +00:00
registration_url = None
form_validated = False
2021-12-01 11:19:28 +00:00
if request.form and form.validate():
form_validated = True
2022-01-01 10:56:48 +00:00
invitation = Invitation(
2023-03-17 23:38:56 +00:00
datetime.datetime.now(datetime.timezone.utc).isoformat(),
form.user_name.data,
form.user_name_editable.data,
form.email.data,
2022-01-01 10:56:48 +00:00
form.groups.data,
)
2021-12-01 11:19:28 +00:00
registration_url = url_for(
"account.registration",
2022-01-01 10:56:48 +00:00
data=invitation.b64(),
hash=invitation.profile_hash(),
2021-12-01 11:19:28 +00:00
_external=True,
)
if request.form["action"] == "send":
email_sent = send_invitation_mail(form.email.data, registration_url)
2021-12-01 11:19:28 +00:00
return render_template(
"invite.html",
form=form,
menuitems="users",
form_validated=form_validated,
email_sent=email_sent,
2021-12-01 11:19:28 +00:00
registration_url=registration_url,
)
@bp.route("/register/<data>/<hash>", methods=["GET", "POST"])
def registration(data, hash):
try:
2022-01-01 10:56:48 +00:00
invitation = Invitation(*b64_to_obj(data))
2021-12-01 11:19:28 +00:00
except:
flash(
_("The invitation link that brought you here was invalid."),
"error",
)
return redirect(url_for("account.index"))
2022-01-01 10:56:48 +00:00
if invitation.has_expired():
flash(
_("The invitation link that brought you here has expired."),
"error",
)
return redirect(url_for("account.index"))
if models.User.get_from_login(invitation.user_name):
2021-12-01 11:19:28 +00:00
flash(
_("Your account has already been created."),
"error",
)
return redirect(url_for("account.index"))
2020-12-31 17:16:35 +00:00
2021-12-01 11:19:28 +00:00
if current_user():
flash(
_("You are already logged in, you cannot create an account."),
"error",
)
2021-12-01 11:19:28 +00:00
return redirect(url_for("account.index"))
2020-11-01 10:33:56 +00:00
2022-01-01 10:56:48 +00:00
if hash != invitation.profile_hash():
2021-12-01 11:19:28 +00:00
flash(
_("The invitation link that brought you here was invalid."),
"error",
)
return redirect(url_for("account.index"))
2020-11-01 10:33:56 +00:00
data = {
"user_name": invitation.user_name,
"emails": [invitation.email],
"groups": invitation.groups,
}
2020-11-01 10:33:56 +00:00
2021-12-08 09:00:36 +00:00
readable_fields, writable_fields = default_fields()
2021-12-02 17:23:14 +00:00
form = profile_form(writable_fields, readable_fields)
if "groups" not in form and invitation.groups:
form["groups"] = wtforms.SelectMultipleField(
_("Groups"),
choices=[(group.id, group.display_name) for group in models.Group.query()],
render_kw={"readonly": "true"},
)
2021-12-01 11:19:28 +00:00
form.process(CombinedMultiDict((request.files, request.form)) or None, data=data)
if "readonly" in form["user_name"].render_kw and invitation.user_name_editable:
del form["user_name"].render_kw["readonly"]
2022-01-01 17:41:04 +00:00
2021-12-01 11:19:28 +00:00
form["password1"].validators = [
wtforms.validators.DataRequired(),
wtforms.validators.Length(min=MINIMUM_PASSWORD_LENGTH),
2021-12-01 11:19:28 +00:00
]
form["password2"].validators = [
wtforms.validators.DataRequired(),
wtforms.validators.Length(min=MINIMUM_PASSWORD_LENGTH),
2021-12-01 11:19:28 +00:00
]
form["password1"].flags.required = True
form["password2"].flags.required = True
if not request.form or form.form_control():
return render_template(
"profile_add.html",
form=form,
menuitem="users",
edited_user=None,
self_deletion=False,
