Changeset - c5ff0bfefdf8
Parent rev.
Child rev.
[Not reviewed]
default
0 2 0
Søren Løvborg - 10 years ago 2015-07-14 13:59:59
kwi@kwi.dk
log_in_user: extract user session setup from LoginController

The next changeset will need to set up a user login session outside
LoginController. 'log_in_user' extracted and added as a top-level
function in kallithea.lib.base since the code doesn't need access to
the current controller.

Code refactored to take a User object instead of a username, to allow
callers flexibility in how the user should be looked up.
2 files changed with 41 insertions and 32 deletions:
kallithea/controllers/login.py
9
32
kallithea/lib/base.py
32
0 comments (0 inline, 0 general)
kallithea/controllers/login.py
➞
Show inline comments
 
@@ -19,76 +19,52 @@ Login controller for Kallithea
 

			




	
	
	
		
 
This file was forked by the Kallithea project in July 2014.

			




	
	
	
		
 
Original author and date, and relevant copyright and licensing information is below:

			




	
	
	
		
 
:created_on: Apr 22, 2010

			




	
	
	
		
 
:author: marcink

			




	
	
	
		
 
:copyright: (c) 2013 RhodeCode GmbH, and others.

			




	
	
	
		
 
:license: GPLv3, see LICENSE.md for more details.

			




	
	
	
		
 
"""

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
import logging

			




	
	
	
		
 
import formencode

			




	
	
	
		
 
import datetime

			




	
	
	
		
 
import urlparse

			




	
	
	
		
 

			




	
	
	
		
 
from formencode import htmlfill

			




	
	
	
		
 
from webob.exc import HTTPFound

			




	
	
	
		
 
from pylons.i18n.translation import _

			




	
	
	
		
 
from pylons.controllers.util import redirect

			




	
	
	
		
 
from pylons import request, session, tmpl_context as c, url

			




	
	
	
		
 

			




	
	
	
		
 
import kallithea.lib.helpers as h

			




	
	
	
		
 
from kallithea.lib.auth import AuthUser, HasPermissionAnyDecorator

			




	
	
	
		
 
from kallithea.lib.auth_modules import importplugin

			




	
	
	
		
 
from kallithea.lib.base import BaseController, render

			




	
	
	
		
 
from kallithea.lib.base import BaseController, log_in_user, render

			




	
	
	
		
 
from kallithea.lib.exceptions import UserCreationError

			




	
	
	
		
 
from kallithea.lib.utils2 import safe_str

			




	
	
	
		
 
from kallithea.model.db import User, Setting

			




	
	
	
		
 
from kallithea.model.forms import LoginForm, RegisterForm, PasswordResetForm

			




	
	
	
		
 
from kallithea.model.user import UserModel

			




	
	
	
		
 
from kallithea.model.meta import Session

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
log = logging.getLogger(__name__)

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
class LoginController(BaseController):

			




	
	
	
		
 

			




	
	
	
		
 
    def __before__(self):

			




	
	
	
		
 
        super(LoginController, self).__before__()

			




	
	
	
		
 

			




	
	
	
		
 
    def _store_user_in_session(self, username, remember=False):

			




	
	
	
		
 
        user = User.get_by_username(username, case_insensitive=True)

			




	
	
	
		
 
        auth_user = AuthUser(user.user_id)

			




	
	
	
		
 
        auth_user.set_authenticated()

			




	
	
	
		
 
        cs = auth_user.get_cookie_store()

			




	
	
	
		
 
        session['authuser'] = cs

			




	
	
	
		
 
        user.update_lastlogin()

			




	
	
	
		
 
        Session().commit()

			




	
	
	
		
 

			




	
	
	
		
 
        # If they want to be remembered, update the cookie

			




	
	
	
		
 
        if remember:

			




	
	
	
		
 
            _year = (datetime.datetime.now() +

			




	
	
	
		
 
                     datetime.timedelta(seconds=60 * 60 * 24 * 365))

			




	
	
	
		
 
            session._set_cookie_expires(_year)

			




	
	
	
		
 

			




	
	
	
		
 
        session.save()

			




	
	
	
		
 

			




	
	
	
		
 
        log.info('user %s is now authenticated and stored in '

			




	
	
	
		
 
                 'session, session attrs %s' % (username, cs))

			




	
	
	
		
 

			




	
	
	
		
 
        # dumps session attrs back to cookie

			




	
	
	
		
 
        session._update_cookie_out()

			




	
	
	
		
 

			




	
	
	
		
 
    def _validate_came_from(self, came_from):

			




	
	
	
		
 
        """Return True if came_from is valid and can and should be used"""

			




	
	
	
		
 
        if not came_from:

			




	
	
	
		
 
            return False

			




	
	
	
		
 

			




	
	
	
		
 
        parsed = urlparse.urlparse(came_from)

			




	
	
	
		
 
        server_parsed = urlparse.urlparse(url.current())

			




	
	
	
		
 
        allowed_schemes = ['http', 'https']

			




	
	
	
		
 
        if parsed.scheme and parsed.scheme not in allowed_schemes:

			




	
	
