From aeae6cc29099c4bea84bbfd006615104ba719b1e Mon Sep 17 00:00:00 2001
From: Rodney Ewing <ewing.rj@gmail.com>
Date: Mon, 8 Jul 2013 17:00:37 -0700
Subject: moved forgot pass to basic_auth plugin

---
 mediagoblin/plugins/basic_auth/__init__.py         |  18 +++
 mediagoblin/plugins/basic_auth/forms.py            |  17 ++
 .../mediagoblin/plugins/basic_auth/change_fp.html  |  43 +++++
 .../plugins/basic_auth/forgot_password.html        |  38 +++++
 .../plugins/basic_auth/fp_verification_email.txt   |  30 ++++
 mediagoblin/plugins/basic_auth/tools.py            |  33 ++++
 mediagoblin/plugins/basic_auth/views.py            | 180 +++++++++++++++++++++
 7 files changed, 359 insertions(+)
 create mode 100644 mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/change_fp.html
 create mode 100644 mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/forgot_password.html
 create mode 100644 mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/fp_verification_email.txt
 create mode 100644 mediagoblin/plugins/basic_auth/views.py

(limited to 'mediagoblin/plugins')

diff --git a/mediagoblin/plugins/basic_auth/__init__.py b/mediagoblin/plugins/basic_auth/__init__.py
index 33a554b0..913ccba4 100644
--- a/mediagoblin/plugins/basic_auth/__init__.py
+++ b/mediagoblin/plugins/basic_auth/__init__.py
@@ -13,6 +13,8 @@
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
+import os
+
 from mediagoblin.plugins.basic_auth import forms as auth_forms
 from mediagoblin.plugins.basic_auth import tools as auth_tools
 from mediagoblin.auth.tools import create_basic_user
@@ -20,10 +22,26 @@ from mediagoblin.db.models import User
 from mediagoblin.tools import pluginapi
 from sqlalchemy import or_
 
+PLUGIN_DIR = os.path.dirname(__file__)
+
 
 def setup_plugin():
     config = pluginapi.get_config('mediagoblin.plugins.basic_auth')
 
+    routes = [
+        ('mediagoblin.plugins.basic_auth.edit.pass',
+         '/edit/password/',
+         'mediagoblin.plugins.basic_auth.views:change_pass'),
+        ('mediagoblin.plugins.basic_auth.forgot_password',
+         '/auth/forgot_password/',
+         'mediagoblin.plugins.basic_auth.views:forgot_password'),
+        ('mediagoblin.plugins.basic_auth.verify_forgot_password',
+         '/auth/forgot_password/verify/',
+         'mediagoblin.plugins.basic_auth.views:verify_forgot_password')]
+
+    pluginapi.register_routes(routes)
+    pluginapi.register_template_path(os.path.join(PLUGIN_DIR, 'templates'))
+
 