)
2020-11-01 10:33:56 +00:00
if not form.validate():
flash(_("User account creation failed."), "error")
return render_template(
"profile_add.html",
form=form,
menuitem="users",
edited_user=None,
self_deletion=False,
)
user = profile_create(current_app, form)
user.login()
flash(_("Your account has been created successfully."), "success")
2023-06-28 15:56:49 +00:00
return redirect(url_for("account.profile_edition", edited_user=user))
2023-03-16 17:39:28 +00:00
@bp.route("/profile", methods=("GET", "POST"))
@permissions_needed("manage_users")
def profile_creation(user):
form = profile_form(user.write, user.read)
form.process(CombinedMultiDict((request.files, request.form)) or None)
for field in form:
if field.render_kw and "readonly" in field.render_kw:
del field.render_kw["readonly"]
if not request.form or form.form_control():
return render_template(
"profile_add.html",
form=form,
menuitem="users",
edited_user=None,
self_deletion=False,
)
2023-03-16 17:39:28 +00:00
if not form.validate():
flash(_("User account creation failed."), "error")
return render_template(
"profile_add.html",
form=form,
menuitem="users",
edited_user=None,
self_deletion=False,
)
2023-03-16 17:39:28 +00:00
user = profile_create(current_app, form)
2023-06-28 15:56:49 +00:00
return redirect(url_for("account.profile_edition", edited_user=user))
2020-11-01 10:33:56 +00:00
2021-12-01 11:19:28 +00:00
def profile_create(current_app, form):
user = models.User()
2021-12-01 11:19:28 +00:00
for attribute in form:
if attribute.name in user.attributes:
2021-12-01 11:19:28 +00:00
if isinstance(attribute.data, FileStorage):
data = attribute.data.stream.read()
else:
data = attribute.data
setattr(user, attribute.name, data)
2021-12-01 11:19:28 +00:00
if "photo" in form and form["photo_delete"].data:
2023-05-11 21:34:10 +00:00
del user.photo
2021-12-08 17:06:50 +00:00
given_name = user.given_name[0] if user.given_name else ""
family_name = user.family_name[0] if user.family_name else ""
user.formatted_name = [f"{given_name} {family_name}".strip()]
user.save()
if form["password1"].data:
user.set_password(form["password1"].data)
user.save()
flash(_("User account creation succeed."), "success")
2021-12-01 11:19:28 +00:00
return user
2023-06-28 15:56:49 +00:00
@bp.route("/profile/<user:edited_user>", methods=("GET", "POST"))
2020-10-20 09:44:45 +00:00
@user_needed()
2023-06-28 15:56:49 +00:00
def profile_edition(user, edited_user):
if not user.can_manage_users and not (user.can_edit_self and edited_user == user):
2023-03-16 17:39:28 +00:00
abort(404)
2023-06-28 15:56:49 +00:00
menuitem = "profile" if edited_user == user else "users"
fields = user.read | user.write
2023-03-16 17:39:28 +00:00
available_fields = {
"formatted_name",
2023-03-16 17:39:28 +00:00
"title",
"given_name",
"family_name",
"display_name",
2023-06-22 13:14:07 +00:00
"emails",
"phone_numbers",
"formatted_address",
2023-03-16 17:39:28 +00:00
"street",
"postal_code",
"locality",
"region",
"photo",
"photo_delete",
"employee_number",
"department",
"profile_url",
"preferred_language",
"organization",
2023-03-16 17:39:28 +00:00
}
data = {
2023-06-28 15:56:49 +00:00
field: getattr(edited_user, field)[0]
if getattr(edited_user, field)
and isinstance(getattr(edited_user, field), list)
and not PROFILE_FORM_FIELDS[field].field_class == wtforms.FieldList
2023-06-28 15:56:49 +00:00
else getattr(edited_user, field) or ""
for field in fields
2023-06-28 15:56:49 +00:00