	
		
 
            log.error('Suspicious URL scheme detected %s for url %s' %

			




	
	
	
		
 
                     (parsed.scheme, parsed))

			




	
	
	
		
 
            return False

			




	
	
		
 
@@ -110,64 +86,65 @@ class LoginController(BaseController):

			




	
	
	
		
 

			




	
	
	
		
 
        not_default = self.authuser.username != User.DEFAULT_USER

			




	
	
	
		
 
        ip_allowed = AuthUser.check_ip_allowed(self.authuser, self.ip_addr)

			




	
	
	
		
 

			




	
	
	
		
 
        # redirect if already logged in

			




	
	
	
		
 
        if self.authuser.is_authenticated and not_default and ip_allowed:

			




	
	
	
		
 
            return self._redirect_to_origin(c.came_from)

			




	
	
	
		
 

			




	
	
	
		
 
        if request.POST:

			




	
	
	
		
 
            # import Login Form validator class

			




	
	
	
		
 
            login_form = LoginForm()

			




	
	
	
		
 
            try:

			




	
	
	
		
 
                session.invalidate()

			




	
	
	
		
 
                c.form_result = login_form.to_python(dict(request.POST))

			




	
	
	
		
 
                # form checks for username/password, now we're authenticated

			




	
	
	
		
 
                self._store_user_in_session(

			




	
	
	
		
 
                                        username=c.form_result['username'],

			




	
	
	
		
 
                                        remember=c.form_result['remember'])

			




	
	
	
		
 
                return self._redirect_to_origin(c.came_from)

			




	
	
	
		
 

			




	
	
	
		
 
                username = c.form_result['username']

			




	
	
	
		
 
                user = User.get_by_username(username, case_insensitive=True)

			




	
	
	
		
 
            except formencode.Invalid, errors:

			




	
	
	
		
 
                defaults = errors.value

			




	
	
	
		
 
                # remove password from filling in form again

			




	
	
	
		
 
                del defaults['password']

			




	
	
	
		
 
                return htmlfill.render(

			




	
	
	
		
 
                    render('/login.html'),

			




	
	
	
		
 
                    defaults=errors.value,

			




	
	
	
		
 
                    errors=errors.error_dict or {},

			




	
	
	
		
 
                    prefix_error=False,

			




	
	
	
		
 
                    encoding="UTF-8",

			




	
	
	
		
 
                    force_defaults=False)

			




	
	
	
		
 
            except UserCreationError, e:

			




	
	
	
		
 
                # container auth or other auth functions that create users on

			




	
	
	
		
 
                # the fly can throw this exception signaling that there's issue

			




	
	
	
		
 
                # with user creation, explanation should be provided in

			




	
	
	
		
 
                # Exception itself

			




	
	
	
		
 
                h.flash(e, 'error')

			




	
	
	
		
 
            else:

			




	
	
	
		
 
                log_in_user(user, c.form_result['remember'])

			




	
	
	
		
 
                return self._redirect_to_origin(c.came_from)

			




	
	
	
		
 

			




	
	
	
		
 
        # check if we use container plugin, and try to login using it.

			




	
	
	
		
 
        auth_plugins = Setting.get_auth_plugins()

			




	
	
	
		
 
        if any((importplugin(name).is_container_auth for name in auth_plugins)):

			




	
	
	
		
 
            from kallithea.lib import auth_modules

			




	
	
	
		
 
            try:

			




	
	
	
		
 
                auth_info = auth_modules.authenticate('', '', request.environ)

			




	
	
	
		
 
            except UserCreationError, e:

			




	
	
	
		
 
                log.error(e)

			




	
	
	
		
 
                h.flash(e, 'error')

			




	
	
	
		
 
                # render login, with flash message about limit

			




	
	
	
		
 
                return render('/login.html')

			




	
	
	
		
 

			




	
	
	
		
 
            if auth_info:

			




	
	
	
		
 
                self._store_user_in_session(auth_info.get('username'))

			




	
	
	
		
 
                username = auth_info.get('username')

			




	
	
	
		
 
                user = User.get_by_username(username, case_insensitive=True)

			




	
	
	
		
 
                log_in_user(user, remember=False)

			




	
	
	
		
 
                return self._redirect_to_origin(c.came_from)

			




	
	
	
		
 

			




	
	
	
		
 
        return render('/login.html')

			




	
	
	
		
 

			




	
	
	
		
 
    @HasPermissionAnyDecorator('hg.admin', 'hg.register.auto_activate',

			




	
	
	
		
 
                               'hg.register.manual_activate')

			




	
	
	
		
 
    def register(self):

			




	
	
	
		
 
        c.auto_active = 'hg.register.auto_activate' in User.get_default_user()\

			




	
	
	
		
 
            .AuthUser.permissions['global']

			




	
	
	
		
 

			




	
	
	
		
 
        settings = Setting.get_app_settings()

			




	
	
	
		
 
        captcha_private_key = settings.get('captcha_private_key')

			




        

    


    
    

    

        

                

                    kallithea/lib/base.py
                

                

                  
                      
                        

                      ➞

                      
                        
                  

                  
                      
                  
                      
                  
                      
                  
                      
                  
                  
                

                

                    Show inline comments
                    
                

        

        

            



	
	
		
 
@@ -19,24 +19,25 @@ kallithea.lib.base

			




	
	
	
		
 
The base Controller API

			




	
	
	
		
 
Provides the BaseController class for subclassing. And usage in different

			




	
	
	
		
 
controllers

			




	
	
	
		
 

			




	
	
	
		
 
This file was forked by the Kallithea project in July 2014.