 def get_user(**kwargs):
     username = kwargs.pop('username', None)
diff --git a/mediagoblin/plugins/basic_auth/forms.py b/mediagoblin/plugins/basic_auth/forms.py
index 6cf01b38..e1d38668 100644
--- a/mediagoblin/plugins/basic_auth/forms.py
+++ b/mediagoblin/plugins/basic_auth/forms.py
@@ -44,3 +44,20 @@ class LoginForm(wtforms.Form):
     stay_logged_in = wtforms.BooleanField(
         label='',
         description=_('Stay logged in'))
+
+
+class ForgotPassForm(wtforms.Form):
+    username = wtforms.TextField(
+        _('Username or email'),
+        [wtforms.validators.Required(),
+         normalize_user_or_email_field()])
+
+
+class ChangeForgotPassForm(wtforms.Form):
+    password = wtforms.PasswordField(
+        'Password',
+        [wtforms.validators.Required(),
+         wtforms.validators.Length(min=5, max=1024)])
+    token = wtforms.HiddenField(
+        '',
+        [wtforms.validators.Required()])
diff --git a/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/change_fp.html b/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/change_fp.html
new file mode 100644
index 00000000..a3cf9cb9
--- /dev/null
+++ b/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/change_fp.html
@@ -0,0 +1,43 @@
+{#
+# GNU MediaGoblin -- federated, autonomous media hosting
+# Copyright (C) 2011 Free Software Foundation, Inc
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#}
+{% extends "mediagoblin/base.html" %}
+
+{% import "/mediagoblin/utils/wtforms.html" as wtforms_util %}
+
+{% block mediagoblin_head %}
+  <script type="text/javascript"
+          src="{{ request.staticdirect('/js/show_password.js') }}"></script>
+{% endblock mediagoblin_head %}
+
+{% block title -%}
+  {% trans %}Set your new password{% endtrans %} &mdash; {{ super() }}
+{%- endblock %}
+
+{% block mediagoblin_content %}
+  <form action="{{ request.urlgen('mediagoblin.auth.verify_forgot_password') }}"
+        method="POST" enctype="multipart/form-data">
+    {{ csrf_token }}
+    <div class="form_box">
+      <h1>{% trans %}Set your new password{% endtrans %}</h1>
+      {{ wtforms_util.render_divs(cp_form, True) }}
+      <div class="form_submit_buttons">
+        <input type="submit" value="{% trans %}Set password{% endtrans %}" class="button_form"/>
+      </div>
+    </div>
+{% endblock %}
+
diff --git a/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/forgot_password.html b/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/forgot_password.html
new file mode 100644
index 00000000..6cfd2c85
--- /dev/null
+++ b/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/forgot_password.html
@@ -0,0 +1,38 @@
+{#
+# GNU MediaGoblin -- federated, autonomous media hosting
+# Copyright (C) 2011 Free Software Foundation, Inc
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#}
+{% extends "mediagoblin/base.html" %}
+
+{% import "/mediagoblin/utils/wtforms.html" as wtforms_util %}
+
+{% block title -%}
+  {% trans %}Recover password{% endtrans %} &mdash; {{ super() }}
+{%- endblock %}
+
+{% block mediagoblin_content %}
+  <form action="{{ request.urlgen('mediagoblin.auth.forgot_password') }}"
+        method="POST" enctype="multipart/form-data">
+    {{ csrf_token }}
+    <div class="form_box">
+      <h1>{% trans %}Recover password{% endtrans %}</h1>
+      {{ wtforms_util.render_divs(fp_form, True) }}
+      <div class="form_submit_buttons">
+        <input type="submit" value="{% trans %}Send instructions{% endtrans %}" class="button_form"/>
+      </div>
+    </div>
+  </form>
+{% endblock %}
diff --git a/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/fp_verification_email.txt b/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/fp_verification_email.txt
new file mode 100644
index 00000000..fb5e1674
--- /dev/null
+++ b/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/fp_verification_email.txt
@@ -0,0 +1,30 @@
+{#
+# GNU MediaGoblin -- federated, autonomous media hosting
+# Copyright (C) 2011 Free Software Foundation, Inc
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#}
+
+{% trans username=username, verification_url=verification_url|safe -%}
+Hi {{ username }},
+
+to change your GNU MediaGoblin password, open the following URL in 
+your web browser:
+
+{{ verification_url }}
+
+If you think this is an error, just ignore this email and continue being
+a happy goblin!
+{%- endtrans %}
+
diff --git a/mediagoblin/plugins/basic_auth/tools.py b/mediagoblin/plugins/basic_auth/tools.py
index 1300bb9a..97393976 100644
--- a/mediagoblin/plugins/basic_auth/tools.py
+++ b/mediagoblin/plugins/basic_auth/tools.py
@@ -82,3 +82,36 @@ def fake_login_attempt():
     randplus_hashed_pass = bcrypt.hashpw(hashed_pass, rand_salt)
 
