aboutsummaryrefslogtreecommitdiff
path: root/source/auth.py
blob: 3a30eefec4b9b7e43ac01f6a87a3e0c9ed85cc41 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
#! /usr/bin/env python
#-*- coding: utf-8 -*-

# pyAggr3g470r - A Web based news aggregator.
# Copyright (C) 2010-2013  Cédric Bonhomme - http://cedricbonhomme.org/
#
# For more information : http://bitbucket.org/cedricbonhomme/pyaggr3g470r/
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>

__author__ = "Cedric Bonhomme"
__version__ = "$Revision: 0.1 $"
__date__ = "$Date: 2012/10/12 $"
__revision__ = "$Date: 2012/10/12 $"
__copyright__ = "Copyright (c) Cedric Bonhomme"
__license__ = "GPLv3"

#
# Form based authentication for CherryPy. Requires the
# Session tool to be loaded.
#

import cherrypy
import hashlib

import log

SESSION_KEY = '_cp_username'

import csv
class excel_french(csv.Dialect):
    delimiter = ';'
    quotechar = '"'
    doublequote = True
    skipinitialspace = False
    lineterminator = '\n'
    quoting = csv.QUOTE_MINIMAL

csv.register_dialect('excel_french', excel_french)


def change_password(username, new_password, password_file='./var/password'):
    """
    Change the password corresponding to username.
    """
    users_list = []
    result = False
    with open(password_file, 'r') as csv_readfile_read:
        cr = csv.reader(csv_readfile_read, 'excel_french')
        users_list = [elem for elem in cr]
    with open(password_file, 'w') as csv_file_write:
        cw = csv.writer(csv_file_write, 'excel_french')
        for user in users_list:
            if user[0] == username:
                cw.writerow([user[0], new_password])
                result = True
            else:
                cw.writerow(user)
    return result

def check_credentials(username, password, password_file='./var/password'):
    """Verifies credentials for username and password.
    Returns None on success or a string describing the error on failure"""
    # Adapt to your needs
    USERS = {}
    cr = csv.reader(open(password_file, "r"), 'excel_french')
    for row in cr:
        USERS[row[0]] = row[1]

    m = hashlib.sha1()
    m.update(password.encode())
    if username in list(USERS.keys()) and USERS[username] == m.hexdigest():
        return None
    else:
        return "Incorrect username or password."

    # An example implementation which uses an ORM could be:
    # u = User.get(username)
    # if u is None:
    #     return u"Username %s is unknown to me." % username
    # if u.password != md5.new(password).hexdigest():
    #     return u"Incorrect password"

def check_auth(*args, **kwargs):
    """A tool that looks in config for 'auth.require'. If found and it
    is not None, a login is required and the entry is evaluated as a list of
    conditions that the user must fulfill"""
    conditions = cherrypy.request.config.get('auth.require', None)
    if conditions is not None:
        username = cherrypy.session.get(SESSION_KEY)
        if username:
            cherrypy.request.login = username
            for condition in conditions:
                # A condition is just a callable that returns true or false
                if not condition():
                    raise cherrypy.HTTPRedirect("/auth/login")
        else:
            raise cherrypy.HTTPRedirect("/auth/login")

cherrypy.tools.auth = cherrypy.Tool('before_handler', check_auth)

def require(*conditions):
    """A decorator that appends conditions to the auth.require config
    variable."""
    def decorate(f):
        if not hasattr(f, '_cp_config'):
            f._cp_config = dict()
        if 'auth.require' not in f._cp_config:
            f._cp_config['auth.require'] = []
        f._cp_config['auth.require'].extend(conditions)
        return f
    return decorate


# Conditions are callables that return True
# if the user fulfills the conditions they define, False otherwise
#
# They can access the current username as cherrypy.request.login
#
# Define those at will however suits the application.

def member_of(groupname):
    def check():
        # replace with actual check if <username> is in <groupname>
        return cherrypy.request.login == 'joe' and groupname == 'admin'
    return check

def name_is(reqd_username):
    return lambda: reqd_username == cherrypy.request.login

# These might be handy

def any_of(*conditions):
    """Returns True if any of the conditions match"""
    def check():
        for c in conditions:
            if c():
                return True
        return False
    return check

# By default all conditions are required, but this might still be
# needed if you want to use it inside of an any_of(...) condition
def all_of(*conditions):
    """Returns True if all of the conditions match"""
    def check():
        for c in conditions:
            if not c():
                return False
        return True
    return check



class AuthController(object):
    """
    This class provides login and logout actions.
    """
    def __init__(self):
        self.logger = log.Log()
        self.username = ""

    def on_login(self, username):
        """
        Called on successful login.
        """
        self.username = username
        self.logger.info(username + ' logged in.')

    def on_logout(self, username):
        """
        Called on logout.
        """
        self.logger.info(username + ' logged out.')
        self.username = ""

    def get_loginform(self, username, msg="Enter login information", from_page="/"):
        """
        Login page.
        """
        msg = ""
        return """<!DOCTYPE html>\n<html>
    <head>
        <title>pyAggr3g470r - News aggregator</title>
        <link rel="stylesheet" type="text/css" href="/css/log.css" />
        <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"/>
    </head>
    <body>
        <div>
            <div id="logform">
                <img src="/img/tuxrss.png" alt="pyAggr3g470r" />
                <form method="post" action="/auth/login">
                    <input type="hidden" name="from_page" value="%(from_page)s" />
                    %(msg)s<br />
                    <input type="text" name="username" value="%(username)s" placeholder="Username" autofocus="autofocus" /><br />
                    <input type="password" name="password" placeholder="Password" /><br />
                    <input type="submit" value="Log in" />
                </form>
            </div><!-- end #main -->
        </div><!-- end #center -->
    </body>
</html>""" % locals()

    @cherrypy.expose
    def login(self, username=None, password=None, from_page="/"):
        """
        Open a session for an authenticated user.
        """
        if username is None or password is None:
            return self.get_loginform("", from_page=from_page)

        error_msg = check_credentials(username, password)
        if error_msg:
            self.logger.info(error_msg)
            return self.get_loginform(username, error_msg, from_page)
        else:
            cherrypy.session[SESSION_KEY] = cherrypy.request.login = username
            self.on_login(username)
            raise cherrypy.HTTPRedirect(from_page or "/")

    @cherrypy.expose
    def logout(self, from_page="/"):
        """
        Cloase a session.
        """
        sess = cherrypy.session
        username = sess.get(SESSION_KEY, None)
        sess[SESSION_KEY] = None
        if username:
            cherrypy.request.login = None
            self.on_logout(username)
        raise cherrypy.HTTPRedirect(from_page or "/")
bgstack15