			




	
	
	
		
 
Original author and date, and relevant copyright and licensing information is below:

			




	
	
	
		
 
:created_on: Oct 06, 2010

			




	
	
	
		
 
:author: marcink

			




	
	
	
		
 
:copyright: (c) 2013 RhodeCode GmbH, and others.

			




	
	
	
		
 
:license: GPLv3, see LICENSE.md for more details.

			




	
	
	
		
 
"""

			




	
	
	
		
 

			




	
	
	
		
 
import datetime

			




	
	
	
		
 
import logging

			




	
	
	
		
 
import time

			




	
	
	
		
 
import traceback

			




	
	
	
		
 

			




	
	
	
		
 
import webob.exc

			




	
	
	
		
 
import paste.httpexceptions

			




	
	
	
		
 
import paste.auth.basic

			




	
	
	
		
 
import paste.httpheaders

			




	
	
	
		
 

			




	
	
	
		
 
from pylons import config, tmpl_context as c, request, session, url

			




	
	
	
		
 
from pylons.controllers import WSGIController

			




	
	
	
		
 
from pylons.controllers.util import redirect

			




	
	
		
 
@@ -94,24 +95,55 @@ def _get_ip_addr(environ):

			




	
	
	
		
 
    ip = environ.get(def_key, '0.0.0.0')

			




	
	
	
		
 
    return _filter_proxy(ip)

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
def _get_access_path(environ):

			




	
	
	
		
 
    path = environ.get('PATH_INFO')

			




	
	
	
		
 
    org_req = environ.get('pylons.original_request')

			




	
	
	
		
 
    if org_req:

			




	
	
	
		
 
        path = org_req.environ.get('PATH_INFO')

			




	
	
	
		
 
    return path

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
def log_in_user(user, remember):

			




	
	
	
		
 
    """

			




	
	
	
		
 
    Log a `User` in and update session and cookies. If `remember` is True,

			




	
	
	
		
 
    the session cookie is set to expire in a year; otherwise, it expires at

			




	
	
	
		
 
    the end of the browser session.

			




	
	
	
		
 
    """

			




	
	
	
		
 
    user.update_lastlogin()

			




	
	
	
		
 
    meta.Session().commit()

			




	
	
	
		
 

			




	
	
	
		
 
    auth_user = AuthUser(user_id=user.user_id)

			




	
	
	
		
 
    auth_user.set_authenticated()

			




	
	
	
		
 

			




	
	
	
		
 
    # Start new session to prevent session fixation attacks.

			




	
	
	
		
 
    session.invalidate()

			




	
	
	
		
 
    cs = auth_user.get_cookie_store()

			




	
	
	
		
 
    session['authuser'] = cs

			




	
	
	
		
 

			




	
	
	
		
 
    # If they want to be remembered, update the cookie

			




	
	
	
		
 
    if remember:

			




	
	
	
		
 
        t = datetime.datetime.now() + datetime.timedelta(days=365)

			




	
	
	
		
 
        session._set_cookie_expires(t)

			




	
	
	
		
 

			




	
	
	
		
 
    session.save()

			




	
	
	
		
 

			




	
	
	
		
 
    log.info('user %s is now authenticated and stored in '

			




	
	
	
		
 
             'session, session attrs %s', user.username, cs)

			




	
	
	
		
 

			




	
	
	
		
 
    # dumps session attrs back to cookie

			




	
	
	
		
 
    session._update_cookie_out()

			




	
	
	
		
 

			




	
	
	
		
 

			




	
	
	
		
 
class BasicAuth(paste.auth.basic.AuthBasicAuthenticator):

			




	
	
	
		
 

			




	
	
	
		
 
    def __init__(self, realm, authfunc, auth_http_code=None):

			




	
	
	
		
 
        self.realm = realm

			




	
	
	
		
 
        self.authfunc = authfunc

			




	
	
	
		
 
        self._rc_auth_http_code = auth_http_code

			




	
	
	
		
 

			




	
	
	
		
 
    def build_authentication(self):

			




	
	
	
		
 
        head = paste.httpheaders.WWW_AUTHENTICATE.tuples('Basic realm="%s"' % self.realm)

			




	
	
	
		
 
        if self._rc_auth_http_code and self._rc_auth_http_code == '403':

			




	
	
	
		
 
            # return 403 if alternative http return code is specified in

			




	
	
	
		
 
            # Kallithea config

			




        

    



    


    



    



      

      





    
    0 comments (0 inline, 0 general)
    





    


  

  







  


    




    








    
        
    
    
        This site is powered by
            Kallithea 0.7.0,
        which is
        © 2010–2025 by various authors & licensed under GPLv3.