4444from flask .ext .login import (LoginManager , login_required , login_user ,
4545 logout_user , current_user , make_secure_token )
4646from flask .ext .bcrypt import Bcrypt
47- from coil .utils import USER_FIELDS , PERMISSIONS , SiteProxy
47+ from coil .utils import USER_FIELDS , PERMISSIONS , PERMISSIONS_E , SiteProxy
4848from coil .forms import (LoginForm , NewPostForm , NewPageForm , DeleteForm ,
4949 UserDeleteForm , UserEditForm , AccountForm ,
50- PermissionsForm )
50+ PermissionsForm , UserImportForm )
5151
5252_site = None
5353site = None
@@ -366,7 +366,7 @@ class User(object):
366366 def __init__ (self , uid , username , realname , password , email , active ,
367367 is_admin , can_edit_all_posts , wants_all_posts ,
368368 can_upload_attachments , can_rebuild_site ,
369- can_transfer_post_authorship ):
369+ can_transfer_post_authorship , must_change_password ):
370370 """Initialize an user with specified settings."""
371371 self .uid = int (uid )
372372 self .username = username
@@ -380,6 +380,7 @@ def __init__(self, uid, username, realname, password, email, active,
380380 self .can_upload_attachments = can_upload_attachments
381381 self .can_rebuild_site = can_rebuild_site
382382 self .can_transfer_post_authorship = can_transfer_post_authorship
383+ self .must_change_password = must_change_password
383384
384385 def get_id (self ):
385386 """Get user ID."""
@@ -419,7 +420,7 @@ def get_user(uid):
419420 d = db .hgetall ('user:{0}' .format (uid ))
420421 if d :
421422 for p in PERMISSIONS :
422- d [p ] = d [ p ] == '1'
423+ d [p ] = d . get ( p ) == '1'
423424 return User (uid = uid , ** d )
424425 else :
425426 return None
@@ -511,6 +512,9 @@ def index():
511512
512513 :param int all: Whether or not should show all posts
513514 """
515+ if current_user .must_change_password :
516+ return redirect (url_for ('acp_account' ) + '?status=pwdchange' )
517+
514518 context = {'postform' : NewPostForm (),
515519 'pageform' : NewPageForm (),
516520 'delform' : DeleteForm ()}
@@ -559,6 +563,9 @@ def edit(path):
559563
560564 :param path: Path to post to edit.
561565 """
566+ if current_user .must_change_password :
567+ return redirect (url_for ('acp_account' ) + '?status=pwdchange' )
568+
562569 context = {'path' : path , 'site' : site }
563570 post = find_post (path )
564571 if post is None :
@@ -628,6 +635,9 @@ def edit(path):
628635@login_required
629636def delete ():
630637 """Delete a post."""
638+ if current_user .must_change_password :
639+ return redirect (url_for ('acp_account' ) + '?status=pwdchange' )
640+
631641 form = DeleteForm ()
632642 path = request .form ['path' ]
633643 post = find_post (path )
@@ -687,6 +697,9 @@ def api_rebuild():
687697@login_required
688698def rebuild (mode = '' ):
689699 """Rebuild the site with a nice UI."""
700+ if current_user .must_change_password :
701+ return redirect (url_for ('acp_account' ) + '?status=pwdchange' )
702+
690703 scan_site () # for good measure
691704 if not current_user .can_rebuild_site :
692705 return error ('You are not permitted to rebuild the site.</p>'
@@ -705,55 +718,16 @@ def rebuild(mode=''):
705718 return render ('coil_rebuild.tmpl' , {'title' : 'Rebuild' })
706719
707720
708- @app .route ('/bower_components/<path:path>' )
709- def serve_bower_components (path ):
710- """Serve bower components.
711-
712- This is meant to be used ONLY by the internal dev server.
713- Please configure your web server to handle requests to this URL::
714-
715- /bower_components/ => coil/data/bower_components
716- """
717- res = pkg_resources .resource_filename (
718- 'coil' , os .path .join ('data' , 'bower_components' ))
719- return send_from_directory (res , path )
720-
721-
722- @app .route ('/coil_assets/<path:path>' )
723- def serve_coil_assets (path ):
724- """Serve Coil assets.
725-
726- This is meant to be used ONLY by the internal dev server.
727- Please configure your web server to handle requests to this URL::
728-
729- /coil_assets/ => coil/data/coil_assets
730- """
731- res = pkg_resources .resource_filename (
732- 'coil' , os .path .join ('data' , 'coil_assets' ))
733- return send_from_directory (res , path )
734-
735-
736- @app .route ('/assets/<path:path>' )
737- def serve_assets (path ):
738- """Serve Nikola assets.
739-
740- This is meant to be used ONLY by the internal dev server.
