mediagoblin/auth/views.py

   1 # GNU MediaGoblin -- federated, autonomous media hosting
   2 # Copyright (C) 2011 Free Software Foundation, Inc
   3 #
   4 # This program is free software: you can redistribute it and/or modify
   5 # it under the terms of the GNU Affero General Public License as published by
   6 # the Free Software Foundation, either version 3 of the License, or
   7 # (at your option) any later version.
   8 #
   9 # This program is distributed in the hope that it will be useful,
  10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12 # GNU Affero General Public License for more details.
  13 #
  14 # You should have received a copy of the GNU Affero General Public License
  15 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
  16
  17 import uuid
  18
  19 from webob import exc
  20
  21 from mediagoblin import messages
  22 from mediagoblin import mg_globals
  23 from mediagoblin.util import render_to_response, redirect
  24 from mediagoblin.db.util import ObjectId
  25 from mediagoblin.auth import lib as auth_lib
  26 from mediagoblin.auth import forms as auth_forms
  27 from mediagoblin.auth.lib import send_verification_email
  28
  29
  30 def register(request):
  31     """
  32     Your classic registration view!
  33     """
  34     # Redirects to indexpage if registrations are disabled
  35     if not mg_globals.app_config["allow_registration"]:
  36         messages.add_message(
  37             request,
  38             messages.WARNING,
  39             ('Sorry, registration is disabled on this instance.'))
  40         return redirect(request, "index")
  41
  42     register_form = auth_forms.RegistrationForm(request.POST)
  43
  44     if request.method == 'POST' and register_form.validate():
  45         # TODO: Make sure the user doesn't exist already
  46
  47         users_with_username = \
  48             request.db.User.find({
  49                 'username': request.POST['username'].lower()
  50             }).count()
  51
  52         if users_with_username:
  53             register_form.username.errors.append(
  54                 u'Sorry, a user with that name already exists.')
  55
  56         else:
  57             # Create the user
  58             entry = request.db.User()
  59             entry['username'] = request.POST['username'].lower()
  60             entry['email'] = request.POST['email']
  61             entry['pw_hash'] = auth_lib.bcrypt_gen_password_hash(
  62                 request.POST['password'])
  63             entry.save(validate=True)
  64
  65             send_verification_email(entry, request)
  66
  67             return redirect(request, "mediagoblin.auth.register_success")
  68
  69     return render_to_response(
  70         request,
  71         'mediagoblin/auth/register.html',
  72         {'register_form': register_form})
  73
  74
  75 def login(request):
  76     """
  77     MediaGoblin login view.
  78
  79     If you provide the POST with 'next', it'll redirect to that view.
  80     """
  81     login_form = auth_forms.LoginForm(request.POST)
  82
  83     login_failed = False
  84
  85     if request.method == 'POST' and login_form.validate():
  86         user = request.db.User.one(
  87             {'username': request.POST['username'].lower()})
  88
  89         if user and user.check_login(request.POST['password']):
  90             # set up login in session
  91             request.session['user_id'] = unicode(user['_id'])
  92             request.session.save()
  93
  94             if request.POST.get('next'):
  95                 return exc.HTTPFound(location=request.POST['next'])
  96             else:
  97                 return redirect(request, "index")
  98
  99         else:
 100             # Prevent detecting who's on this system by testing login
 101             # attempt timings
 102             auth_lib.fake_login_attempt()
 103             login_failed = True
 104
 105     return render_to_response(
 106         request,
 107         'mediagoblin/auth/login.html',
 108         {'login_form': login_form,
 109          'next': request.GET.get('next') or request.POST.get('next'),
 110          'login_failed': login_failed,
 111          'allow_registration': mg_globals.app_config["allow_registration"]})
 112
 113
 114 def logout(request):
 115     # Maybe deleting the user_id parameter would be enough?
 116     request.session.delete()
 117
 118     return redirect(request, "index")
 119
 120
 121 def verify_email(request):
 122     """
 123     Email verification view
 124
 125     validates GET parameters against database and unlocks the user account, if
 126     you are lucky :)
 127     """
 128     # If we don't have userid and token parameters, we can't do anything; 404
 129     if not request.GET.has_key('userid') or not request.GET.has_key('token'):
 130         return exc.HTTPNotFound()
 131
 132     user = request.db.User.find_one(
 133         {'_id': ObjectId(unicode(request.GET['userid']))})
 134
 135     if user and user['verification_key'] == unicode(request.GET['token']):
 136         user['status'] = u'active'
 137         user['email_verified'] = True
 138         user.save()
 139         verification_successful = True
 140         messages.add_message(
 141             request,
 142             messages.SUCCESS,
 143             ('Your email address has been verified. '
 144              'You may now login, edit your profile, and submit images!'))
 145     else:
 146         verification_successful = False
 147         messages.add_message(request,
 148                              messages.ERROR,
 149                             'The verification key or user id is incorrect')
 150
 151     return render_to_response(
 152         request,
 153         'mediagoblin/user_pages/user.html',
 154         {'user': user,
 155         'verification_successful' : verification_successful})
 156
 157
 158 def resend_activation(request):
 159     """
 160     The reactivation view
 161
 162     Resend the activation email.
 163     """
 164     request.user['verification_key'] = unicode(uuid.uuid4())
 165     request.user.save()
 166
 167     send_verification_email(request.user, request)
 168
 169     return redirect(request, 'mediagoblin.auth.resend_verification_success')