Removed Sobol's automatic use of eventlet. Adjusted imports project-wide to conform...
[philo.git] / philo / contrib / waldo / models.py
1 import urlparse
2
3 from django import forms
4 from django.conf.urls.defaults import url, patterns, include
5 from django.contrib import messages
6 from django.contrib.auth import authenticate, login, views as auth_views
7 from django.contrib.auth.forms import PasswordResetForm, SetPasswordForm, PasswordChangeForm
8 from django.contrib.auth.models import User
9 from django.contrib.auth.tokens import default_token_generator as password_token_generator
10 from django.contrib.sites.models import Site
11 from django.core.mail import EmailMultiAlternatives, send_mail
12 from django.db import models
13 from django.http import Http404, HttpResponseRedirect
14 from django.shortcuts import render_to_response, get_object_or_404
15 from django.template.defaultfilters import striptags
16 from django.utils.http import int_to_base36, base36_to_int
17 from django.utils.translation import ugettext as _
18 from django.views.decorators.cache import never_cache
19 from django.views.decorators.csrf import csrf_protect
20
21 from philo.models import MultiView, Page
22 from philo.contrib.waldo.forms import WaldoAuthenticationForm, RegistrationForm, UserAccountForm
23 from philo.contrib.waldo.tokens import registration_token_generator, email_token_generator
24
25
26 class LoginMultiView(MultiView):
27         """
28         Handles exclusively methods and views related to logging users in and out.
29         """
30         login_page = models.ForeignKey(Page, related_name='%(app_label)s_%(class)s_login_related')
31         login_form = WaldoAuthenticationForm
32         
33         @property
34         def urlpatterns(self):
35                 return patterns('',
36                         url(r'^login$', self.login, name='login'),
37                         url(r'^logout$', self.logout, name='logout'),
38                 )
39         
40         def set_requirement_redirect(self, request, redirect=None):
41                 "Figure out where someone should end up after landing on a `requirement` page like the login page."
42                 if redirect is not None:
43                         pass
44                 elif 'requirement_redirect' in request.session:
45                         return
46                 else:
47                         referrer = request.META.get('HTTP_REFERER', None)
48                 
49                         if referrer is not None:
50                                 referrer = urlparse.urlparse(referrer)
51                                 host = referrer[1]
52                                 if host != request.get_host():
53                                         referrer = None
54                                 else:
55                                         redirect = '%s?%s' % (referrer[2], referrer[4])
56                 
57                         path = request.get_full_path()
58                         if referrer is None or redirect == path:
59                                 # Default to the index page if we can't find a referrer or
60                                 # if we'd otherwise redirect to where we already are.
61                                 redirect = request.node.get_absolute_url()
62                 
63                 request.session['requirement_redirect'] = redirect
64         
65         def get_requirement_redirect(self, request, default=None):
66                 redirect = request.session.pop('requirement_redirect', None)
67                 # Security checks a la django.contrib.auth.views.login
68                 if not redirect or ' ' in redirect:
69                         redirect = default
70                 else:
71                         netloc = urlparse.urlparse(redirect)[1]
72                         if netloc and netloc != request.get_host():
73                                 redirect = default
74                 if redirect is None:
75                         redirect = request.node.get_absolute_url()
76                 return redirect
77         
78         @never_cache
79         def login(self, request, extra_context=None):
80                 """
81                 Displays the login form for the given HttpRequest.
82                 """
83                 self.set_requirement_redirect(request)
84                 
85                 # Redirect already-authenticated users to the index page.
86                 if request.user.is_authenticated():
87                         messages.add_message(request, messages.INFO, "You are already authenticated. Please log out if you wish to log in as a different user.")
