kallithea Changeset - 5875955def39

Changeset - 5875955def39

Parent rev.

Child rev.

[Not reviewed]

beta

0 9 1

Marcin Kuzminski - 14 years ago 2011-07-04 10:59:01
marcin@python-works.com

fixes #223 improve password reset form

10 files changed with 93 insertions and 10 deletions:

rhodecode/config/routing.py

rhodecode/controllers/login.py

rhodecode/lib/celerylib/tasks.py

rhodecode/lib/smtp_mailer.py

rhodecode/model/db.py

rhodecode/model/user.py

rhodecode/public/css/style.css

rhodecode/templates/base/base.html

rhodecode/templates/password_reset.html

rhodecode/templates/password_reset_confirmation.html

new file

0 comments (0 inline, 0 general)

rhodecode/config/routing.py

➞

Show inline comments

@@ @@ -273,48 +273,52 @@ def make_map(config): @@
     rmap.connect('public_journal_atom',
                  '%s/public_journal_atom' % ADMIN_PREFIX, controller='journal',
                  action="public_journal_atom")
     rmap.connect('toggle_following', '%s/toggle_following' % ADMIN_PREFIX,
                  controller='journal', action='toggle_following',
                  conditions=dict(method=["POST"]))
     #SEARCH
     rmap.connect('search', '%s/search' % ADMIN_PREFIX, controller='search',)
     rmap.connect('search_repo', '%s/search/{search_repo:.*}' % ADMIN_PREFIX,
                   controller='search')
     #LOGIN/LOGOUT/REGISTER/SIGN IN
     rmap.connect('login_home', '%s/login' % ADMIN_PREFIX, controller='login')
     rmap.connect('logout_home', '%s/logout' % ADMIN_PREFIX, controller='login',
                  action='logout')
     rmap.connect('register', '%s/register' % ADMIN_PREFIX, controller='login',
                  action='register')
     rmap.connect('reset_password', '%s/password_reset' % ADMIN_PREFIX,
                  controller='login', action='password_reset')
     rmap.connect('reset_password_confirmation',
                  '%s/password_reset_confirmation' % ADMIN_PREFIX,
                  controller='login', action='password_reset_confirmation')
     #FEEDS
     rmap.connect('rss_feed_home', '/{repo_name:.*}/feed/rss',
                 controller='feed', action='rss',
                 conditions=dict(function=check_repo))
     rmap.connect('atom_feed_home', '/{repo_name:.*}/feed/atom',
                 controller='feed', action='atom',
                 conditions=dict(function=check_repo))
     #==========================================================================
     # REPOSITORY ROUTES
     #==========================================================================
     rmap.connect('changeset_home', '/{repo_name:.*}/changeset/{revision}',
                 controller='changeset', revision='tip',
                 conditions=dict(function=check_repo))
     rmap.connect('raw_changeset_home',
                  '/{repo_name:.*}/raw-changeset/{revision}',
                  controller='changeset', action='raw_changeset',
                  revision='tip', conditions=dict(function=check_repo))
     rmap.connect('summary_home', '/{repo_name:.*}',
                 controller='summary', conditions=dict(function=check_repo))

rhodecode/controllers/login.py

➞

Show inline comments

@@ @@ -108,44 +108,61 @@ class LoginController(BaseController): @@
                 form_result = register_form.to_python(dict(request.POST))
                 form_result['active'] = c.auto_active
                 user_model.create_registration(form_result)
                 h.flash(_('You have successfully registered into rhodecode'),
                             category='success')
                 return redirect(url('login_home'))
             except formencode.Invalid, errors:
                 return htmlfill.render(
                     render('/register.html'),
                     defaults=errors.value,
                     errors=errors.error_dict or {},
                     prefix_error=False,
                     encoding="UTF-8")
         return render('/register.html')
     def password_reset(self):
         user_model = UserModel()
         if request.POST:
             password_reset_form = PasswordResetForm()()
             try:
                 form_result = password_reset_form.to_python(dict(request.POST))
                 user_model.reset_password(form_result)
                 h.flash(_('Your new password was sent'),
                 user_model.reset_password_link(form_result)
                 h.flash(_('Your password reset link was sent'),
                             category='success')
                 return redirect(url('login_home'))
             except formencode.Invalid, errors:
                 return htmlfill.render(
                     render('/password_reset.html'),
                     defaults=errors.value,
                     errors=errors.error_dict or {},
                     prefix_error=False,
                     encoding="UTF-8")
         return render('/password_reset.html')
     def password_reset_confirmation(self):
         if request.GET and request.GET.get('key'):
             try:
                 user_model = UserModel()
                 user = User.get_by_api_key(request.GET.get('key'))
                 data = dict(email=user.email)
                 user_model.reset_password(data)
                 h.flash(_('Your password reset was successful, '
                           'new password has been sent to your email'),
                             category='success')
             except Exception, e:
                 log.error(e)
                 return redirect(url('reset_password'))
         return redirect(url('login_home'))
     def logout(self):
         del session['rhodecode_user']
         session.save()
         log.info('Logging out and setting user as Empty')
         redirect(url('home'))

