|
36 | 36 | import redis
|
37 | 37 | import rq
|
38 | 38 | import operator
|
| 39 | +import requests |
39 | 40 | import coil.tasks
|
40 | 41 | from nikola.utils import (unicode_str, get_logger, ColorfulStderrHandler,
|
41 | 42 | write_metadata, TranslatableSetting)
|
@@ -119,6 +120,10 @@ def configure_site():
|
119 | 120 |
|
120 | 121 | app.secret_key = _site.config.get('COIL_SECRET_KEY')
|
121 | 122 | app.config['COIL_URL'] = _site.config.get('COIL_URL')
|
| 123 | + app.config['COIL_LOGIN_CAPTCHA'] = _site.config.get( |
| 124 | + 'COIL_LOGIN_CAPTCHA', |
| 125 | + {'enabled': False, 'site_key': '', 'secret_key': ''}) |
| 126 | + app.config['COIL_USERS_PREVENT_EDITING'] = _site.config.get('COIL_USERS_PREVENT_EDITING', []) |
122 | 127 | app.config['COIL_LIMITED'] = _site.config.get('COIL_LIMITED', False)
|
123 | 128 | app.config['REDIS_URL'] = _site.config.get('COIL_REDIS_URL',
|
124 | 129 | 'redis://localhost:6379/0')
|
@@ -543,14 +548,28 @@ def login():
|
543 | 548 | alert = None
|
544 | 549 | alert_status = 'danger'
|
545 | 550 | code = 200
|
| 551 | + captcha = app.config['COIL_LOGIN_CAPTCHA'] |
546 | 552 | form = LoginForm()
|
547 | 553 | if request.method == 'POST':
|
548 | 554 | if form.validate():
|
549 | 555 | user = find_user_by_name(request.form['username'])
|
550 | 556 | if not user:
|
551 | 557 | alert = 'Invalid credentials.'
|
552 | 558 | code = 401
|
553 |
| - else: |
| 559 | + if captcha['enabled']: |
| 560 | + r = requests.post('https://www.google.com/recaptcha/api/siteverify', |
| 561 | + data={'secret': captcha['secret_key'], |
| 562 | + 'response': request.form['g-recaptcha-response'], |
| 563 | + 'remoteip': request.remote_addr}) |
| 564 | + if r.status_code != 200: |
| 565 | + alert = 'Cannot check CAPTCHA response.' |
| 566 | + code = 500 |
| 567 | + else: |
| 568 | + rj = r.json() |
| 569 | + if not rj['success']: |
| 570 | + alert = 'Invalid CAPTCHA response. Please try again.' |
| 571 | + code = 401 |
| 572 | + if code == 200: |
554 | 573 | try:
|
555 | 574 | pwd_ok = check_password(user.password,
|
556 | 575 | request.form['password'])
|
@@ -584,7 +603,8 @@ def login():
|
584 | 603 | alert_status = 'success'
|
585 | 604 | return render('coil_login.tmpl', {'title': 'Login', 'alert': alert, 'form':
|
586 | 605 | form, 'alert_status': alert_status,
|
587 |
| - 'pwdchange_skip': True}, |
| 606 | + 'pwdchange_skip': True, |
| 607 | + 'captcha': captcha}, |
588 | 608 | code)
|
589 | 609 |
|
590 | 610 |
|
@@ -936,6 +956,8 @@ def acp_account():
|
936 | 956 | action = 'edit'
|
937 | 957 | form = AccountForm()
|
938 | 958 | if request.method == 'POST':
|
| 959 | + if int(current_user.uid) in app.config['COIL_USERS_PREVENT_EDITING']: |
| 960 | + return error("Cannot edit data for this user.", 403) |
939 | 961 | if not form.validate():
|
940 | 962 | return error("Bad Request", 400)
|
941 | 963 | action = 'save'
|
|
0 commit comments