88                         return HttpResponseRedirect(self.get_requirement_redirect(request))
89                 
90                 if request.method == 'POST':
91                         form = self.login_form(request=request, data=request.POST)
92                         if form.is_valid():
93                                 redirect = self.get_requirement_redirect(request)
94                                 login(request, form.get_user())
95                                 
96                                 if request.session.test_cookie_worked():
97                                         request.session.delete_test_cookie()
98                                 
99                                 return HttpResponseRedirect(redirect)
100                 else:
101                         form = self.login_form()
102                 
103                 request.session.set_test_cookie()
104                 
105                 context = self.get_context()
106                 context.update(extra_context or {})
107                 context.update({
108                         'form': form
109                 })
110                 return self.login_page.render_to_response(request, extra_context=context)
111         
112         @never_cache
113         def logout(self, request, extra_context=None):
114                 return auth_views.logout(request, request.META.get('HTTP_REFERER', request.node.get_absolute_url()))
115         
116         def login_required(self, view):
117                 def inner(request, *args, **kwargs):
118                         if not request.user.is_authenticated():
119                                 self.set_requirement_redirect(request, redirect=request.path)
120                                 if request.POST:
121                                         messages.add_message(request, messages.ERROR, "Please log in again, because your session has expired.")
122                                 return HttpResponseRedirect(self.reverse('login', node=request.node))
123                         return view(request, *args, **kwargs)
124                 
125                 return inner
126         
127         class Meta:
128                 abstract = True
129
130
131 class PasswordMultiView(LoginMultiView):
132         "Adds on views for password-related functions."
133         password_reset_page = models.ForeignKey(Page, related_name='%(app_label)s_%(class)s_password_reset_related', blank=True, null=True)
134         password_reset_confirmation_email = models.ForeignKey(Page, related_name='%(app_label)s_%(class)s_password_reset_confirmation_email_related', blank=True, null=True)
135         password_set_page = models.ForeignKey(Page, related_name='%(app_label)s_%(class)s_password_set_related', blank=True, null=True)
136         password_change_page = models.ForeignKey(Page, related_name='%(app_label)s_%(class)s_password_change_related', blank=True, null=True)
137         
138         password_change_form = PasswordChangeForm
139         password_set_form = SetPasswordForm
140         password_reset_form = PasswordResetForm
141         
142         @property
143         def urlpatterns(self):
144                 urlpatterns = super(PasswordMultiView, self).urlpatterns
145                 
146                 if self.password_reset_page and self.password_reset_confirmation_email and self.password_set_page:
147                         urlpatterns += patterns('',
148                                 url(r'^password/reset$', csrf_protect(self.password_reset), name='password_reset'),
149                                 url(r'^password/reset/(?P<uidb36>\w+)/(?P<token>[^/]+)$', self.password_reset_confirm, name='password_reset_confirm'),
150                         )
151                 
152                 if self.password_change_page:
153                         urlpatterns += patterns('',
154                                 url(r'^password/change$', csrf_protect(self.login_required(self.password_change)), name='password_change'),
155                         )
156                 return urlpatterns
157         
158         def make_confirmation_link(self, confirmation_view, token_generator, user, node, token_args=None, reverse_kwargs=None, secure=False):
159                 token = token_generator.make_token(user, *(token_args or []))
160                 kwargs = {
161                         'uidb36': int_to_base36(user.id),
162                         'token': token
163                 }
164                 kwargs.update(reverse_kwargs or {})
165                 return node.construct_url(subpath=self.reverse(confirmation_view, kwargs=kwargs), with_domain=True, secure=secure)
166         
167         def send_confirmation_email(self, subject, email, page, extra_context):
168                 text_content = page.render_to_string(extra_context=extra_context)
169                 from_email = 'noreply@%s' % Site.objects.get_current().domain
170                 
171                 if page.template.mimetype == 'text/html':
172                         msg = EmailMultiAlternatives(subject, striptags(text_content), from_email, [email])
173                         msg.attach_alternative(text_content, 'text/html')
174                         msg.send()
175                 else:
176                         send_mail(subject, text_content, from_email, [email])
177         
178         def password_reset(self, request, extra_context=None, token_generator=password_token_generator):
179                 if request.user.is_authenticated():
180                         return HttpResponseRedirect(request.node.get_absolute_url())
181                 
182                 if request.method == 'POST':
183                         form = self.password_reset_form(request.POST)
184                         if form.is_valid():
185                                 current_site = Site.objects.get_current()
186                                 for user in form.users_cache:
187                                         context = {
188                                                 'link': self.make_confirmation_link('password_reset_confirm', token_generator, user, request.node, secure=request.is_secure()),
189                                                 'user': user,
190                                                 'site': current_site,
191                                                 'request': request,
192                                                 
193                                                 # Deprecated... leave in for backwards-compatibility
194                                                 'username': user.username
195                                         }
196                                         self.send_confirmation_email('Confirm password reset for account at %s' % current_site.domain, user.email, self.password_reset_confirmation_email, context)
197                                         messages.add_message(request, messages.SUCCESS, "An email has been sent to the address you provided with details on resetting your password.", fail_silently=True)
198                                 return HttpResponseRedirect('')
199                 else:
200                         form = self.password_reset_form()
201                 
202                 context = self.get_context()
203                 context.update(extra_context or {})
204                 context.update({
205                         'form': form
206                 })
207                 return self.password_reset_page.render_to_response(request, extra_context=context)
208         
209         def password_reset_confirm(self, request, extra_context=None, uidb36=None, token=None, token_generator=password_token_generator):
210                 """
211                 Checks that a given hash in a password reset link is valid. If so,
212                 displays the password set form.
213                 """
214                 assert uidb36 is not None and token is not None
215                 try:
216                         uid_int = base36_to_int(uidb36)
217                 except:
218                         raise Http404
219                 
220                 user = get_object_or_404(User, id=uid_int)
221                 
222                 if token_generator.check_token(user, token):
223                         if request.method == 'POST':
224                                 form = self.password_set_form(user, request.POST)
225                                 
226                                 if form.is_valid():
227                                         form.save()
228                                         messages.add_message(request, messages.SUCCESS, "Password reset successful.")
229                                         return HttpResponseRedirect(self.reverse('login', node=request.node))
230                         else:
231                                 form = self.password_set_form(user)
232                         
233                         context = self.get_context()
234                         context.update(extra_context or {})
235                         context.update({
236                                 'form': form
237                         })
238                         return self.password_set_page.render_to_response(request, extra_context=context)
239                 
240                 raise Http404
241         
242         def password_change(self, request, extra_context=None):
243                 if request.method == 'POST':
244                         form = self.password_change_form(request.user, request.POST)
245                         if form.is_valid():
246                                 form.save()
247                                 messages.add_message(request, messages.SUCCESS, 'Password changed successfully.', fail_silently=True)
248                                 return HttpResponseRedirect('')
249                 else:
250                         form = self.password_change_form(request.user)
251                 
252                 context = self.get_context()
253                 context.update(extra_context or {})
254                 context.update({
255                         'form': form
256                 })
257                 return self.password_change_page.render_to_response(request, extra_context=context)
258         
259         class Meta:
260                 abstract = True
261
262
263 class RegistrationMultiView(PasswordMultiView):
264         """Adds on the pages necessary for letting new users register."""