rhodecode/lib/celerylib/tasks.py

➞

Show inline comments

@@ @@ -13,49 +13,49 @@ @@
 """
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
 # the Free Software Foundation, either version 3 of the License, or
 # (at your option) any later version.
+#
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
+#
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 from celery.decorators import task
 import os
 import traceback
 import logging
 from os.path import dirname as dn, join as jn
 from time import mktime
 from operator import itemgetter
 from string import lower
 from pylons import config
+from pylons import config, url
 from pylons.i18n.translation import _
 from rhodecode.lib import LANGUAGES_EXTENSIONS_MAP, safe_str
 from rhodecode.lib.celerylib import run_task, locked_task, str2bool, \
     __get_lockkey, LockHeld, DaemonLock
 from rhodecode.lib.helpers import person
 from rhodecode.lib.smtp_mailer import SmtpMailer
 from rhodecode.lib.utils import add_cache
 from rhodecode.lib.odict import OrderedDict
 from rhodecode.model import init_model
 from rhodecode.model import meta
 from rhodecode.model.db import RhodeCodeUi, Statistics, Repository
 from vcs.backends import get_repo
 from sqlalchemy import engine_from_config
 add_cache(config)
 try:
     import json
 except ImportError:
     #python 2.5 compatibility
     import simplejson as json
@@ @@ -228,81 +228,120 @@ def get_commits_stats(repo_name, ts_min_ @@
             stats.languages = json.dumps(__get_codes_stats(repo_name))
         try:
             stats.repository = dbrepo
             stats.stat_on_revision = last_cs.revision if last_cs else 0
             sa.add(stats)
             sa.commit()
         except:
             log.error(traceback.format_exc())
             sa.rollback()
             lock.release()
             return False
         #final release
         lock.release()
         #execute another task if celery is enabled
         if len(repo.revisions) > 1 and CELERY_ON:
             run_task(get_commits_stats, repo_name, ts_min_y, ts_max_y)
         return True
     except LockHeld:
         log.info('LockHeld')
         return 'Task with key %s already running' % lockkey
 @task(ignore_result=True)
 def send_password_link(user_email):
     try:
         log = reset_user_password.get_logger()
     except:
         log = logging.getLogger(__name__)
     from rhodecode.lib import auth
     from rhodecode.model.db import User
     try:
         sa = get_session()
         user = sa.query(User).filter(User.email == user_email).scalar()
         if user:
             link = url('reset_password_confirmation', key=user.api_key,
                        qualified=True)
             tmpl = """
 Hello %s
 We received a request to create a new password for your account.
 You can generate it by clicking following URL:
 %s
 If you didn't request new password please ignore this email.
             """
             run_task(send_email, user_email,
                      "RhodeCode password reset link",
                      tmpl % (user.short_contact, link))
             log.info('send new password mail to %s', user_email)
     except:
         log.error('Failed to update user password')
         log.error(traceback.format_exc())
         return False
     return True
 @task(ignore_result=True)
 def reset_user_password(user_email):
     try:
         log = reset_user_password.get_logger()
     except:
         log = logging.getLogger(__name__)
     from rhodecode.lib import auth
     from rhodecode.model.db import User
     try:
         try:
             sa = get_session()
             user = sa.query(User).filter(User.email == user_email).scalar()
             new_passwd = auth.PasswordGenerator().gen_password(8,
                              auth.PasswordGenerator.ALPHABETS_BIG_SMALL)
             if user:
                 user.password = auth.get_crypt_password(new_passwd)
                 user.api_key = auth.generate_api_key(user.username)
                 sa.add(user)
                 sa.commit()
                 log.info('change password for %s', user_email)
             if new_passwd is None:
                 raise Exception('unable to generate new password')
         except:
             log.error(traceback.format_exc())
             sa.rollback()
         run_task(send_email, user_email,
                  "Your new rhodecode password",
                  'Your new rhodecode password:%s' % (new_passwd))
                  "Your new RhodeCode password",
                  'Your new RhodeCode password:%s' % (new_passwd))
         log.info('send new password mail to %s', user_email)
     except:
         log.error('Failed to update user password')
         log.error(traceback.format_exc())
     return True
 @task(ignore_result=True)
 def send_email(recipients, subject, body):
     """
     Sends an email with defined parameters from the .ini files.
     :param recipients: list of recipients, it this is empty the defined email
         address from field 'email_to' is used instead
     :param subject: subject of the mail
     :param body: body of the mail
     """
     try:
         log = send_email.get_logger()
     except:
         log = logging.getLogger(__name__)