if hasattr(edited_user, field) and field in available_fields
2023-03-16 17:39:28 +00:00
}
form = profile_form(
2023-06-28 15:56:49 +00:00
user.write & available_fields, user.read & available_fields, edited_user
)
2023-03-16 17:39:28 +00:00
form.process(CombinedMultiDict((request.files, request.form)) or None, data=data)
form.render_field_macro_file = "partial/profile_field.html"
form.render_field_extra_context = {
"user": user,
"edited_user": edited_user,
}
if not request.form or form.form_control():
return render_template(
"profile_edit.html",
form=form,
menuitem=menuitem,
2023-06-28 15:56:49 +00:00
edited_user=edited_user,
)
2023-03-16 17:39:28 +00:00
if not form.validate():
flash(_("Profile edition failed."), "error")
return render_template(
"profile_edit.html",
form=form,
menuitem=menuitem,
2023-06-28 15:56:49 +00:00
edited_user=edited_user,
)
2023-03-16 17:39:28 +00:00
for attribute in form:
2023-06-28 15:56:49 +00:00
if attribute.name in edited_user.attributes and attribute.name in user.write:
if isinstance(attribute.data, FileStorage):
data = attribute.data.stream.read()
else:
data = attribute.data
2023-03-16 17:39:28 +00:00
2023-06-28 15:56:49 +00:00
setattr(edited_user, attribute.name, data)
2023-03-16 17:39:28 +00:00
if "photo" in form and form["photo_delete"].data:
2023-06-28 15:56:49 +00:00
del edited_user.photo
2023-03-16 17:39:28 +00:00
if "preferred_language" in request.form:
# Refresh the babel cache in case the lang is updated
refresh()
2023-03-16 17:39:28 +00:00
if form["preferred_language"].data == "auto":
2023-06-28 15:56:49 +00:00
edited_user.preferred_language = None
2023-03-16 17:39:28 +00:00
2023-06-28 15:56:49 +00:00
edited_user.save()
flash(_("Profile updated successfully."), "success")
2023-06-28 15:56:49 +00:00
return redirect(url_for("account.profile_edition", edited_user=edited_user))
2023-03-16 17:39:28 +00:00
2023-06-28 15:56:49 +00:00
@bp.route("/profile/<user:edited_user>/settings", methods=("GET", "POST"))
2023-03-16 17:39:28 +00:00
@user_needed()
2023-06-28 15:56:49 +00:00
def profile_settings(user, edited_user):
if not user.can_manage_users and not (user.can_edit_self and edited_user == user):
2023-03-22 07:52:00 +00:00
abort(404)
2023-03-30 21:14:39 +00:00
if (
request.method == "GET"
or request.form.get("action") == "edit"
or request_is_htmx()
):
2023-03-22 07:52:00 +00:00
return profile_settings_edit(user, edited_user)
2020-11-01 10:33:56 +00:00
if request.form.get("action") == "delete":
2023-03-22 07:52:00 +00:00
return profile_delete(user, edited_user)
2020-11-01 10:33:56 +00:00
if request.form.get("action") == "password-initialization-mail":
success = all(
send_password_initialization_mail(edited_user, email)
for email in edited_user.emails
)
if success:
flash(
_(
2023-06-22 16:12:54 +00:00
"A password initialization link has been sent at the user email address. It should be received within a few minutes."
),
"success",
)
else:
flash(_("Could not send the password initialization email"), "error")
2023-03-22 07:52:00 +00:00
return profile_settings_edit(user, edited_user)
2021-01-22 17:26:53 +00:00
if request.form.get("action") == "password-reset-mail":
success = all(
send_password_reset_mail(edited_user, email) for email in edited_user.emails
)
if success:
2021-01-22 17:26:53 +00:00
flash(
_(
2023-06-22 16:12:54 +00:00
"A password reset link has been sent at the user email address. It should be received within a few minutes."