265         register_page = models.ForeignKey(Page, related_name='%(app_label)s_%(class)s_register_related', blank=True, null=True)
266         register_confirmation_email = models.ForeignKey(Page, related_name='%(app_label)s_%(class)s_register_confirmation_email_related', blank=True, null=True)
267         registration_form = RegistrationForm
268         
269         @property
270         def urlpatterns(self):
271                 urlpatterns = super(RegistrationMultiView, self).urlpatterns
272                 if self.register_page and self.register_confirmation_email:
273                         urlpatterns += patterns('',
274                                 url(r'^register$', csrf_protect(self.register), name='register'),
275                                 url(r'^register/(?P<uidb36>\w+)/(?P<token>[^/]+)$', self.register_confirm, name='register_confirm')
276                         )
277                 return urlpatterns
278         
279         def register(self, request, extra_context=None, token_generator=registration_token_generator):
280                 if request.user.is_authenticated():
281                         return HttpResponseRedirect(request.node.get_absolute_url())
282                 
283                 if request.method == 'POST':
284                         form = self.registration_form(request.POST)
285                         if form.is_valid():
286                                 user = form.save()
287                                 current_site = Site.objects.get_current()
288                                 context = {
289                                         'link': self.make_confirmation_link('register_confirm', token_generator, user, request.node, secure=request.is_secure()),
290                                         'user': user,
291                                         'site': current_site,
292                                         'request': request
293                                 }
294                                 self.send_confirmation_email('Confirm account creation at %s' % current_site.name, user.email, self.register_confirmation_email, context)
295                                 messages.add_message(request, messages.SUCCESS, 'An email has been sent to %s with details on activating your account.' % user.email, fail_silently=True)
296                                 return HttpResponseRedirect(request.node.get_absolute_url())
297                 else:
298                         form = self.registration_form()
299                 
300                 context = self.get_context()
301                 context.update(extra_context or {})
302                 context.update({
303                         'form': form
304                 })
305                 return self.register_page.render_to_response(request, extra_context=context)
306         
307         def register_confirm(self, request, extra_context=None, uidb36=None, token=None, token_generator=registration_token_generator):
308                 """
309                 Checks that a given hash in a registration link is valid and activates
310                 the given account. If so, log them in and redirect to
311                 self.post_register_confirm_redirect.
312                 """
313                 assert uidb36 is not None and token is not None
314                 try:
315                         uid_int = base36_to_int(uidb36)
316                 except:
317                         raise Http404
318                 
319                 user = get_object_or_404(User, id=uid_int)
320                 if token_generator.check_token(user, token):
321                         user.is_active = True
322                         true_password = user.password
323                         temp_password = token_generator.make_token(user)
324                         try:
325                                 user.set_password(temp_password)
326                                 user.save()
327                                 authenticated_user = authenticate(username=user.username, password=temp_password)
328                                 login(request, authenticated_user)
329                         finally:
330                                 # if anything goes wrong, do our best make sure that the true password is restored.
331                                 user.password = true_password
332                                 user.save()
333                         return self.post_register_confirm_redirect(request)
334                 
335                 raise Http404
336         
337         def post_register_confirm_redirect(self, request):
338                 return HttpResponseRedirect(request.node.get_absolute_url())
339         
340         class Meta:
341                 abstract = True
342
343
344 class AccountMultiView(RegistrationMultiView):
345         """
346         By default, the `account` consists of the first_name, last_name, and email fields
347         of the User model. Using a different account model is as simple as writing a form that
348         accepts a User instance as the first argument.
349         """
350         manage_account_page = models.ForeignKey(Page, related_name='%(app_label)s_%(class)s_manage_account_related', blank=True, null=True)
351         email_change_confirmation_email = models.ForeignKey(Page, related_name='%(app_label)s_%(class)s_email_change_confirmation_email_related', blank=True, null=True, help_text="If this is left blank, email changes will be performed without confirmation.")
352         
353         account_form = UserAccountForm
354         
355         @property
356         def urlpatterns(self):
357                 urlpatterns = super(AccountMultiView, self).urlpatterns
358                 if self.manage_account_page:
359                         urlpatterns += patterns('',
360                                 url(r'^account$', self.login_required(self.account_view), name='account'),
361                         )
362                 if self.email_change_confirmation_email:
363                         urlpatterns += patterns('',
364                                 url(r'^account/email/(?P<uidb36>\w+)/(?P<email>[\w.]+[+][\w.]+)/(?P<token>[^/]+)$', self.email_change_confirm, name='email_change_confirm')
365                         )
366                 return urlpatterns
367         
368         def account_view(self, request, extra_context=None, token_generator=email_token_generator, *args, **kwargs):
369                 if request.method == 'POST':
370                         form = self.account_form(request.user, request.POST, request.FILES)
371                         
372                         if form.is_valid():
373                                 message = "Account information saved."