rhodecode/lib/smtp_mailer.py

➞

Show inline comments

@@ @@ -53,55 +53,61 @@ class SmtpMailer(object): @@
         if isinstance(recipients, basestring):
             recipients = [recipients]
         if self.ssl:
             smtp_serv = smtplib.SMTP_SSL(self.mail_server, self.mail_port)
         else:
             smtp_serv = smtplib.SMTP(self.mail_server, self.mail_port)
         if self.tls:
             smtp_serv.ehlo()
             smtp_serv.starttls()
         if self.debug:
             smtp_serv.set_debuglevel(1)
         smtp_serv.ehlo()
         #if server requires authorization you must provide login and password
         #but only if we have them
         if self.user and self.passwd:
             smtp_serv.login(self.user, self.passwd)
         date_ = formatdate(localtime=True)
         msg = MIMEMultipart()
         msg.set_type('multipart/alternative')
         msg.preamble = 'You will not see this in a MIME-aware mail reader.\n'
         text_msg = MIMEText(body)
         text_msg.set_type('text/plain')
         text_msg.set_param('charset', 'UTF-8')
         msg['From'] = self.mail_from
         msg['To'] = ','.join(recipients)
         msg['Date'] = date_
         msg['Subject'] = subject
         msg.preamble = 'You will not see this in a MIME-aware mail reader.\n'
-        msg.attach(MIMEText(body))
+        msg.attach(text_msg)
         if attachment_files:
             self.__atach_files(msg, attachment_files)
         smtp_serv.sendmail(self.mail_from, recipients, msg.as_string())
         logging.info('MAIL SEND TO: %s' % recipients)
         try:
             smtp_serv.quit()
         except sslerror:
             # sslerror is raised in tls connections on closing sometimes
             pass
     def __atach_files(self, msg, attachment_files):
         if isinstance(attachment_files, dict):
             for f_name, msg_file in attachment_files.items():
                 ctype, encoding = mimetypes.guess_type(f_name)
                 logging.info("guessing file %s type based on %s", ctype,
                              f_name)
                 if ctype is None or encoding is not None:
                     # No guess could be made, or the file is encoded
                     # (compressed), so use a generic bag-of-bits type.
                     ctype = 'application/octet-stream'
                 maintype, subtype = ctype.split('/', 1)

rhodecode/model/db.py

➞

Show inline comments

@@ @@ -222,48 +222,53 @@ class User(Base, BaseModel): @@
         return '%s %s <%s>' % (self.name, self.lastname, self.email)
     @property
     def short_contact(self):
         return '%s %s' % (self.name, self.lastname)
     @property
     def is_admin(self):
         return self.admin
     def __repr__(self):
         try:
             return "<%s('id:%s:%s')>" % (self.__class__.__name__,
                                              self.user_id, self.username)
         except:
             return self.__class__.__name__
     @classmethod
     def by_username(cls, username, case_insensitive=False):
         if case_insensitive:
             return Session.query(cls).filter(cls.username.like(username)).one()
         else:
             return Session.query(cls).filter(cls.username == username).one()
     @classmethod
     def get_by_api_key(cls, api_key):
         return Session.query(cls).filter(cls.api_key == api_key).one()
     def update_lastlogin(self):
         """Update user lastlogin"""
         self.last_login = datetime.datetime.now()
         Session.add(self)
         Session.commit()
         log.debug('updated user %s lastlogin', self.username)
 class UserLog(Base, BaseModel):
     __tablename__ = 'user_logs'
     __table_args__ = {'extend_existing':True}
     user_log_id = Column("user_log_id", Integer(), nullable=False, unique=True, default=None, primary_key=True)
     user_id = Column("user_id", Integer(), ForeignKey('users.user_id'), nullable=False, unique=None, default=None)
     repository_id = Column("repository_id", Integer(), ForeignKey('repositories.repo_id'), nullable=False, unique=None, default=None)
     repository_name = Column("repository_name", String(length=255, convert_unicode=False, assert_unicode=None), nullable=True, unique=None, default=None)
     user_ip = Column("user_ip", String(length=255, convert_unicode=False, assert_unicode=None), nullable=True, unique=None, default=None)
     action = Column("action", UnicodeText(length=1200000, convert_unicode=False, assert_unicode=None), nullable=True, unique=None, default=None)
     action_date = Column("action_date", DateTime(timezone=False), nullable=True, unique=None, default=None)
     @property
     def action_as_day(self):
         return date(*self.action_date.timetuple()[:3])