2021-01-22 17:26:53 +00:00
),
"success",
)
else:
flash(_("Could not send the password reset email"), "error")
2023-03-22 07:52:00 +00:00
return profile_settings_edit(user, edited_user)
2021-01-22 17:26:53 +00:00
2022-11-01 11:25:21 +00:00
if (
request.form.get("action") == "lock"
2023-06-05 16:10:37 +00:00
and BaseBackend.get().has_account_lockability()
2022-11-01 11:25:21 +00:00
and not edited_user.locked
):
flash(_("The account has been locked"), "success")
2023-05-26 15:44:15 +00:00
edited_user.lock_date = datetime.datetime.now(datetime.timezone.utc)
2022-11-01 11:25:21 +00:00
edited_user.save()
return profile_settings_edit(user, edited_user)
if (
request.form.get("action") == "unlock"
2023-06-05 16:10:37 +00:00
and BaseBackend.get().has_account_lockability()
2022-11-01 11:25:21 +00:00
and edited_user.locked
):
flash(_("The account has been unlocked"), "success")
2023-05-26 15:44:15 +00:00
del edited_user.lock_date
2022-11-01 11:25:21 +00:00
edited_user.save()
return profile_settings_edit(user, edited_user)
2020-11-01 10:33:56 +00:00
abort(400)
2020-10-31 16:41:24 +00:00
2020-11-01 10:33:56 +00:00
2023-03-22 07:52:00 +00:00
def profile_settings_edit(editor, edited_user):
menuitem = "profile" if editor.id == editor.id else "users"
2021-12-02 17:23:14 +00:00
fields = editor.read | editor.write
2022-11-01 11:25:21 +00:00
available_fields = {"password", "groups", "user_name", "lock_date"}
2020-10-20 09:44:45 +00:00
data = {
2023-03-16 17:39:28 +00:00
k: getattr(edited_user, k)[0]
if getattr(edited_user, k) and isinstance(getattr(edited_user, k), list)
else getattr(edited_user, k) or ""
for k in fields
2023-03-16 17:39:28 +00:00
if hasattr(edited_user, k) and k in available_fields
2020-10-20 09:44:45 +00:00
}
2021-06-03 13:00:11 +00:00
if "groups" in fields:
2023-03-16 17:39:28 +00:00
data["groups"] = [g.id for g in edited_user.groups]
form = profile_form(
editor.write & available_fields, editor.read & available_fields, edited_user
)
2020-12-31 17:16:35 +00:00
form.process(CombinedMultiDict((request.files, request.form)) or None, data=data)
2020-10-21 08:26:31 +00:00
2023-03-30 21:14:39 +00:00
if request.form and request.form.get("action") == "edit" or request_is_htmx():
2020-10-20 09:44:45 +00:00
if not form.validate():
2020-10-22 15:37:01 +00:00
flash(_("Profile edition failed."), "error")
2020-10-20 09:44:45 +00:00
else:
for attribute in form:
2023-05-26 15:44:15 +00:00
if attribute.name in available_fields & editor.write:
setattr(edited_user, attribute.name, attribute.data)
2022-11-01 11:25:21 +00:00
if (
"password1" in request.form
and form["password1"].data
and request.form["action"] == "edit"
):
2023-03-16 17:39:28 +00:00
edited_user.set_password(form["password1"].data)
2021-12-02 17:23:14 +00:00
2023-03-16 17:39:28 +00:00
edited_user.save()
2023-05-30 07:44:11 +00:00
flash(_("Profile updated successfully."), "success")
2023-03-22 07:52:00 +00:00
return redirect(
2023-06-28 15:56:49 +00:00
url_for("account.profile_settings", edited_user=edited_user)
2023-03-22 07:52:00 +00:00
)
2020-10-20 09:44:45 +00:00
2020-11-01 10:33:56 +00:00
return render_template(
2023-03-16 17:39:28 +00:00
"profile_settings.html",
form=form,
menuitem=menuitem,
2023-03-16 17:39:28 +00:00
edited_user=edited_user,
self_deletion=edited_user.can_delete_account,
2020-11-01 10:33:56 +00:00
)
2023-03-22 07:52:00 +00:00
def profile_delete(user, edited_user):
self_deletion = user.id == edited_user.id
2020-11-01 10:33:56 +00:00
if self_deletion:
user.logout()
2023-03-22 07:52:00 +00:00
flash(
_(
"The user %(user)s has been sucessfuly deleted",
user=edited_user.formatted_name[0],
),
2023-03-22 07:52:00 +00:00
"success",
)
edited_user.delete()
2020-11-01 10:33:56 +00:00
if self_deletion:
2021-05-24 15:43:15 +00:00
return redirect(url_for("account.index"))
return redirect(url_for("account.users"))
2020-10-22 15:37:01 +00:00
2023-06-28 15:56:49 +00:00
@bp.route("/impersonate/<user:puppet>")
2021-12-02 17:23:14 +00:00
@permissions_needed("impersonate_users")
2023-06-28 15:56:49 +00:00
def impersonate(user, puppet):
puppet.login()
flash(
_("Connection successful. Welcome %(user)s", user=puppet.formatted_name),
"success",
)
2021-12-01 10:47:11 +00:00
return redirect(url_for("account.index"))
2020-10-22 15:37:01 +00:00
@bp.route("/reset", methods=["GET", "POST"])
@smtp_needed()
2020-10-22 15:37:01 +00:00
def forgotten():
if not current_app.config.get("ENABLE_PASSWORD_RECOVERY", True):
abort(404)
2020-10-22 15:37:01 +00:00
form = ForgottenPasswordForm(request.form)
if not request.form:
return render_template("forgotten-password.html", form=form)
if not form.validate():
flash(_("Could not send the password reset link."), "error")
return render_template("forgotten-password.html", form=form)
user = models.User.get_from_login(form.login.data)
success_message = _(
2023-01-15 08:28:52 +00:00
"A password reset link has been sent at your email address. You should receive it within a few minutes."