741- Please configure your web server to handle requests to this URL::
742-
743- /assets/ => output/assets
744- """
745- res = os .path .join (app .config ['NIKOLA_ROOT' ],
746- _site .config ["OUTPUT_FOLDER" ], 'assets' )
747- return send_from_directory (res , path )
748-
749-
750721@app .route ('/new/<obj>/' , methods = ['POST' ])
751722@login_required
752723def new (obj ):
753724 """Create a new post or page.
754725
755726 :param str obj: Object to create (post or page)
756727 """
728+ if current_user .must_change_password :
729+ return redirect (url_for ('acp_account' ) + '?status=pwdchange' )
730+
757731 title = request .form ['title' ]
758732 _site .config ['ADDITIONAL_METADATA' ]['author.uid' ] = current_user .uid
759733 try :
@@ -789,15 +763,61 @@ def new(obj):
789763 return redirect (url_for ('index' ))
790764
791765
766+ @app .route ('/bower_components/<path:path>' )
767+ def serve_bower_components (path ):
768+ """Serve bower components.
769+
770+ This is meant to be used ONLY by the internal dev server.
771+ Please configure your web server to handle requests to this URL::
772+
773+ /bower_components/ => coil/data/bower_components
774+ """
775+ res = pkg_resources .resource_filename (
776+ 'coil' , os .path .join ('data' , 'bower_components' ))
777+ return send_from_directory (res , path )
778+
779+
780+ @app .route ('/coil_assets/<path:path>' )
781+ def serve_coil_assets (path ):
782+ """Serve Coil assets.
783+
784+ This is meant to be used ONLY by the internal dev server.
785+ Please configure your web server to handle requests to this URL::
786+
787+ /coil_assets/ => coil/data/coil_assets
788+ """
789+ res = pkg_resources .resource_filename (
790+ 'coil' , os .path .join ('data' , 'coil_assets' ))
791+ return send_from_directory (res , path )
792+
793+
794+ @app .route ('/assets/<path:path>' )
795+ def serve_assets (path ):
796+ """Serve Nikola assets.
797+
798+ This is meant to be used ONLY by the internal dev server.
799+ Please configure your web server to handle requests to this URL::
800+
801+ /assets/ => output/assets
802+ """
803+ res = os .path .join (app .config ['NIKOLA_ROOT' ],
804+ _site .config ["OUTPUT_FOLDER" ], 'assets' )
805+ return send_from_directory (res , path )
806+
807+
792808@app .route ('/account/' , methods = ['POST' , 'GET' ])
793809@login_required
794810def acp_account ():
795811 """Manage the user account of currently-logged-in users.
796812
797813 This does NOT accept admin-specific options.
798814 """
799- alert = ''
800- alert_status = ''
815+ if request .args .get ('status' ) == 'pwdchange' :
816+ alert = 'You must change your password before proceeding.'
817+ alert_status = 'danger'
818+ else :
819+ alert = ''
820+ alert_status = ''
801821 action = 'edit'
802822 form = AccountForm ()
803823 if request .method == 'POST' :
@@ -809,6 +829,7 @@ def acp_account():
809829 if data ['newpwd1' ] == data ['newpwd2' ] and check_password (
810830 current_user .password , data ['oldpwd' ]):
811831 current_user .password = password_hash (data ['newpwd1' ])
832+ current_user .must_change_password = False
812833 else :
813834 alert = 'Passwords don’t match.'
814835 alert_status = 'danger'
@@ -830,6 +851,11 @@ def acp_account():
830851@login_required
831852def acp_users ():
832853 """List all users."""
854+ if current_user .must_change_password :
855+ return redirect (url_for ('acp_account' ) + '?status=pwdchange' )
856+ elif not current_user .is_admin :
857+ return error ("Not authorized to edit users." , 401 )
858+
833859 alert = ''
834860 alert_status = ''
835861 if request .args .get ('status' ) == 'deleted' :
@@ -838,8 +864,6 @@ def acp_users():
838864 if request .args .get ('status' ) == 'undeleted' :
839865 alert = 'User undeleted.'
840866 alert_status = 'success'
841- if not current_user .is_admin :
842- return error ("Not authorized to edit users." , 401 )
843867 else :
844868 uids = db .hgetall ('users' ).values ()
845869 USERS = sorted ([(i , get_user (i )) for i in uids ])
@@ -849,16 +873,18 @@ def acp_users():
849873 'alert' : alert ,
850874 'alert_status' : alert_status ,
851875 'delform' : UserDeleteForm (),
852- 'editform' : UserEditForm ()})
876+ 'editform' : UserEditForm (),
877+ 'importform' : UserImportForm ()})
853878
854879
855880@app .route ('/users/edit/' , methods = ['POST' ])
856881@login_required
857882def acp_users_edit ():
858883 """Edit an user account."""