rhodecode/model/user.py

➞

Show inline comments

@@ @@ -192,48 +192,52 @@ class UserModel(BaseModel): @@
             log.error(traceback.format_exc())
             self.sa.rollback()
             raise
     def delete(self, user_id):
         try:
             user = self.get(user_id, cache=False)
             if user.username == 'default':
                 raise DefaultUserException(
                                 _("You can't remove this user since it's"
                                   " crucial for entire application"))
             if user.repositories:
                 raise UserOwnsReposException(_('This user still owns %s '
                                                'repositories and cannot be '
                                                'removed. Switch owners or '
                                                'remove those repositories') \
                                                % user.repositories)
             self.sa.delete(user)
             self.sa.commit()
         except:
             log.error(traceback.format_exc())
             self.sa.rollback()
             raise
     def reset_password_link(self, data):
         from rhodecode.lib.celerylib import tasks, run_task
         run_task(tasks.send_password_link, data['email'])
     def reset_password(self, data):
         from rhodecode.lib.celerylib import tasks, run_task
         run_task(tasks.reset_user_password, data['email'])
     def fill_data(self, auth_user, user_id=None, api_key=None):
         """
         Fetches auth_user by user_id,or api_key if present.
         Fills auth_user attributes with those taken from database.
         Additionally set's is_authenitated if lookup fails
         present in database
         :param auth_user: instance of user to set attributes
         :param user_id: user id to fetch by
         :param api_key: api key to fetch by
         """
         if user_id is None and api_key is None:
             raise Exception('You need to pass user_id or api_key')
         try:
             if api_key:
                 dbuser = self.get_by_api_key(api_key)
             else:
                 dbuser = self.get(user_id)

rhodecode/public/css/style.css

➞

Show inline comments

@@ @@ -177,49 +177,50 @@ border-top-right-radius: 8px; @@
 border-bottom-left-radius: 8px;
+}
 .bottom-right-rounded-corner {
 -webkit-border-bottom-right-radius: 8px;
 -khtml-border-radius-bottomright: 8px;
 -moz-border-radius-bottomright: 8px;
 border-bottom-right-radius: 8px;
+}
 #header {
 margin:0;
 padding:0 10px;
+}
 #header ul#logged-user{
 margin-bottom:5px !important;
 -webkit-border-radius: 0px 0px 8px 8px;
 -khtml-border-radius: 0px 0px 8px 8px;
 -moz-border-radius: 0px 0px 8px 8px;
 border-radius: 0px 0px 8px 8px;
 height:37px;
 background:url("../images/header_inner.png") repeat-x scroll 0 0 #003367
 background:url("../images/header_inner.png") repeat-x scroll 0 0 #003367;
 box-shadow: 0 2px 2px rgba(0, 0, 0, 0.6);
+}
 #header ul#logged-user li {
 list-style:none;
 float:left;
 margin:8px 0 0;
 padding:4px 12px;
 border-left: 1px solid #316293;
+}
 #header ul#logged-user li.first {
 border-left:none;
 margin:4px;
+}
 #header ul#logged-user li.first div.gravatar {
 margin-top:-2px;
+}
 #header ul#logged-user li.first div.account {
 padding-top:4px;
 float:left;
+}
@@ @@ -1362,48 +1363,55 @@ padding:7px 7px 6px; @@
 clear:both;
 overflow:hidden;
 border-top:1px solid #DDD;
 text-align:right;
 margin:0;
 padding:10px 0 0;
+}
 #login div.form div.links {
 clear:both;
 overflow:hidden;
 margin:10px 0 0;
 padding:0 0 2px;
+}
 #quick_login{
 top: 31px;
 background-color: rgb(0, 51, 103);
 z-index: 999;
 height: 150px;
 position: absolute;
 margin-left: -16px;
 width: 281px;
 border-radius: 0 0 8px 8px;
 box-shadow: 0 2px 2px rgba(0, 0, 0, 0.6);
+}
 #quick_login .password_forgoten{
 padding-right:10px;
 padding-top:10px;
 float:left;
+}
 #quick_login div.form div.fields{
 padding-top: 2px;
 padding-left:10px;
+}
 #quick_login div.form div.fields div.field{
  padding: 5px;
+}
 #quick_login div.form div.fields div.field div.label label{
 color:#fff;
 padding-bottom: 3px;
+}
 #quick_login div.form div.fields div.field div.input input {
 width:236px;
 background:#FFF;
 border-top:1px solid #b3b3b3;
 border-left:1px solid #b3b3b3;
 border-right:1px solid #eaeaea;
 border-bottom:1px solid #eaeaea;
 color:#000;