374                                 redirect = self.get_requirement_redirect(request, default='')
375                                 if 'email' in form.changed_data and self.email_change_confirmation_email:
376                                         # ModelForms modify their instances in-place during
377                                         # validation, so reset the instance's email to its
378                                         # previous value here, then remove the new value
379                                         # from cleaned_data. We only do this if an email
380                                         # change confirmation email is available.
381                                         request.user.email = form.initial['email']
382                                         
383                                         email = form.cleaned_data.pop('email')
384                                         
385                                         current_site = Site.objects.get_current()
386                                         
387                                         context = {
388                                                 'link': self.make_confirmation_link('email_change_confirm', token_generator, request.user, request.node, token_args=[email], reverse_kwargs={'email': email.replace('@', '+')}, secure=request.is_secure()),
389                                                 'user': request.user,
390                                                 'site': current_site,
391                                                 'request': request
392                                         }
393                                         self.send_confirmation_email('Confirm account email change at %s' % current_site.domain, email, self.email_change_confirmation_email, context)
394                                         
395                                         message = "An email has be sent to %s to confirm the email%s." % (email, bool(request.user.email) and " change" or "")
396                                         if not request.user.email:
397                                                 message += " You will need to confirm the email before accessing pages that require a valid account."
398                                                 redirect = ''
399                                 
400                                 form.save()
401                                 
402                                 if redirect != '':
403                                         message += " Here you go!"
404                                 
405                                 messages.add_message(request, messages.SUCCESS, message, fail_silently=True)
406                                 return HttpResponseRedirect(redirect)
407                 else:
408                         form = self.account_form(request.user)
409                 
410                 context = self.get_context()
411                 context.update(extra_context or {})
412                 context.update({
413                         'form': form
414                 })
415                 return self.manage_account_page.render_to_response(request, extra_context=context)
416         
417         def has_valid_account(self, user):
418                 form = self.account_form(user, {})
419                 form.data = form.initial
420                 return form.is_valid()
421         
422         def account_required(self, view):
423                 def inner(request, *args, **kwargs):
424                         if not self.has_valid_account(request.user):
425                                 messages.add_message(request, messages.ERROR, "You need to add some account information before you can access that page.", fail_silently=True)
426                                 if self.manage_account_page:
427                                         self.set_requirement_redirect(request, redirect=request.path)
428                                         redirect = self.reverse('account', node=request.node)
429                                 else:
430                                         redirect = node.get_absolute_url()
431                                 return HttpResponseRedirect(redirect)
432                         return view(request, *args, **kwargs)
433                 
434                 inner = self.login_required(inner)
435                 return inner
436         
437         def post_register_confirm_redirect(self, request):
438                 if self.manage_account_page:
439                         messages.add_message(request, messages.INFO, 'Welcome! Please fill in some more information.', fail_silently=True)
440                         return HttpResponseRedirect(self.reverse('account', node=request.node))
441                 return super(AccountMultiView, self).post_register_confirm_redirect(request)
442         
443         def email_change_confirm(self, request, extra_context=None, uidb36=None, token=None, email=None, token_generator=email_token_generator):
444                 """
445                 Checks that a given hash in an email change link is valid. If so, changes the email and redirects to the account page.
446                 """
447                 assert uidb36 is not None and token is not None and email is not None
448                 
449                 try:
450                         uid_int = base36_to_int(uidb36)
451                 except:
452                         raise Http404
453                 
454                 user = get_object_or_404(User, id=uid_int)
455                 
456                 email = '@'.join(email.rsplit('+', 1))
457                 
458                 if email == user.email:
459                         # Then short-circuit.
460                         raise Http404
461                 
462                 if token_generator.check_token(user, email, token):
463                         user.email = email
464                         user.save()
465                         messages.add_message(request, messages.SUCCESS, 'Email changed successfully.')
466                         if self.manage_account_page:
467                                 redirect = self.reverse('account', node=request.node)
468                         else:
469                                 redirect = request.node.get_absolute_url()
470                         return HttpResponseRedirect(redirect)
471                 
472                 raise Http404
473         
474         class Meta:
475                 abstract = True