859884 global current_user
860-
861- if not current_user .is_admin :
885+ if current_user .must_change_password :
886+ return redirect (url_for ('acp_account' ) + '?status=pwdchange' )
887+ elif not current_user .is_admin :
862888 return error ("Not authorized to edit users." , 401 )
863889 data = request .form
864890
@@ -873,6 +899,7 @@ def acp_users_edit():
873899 uid = max (db .hgetall ('users' ).values ()) + 1
874900 pf = [False for p in PERMISSIONS ]
875901 pf [0 ] = True # active
902+ pf [7 ] = True # must_change_password
876903 user = User (uid , data ['username' ], '' , '' , '' , * pf )
877904 write_user (user )
878905 db .hset ('users' , user .username , user .uid )
@@ -911,6 +938,7 @@ def acp_users_edit():
911938 user .active = True
912939 if user .uid == current_user .uid :
913940 user .is_admin = True
941+ user .must_change_password = False
914942 current_user = user
915943 write_user (user )
916944
@@ -924,12 +952,33 @@ def acp_users_edit():
924952 'form' : form })
925953
926954
955+ @app .route ('/users/import/' , methods = ['POST' ])
956+ @login_required
957+ def acp_users_import ():
958+ """Import users from a TSV file."""
959+ if current_user .must_change_password :
960+ return redirect (url_for ('acp_account' ) + '?status=pwdchange' )
961+ elif not current_user .is_admin :
962+ return error ("Not authorized to edit users." , 401 )
963+
964+ form = UserImportForm ()
965+ if not form .validate ():
966+ return error ("Bad Request" , 400 )
967+ fh = request .files ['tsv' ].stream
968+ tsv = fh .read ()
969+ return tsv
970+ # TODO
971+
972+
927973@app .route ('/users/delete/' , methods = ['POST' ])
928974@login_required
929975def acp_users_delete ():
930976 """Delete or undelete an user account."""
931- if not current_user .is_admin :
977+ if current_user .must_change_password :
978+ return redirect (url_for ('acp_account' ) + '?status=pwdchange' )
979+ elif not current_user .is_admin :
932980 return error ("Not authorized to edit users." , 401 )
981+
933982 form = UserDeleteForm ()
934983 if not form .validate ():
935984 return error ("Bad Request" , 400 )
@@ -950,7 +999,9 @@ def acp_users_delete():
950999@login_required
9511000def acp_users_permissions ():
9521001 """Change user permissions."""
953- if not current_user .is_admin :
1002+ if current_user .must_change_password :
1003+ return redirect (url_for ('acp_account' ) + '?status=pwdchange' )
1004+ elif not current_user .is_admin :
9541005 return error ("Not authorized to edit users." , 401 )
9551006
9561007 form = PermissionsForm ()
@@ -966,9 +1017,11 @@ def acp_users_permissions():
9661017 setattr (user , perm , True )
9671018 else :
9681019 setattr (user , perm , False )
969- if uid == current_user .uid :
970- user .is_admin = True # cannot deadmin oneself
971- user .active = True # cannot deactivate oneself
1020+ if int (uid ) == current_user .uid :
1021+ # Some permissions cannot apply to the current user.
1022+ user .is_admin = True
1023+ user .active = True
1024+ user .must_change_password = False
9721025 write_user (user )
9731026 users .append ((uid , user ))
9741027 action = 'save'
@@ -981,8 +1034,8 @@ def display_permission(user, permission):
9811034 if permission == 'wants_all_posts' and not user .can_edit_all_posts :
9821035 # If this happens, permissions are damaged.
9831036 checked = ''
984- if user .uid == current_user .uid and permission in ['active' ,
985- 'is_admin' ] :
1037+ if ( user .uid == current_user .uid and permission in [
1038+ 'active' , 'is_admin' , 'must_change_password' ]) :
9861039 disabled = 'disabled'
9871040 else :
9881041 disabled = ''
@@ -993,13 +1046,14 @@ def display_permission(user, permission):
9931046 'data-perm="{4}" class="u{0}" {2} {3}>' )
9941047 return d .format (user .uid , permission , checked , disabled , permission_a )
9951048
996- users = [(i , get_user (i )) for i in uids ]
1049+ if not users :
1050+ users = [(i , get_user (i )) for i in uids ]
9971051
9981052 return render ('coil_users_permissions.tmpl' ,
9991053 context = {'title' : 'Permissions' ,
10001054 'USERS' : sorted (users ),
10011055 'UIDS' : sorted (uids ),
1002- 'PERMISSIONS ' : PERMISSIONS ,
1056+ 'PERMISSIONS_E ' : PERMISSIONS_E ,
10031057 'action' : action ,
10041058 'json' : json ,
10051059 'form' : form ,
0 commit comments