)
if current_app.config.get("HIDE_INVALID_LOGINS", True) and (
not user or not user.can_edit_self
):
flash(success_message, "success")
return render_template("forgotten-password.html", form=form)
2020-10-22 15:37:01 +00:00
if not user.can_edit_self:
2020-10-22 15:37:01 +00:00
flash(
2020-11-23 16:03:03 +00:00
_(
"The user '%(user)s' does not have permissions to update their password. "
"We cannot send a password reset email.",
user=user.formatted_name[0],
2020-11-23 16:03:03 +00:00
),
"error",
2020-10-22 15:37:01 +00:00
)
return render_template("forgotten-password.html", form=form)
success = all(send_password_reset_mail(user, email) for email in user.emails)
2020-10-22 15:37:01 +00:00
if success:
flash(success_message, "success")
else:
2020-10-22 15:37:01 +00:00
flash(
_("We encountered an issue while we sent the password recovery email."),
"error",
2020-10-22 15:37:01 +00:00
)
return render_template("forgotten-password.html", form=form)
2023-06-28 15:56:49 +00:00
@bp.route("/reset/<user:user>/<hash>", methods=["GET", "POST"])
def reset(user, hash):
if not current_app.config.get("ENABLE_PASSWORD_RECOVERY", True):
abort(404)
2020-10-22 15:37:01 +00:00
form = PasswordResetForm(request.form)
hashes = {
profile_hash(
user.identifier,
email,
user.password[0] if user.has_password() else "",
)
for email in user.emails
}
if not user or hash not in hashes:
2020-10-22 15:37:01 +00:00
flash(
2021-10-29 12:20:06 +00:00
_("The password reset link that brought you here was invalid."),
"error",
2020-10-22 15:37:01 +00:00
)
2021-05-24 15:43:15 +00:00
return redirect(url_for("account.index"))
2020-10-22 15:37:01 +00:00
if request.form and form.validate():
user.set_password(form.password.data)
user.login()
2023-05-30 07:44:11 +00:00
flash(_("Your password has been updated successfully"), "success")
2023-06-28 15:56:49 +00:00
return redirect(url_for("account.profile_edition", edited_user=user))
2020-10-22 15:37:01 +00:00
2023-06-28 15:56:49 +00:00
return render_template("reset-password.html", form=form, user=user, hash=hash)
2023-06-28 15:56:49 +00:00
@bp.route("/profile/<user:user>/<field>")
def photo(user, field):
if field.lower() != "photo":
abort(404)
etag = None
if request.if_modified_since and request.if_modified_since >= user.last_modified:
return "", 304
2023-06-28 15:56:49 +00:00
etag = profile_hash(user.identifier, user.last_modified.isoformat())
if request.if_none_match and etag in request.if_none_match:
return "", 304
2022-12-22 16:12:24 +00:00
photos = getattr(user, field)
if not photos:
abort(404)
stream = io.BytesIO(photos[0])
return send_file(
stream, mimetype="image/jpeg", last_modified=user.last_modified, etag=etag
)