rhodecode/templates/base/base.html

➞

Show inline comments

@@ @@ -9,49 +9,49 @@ @@
 			<div id="quick_login" style="display:none">
 			${h.form(h.url('login_home',came_from=h.url.current()))}
 			<div class="form">
 			    <div class="fields">
 			        <div class="field">
 			            <div class="label">
 			                <label for="username">${_('Username')}:</label>
 			            </div>
 			            <div class="input">
 			                ${h.text('username',class_='focus',size=40)}
 			            </div>
 			        </div>
 			        <div class="field">
 			            <div class="label">
 			                <label for="password">${_('Password')}:</label>
 			            </div>
 			            <div class="input">
 			                ${h.password('password',class_='focus',size=40)}
 			            </div>
 			        </div>
 			        <div class="buttons">
 			            ${h.submit('sign_in','Sign In',class_="ui-button")}
+			            <div class="password_forgoten">${h.link_to(_('Forgot password ?'),h.url('reset_password'))}</div>${h.submit('sign_in','Sign In',class_="ui-button")}
 			        </div>
 			    </div>
 			</div>
 			${h.end_form()}
 			<script type="text/javascript">
 			YUE.on('quick_login_link','click',function(e){
 				if(YUD.hasClass('quick_login_link','enabled')){
 					YUD.setStyle('quick_login','display','none');
 					YUD.removeClass('quick_login_link','enabled');
+				}
 				else{
 	                YUD.setStyle('quick_login','display','');
 	                YUD.addClass('quick_login_link','enabled');
 	                YUD.get('username').focus();
+				}
 			    //make sure we don't redirect
 				YUE.preventDefault(e);
 			});
 			</script>
 			</div>
              <div class="gravatar">

rhodecode/templates/password_reset.html

➞

Show inline comments

@@ @@ -7,38 +7,38 @@ @@
 <div id="register">
 	<div class="title top-left-rounded-corner top-right-rounded-corner">
 		<h5>${_('Reset You password to')} ${c.rhodecode_name}</h5>
 	</div>
 	<div class="inner">
 	    ${h.form(url('password_reset'))}
 	    <div class="form">
 	        <!-- fields -->
 	        <div class="fields">
 	             <div class="field">
 	                <div class="label">
 	                    <label for="email">${_('Email address')}:</label>
 	                </div>
 	                <div class="input">
 	                    ${h.text('email')}
 	                </div>
 	             </div>
 	            <div class="buttons">
 		            <div class="nohighlight">
 		              ${h.submit('send','Reset my password',class_="ui-button")}
-					  	<div class="activation_msg">${_('Your new password will be send to matching email address')}</div>
+					  	<div class="activation_msg">${_('Password reset link will be send to matching email address')}</div>
 		            </div>
 	            </div>
 	    	</div>
 	    </div>
 	    ${h.end_form()}
         <script type="text/javascript">
         YUE.onDOMReady(function(){
             YUD.get('email').focus();
         })
         </script>
 	</div>
    </div>

rhodecode/templates/password_reset_confirmation.html

➞

Show inline comments

new file 100644

0 comments (0 inline, 0 general)