     randplus_stored_hash == randplus_hashed_pass
+
+
+EMAIL_FP_VERIFICATION_TEMPLATE = (
+    u"{uri}?"
+    u"token={fp_verification_key}")
+
+
+def send_fp_verification_email(user, request):
+    """
+    Send the verification email to users to change their password.
+
+    Args:
+    - user: a user object
+    - request: the request
+    """
+    fp_verification_key = get_timed_signer_url('mail_verification_token') \
+            .dumps(user.id)
+
+    rendered_email = render_template(
+        request, 'mediagoblin/auth/fp_verification_email.txt',
+        {'username': user.username,
+         'verification_url': EMAIL_FP_VERIFICATION_TEMPLATE.format(
+             uri=request.urlgen('mediagoblin.auth.verify_forgot_password',
+                                qualified=True),
+             fp_verification_key=fp_verification_key)})
+
+    # TODO: There is no error handling in place
+    send_email(
+        mg_globals.app_config['email_sender_address'],
+        [user.email],
+        'GNU MediaGoblin - Change forgotten password!',
+        rendered_email)
+
diff --git a/mediagoblin/plugins/basic_auth/views.py b/mediagoblin/plugins/basic_auth/views.py
new file mode 100644
index 00000000..64defdad
--- /dev/null
+++ b/mediagoblin/plugins/basic_auth/views.py
@@ -0,0 +1,180 @@
+# GNU MediaGoblin -- federated, autonomous media hosting
+# Copyright (C) 2011, 2012 MediaGoblin contributors.  See AUTHORS.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+from itsdangerous import BadSignature
+
+from mediagoblin import messages
+from mediagoblin.db.models import User
+from mediagoblin.plugins.basic_auth import forms, tools
+from mediagoblin.tools.crypto import get_timed_signer_url
+from mediagoblin.tools.mail import email_debug_message
+from mediagoblin.tools.response import redirect, render_to_response, render_404
+from mediagoblin.tools.translate import pass_to_ugettext as _
+
+
+def forgot_password(request):
+    """
+    Forgot password view
+
+    Sends an email with an url to renew forgotten password.
+    Use GET querystring parameter 'username' to pre-populate the input field
+    """
+    fp_form = forms.ForgotPassForm(request.form,
+                                   username=request.args.get('username'))
+
+    if not (request.method == 'POST' and fp_form.validate()):
+        # Either GET request, or invalid form submitted. Display the template
+        return render_to_response(request,
+            'mediagoblin/plugins/basic_auth/forgot_password.html',
+            {'fp_form': fp_form})
+
+    # If we are here: method == POST and form is valid. username casing
+    # has been sanitized. Store if a user was found by email. We should
+    # not reveal if the operation was successful then as we don't want to
+    # leak if an email address exists in the system.
+    found_by_email = '@' in fp_form.username.data
+
+    if found_by_email:
+        user = User.query.filter_by(
+            email=fp_form.username.data).first()
+        # Don't reveal success in case the lookup happened by email address.
+        success_message = _("If that email address (case sensitive!) is "
+                            "registered an email has been sent with "
+                            "instructions on how to change your password.")
+
+    else:  # found by username
+        user = User.query.filter_by(
+            username=fp_form.username.data).first()
+
+        if user is None:
+            messages.add_message(request,
+                                 messages.WARNING,
+                                 _("Couldn't find someone with that username."))
+            return redirect(request, 'mediagoblin.auth.forgot_password')
+
+        success_message = _("An email has been sent with instructions "
+                            "on how to change your password.")
+
+    if user and not(user.email_verified and user.status == 'active'):
+        # Don't send reminder because user is inactive or has no verified email
+        messages.add_message(request,
+            messages.WARNING,
+            _("Could not send password recovery email as your username is in"
+              "active or your account's email address has not been verified."))
+
+        return redirect(request, 'mediagoblin.user_pages.user_home',
+                        user=user.username)
+
+    # SUCCESS. Send reminder and return to login page
+    if user:
+        email_debug_message(request)
+        tools.send_fp_verification_email(user, request)
+
+    messages.add_message(request, messages.INFO, success_message)
+    return redirect(request, 'mediagoblin.auth.login')
+
+
+def verify_forgot_password(request):
+    """
+    Check the forgot-password verification and possibly let the user
+    change their password because of it.
+    """
+    # get form data variables, and specifically check for presence of token
+    formdata = _process_for_token(request)
+    if not formdata['has_token']:
+        return render_404(request)
+
+    formdata_vars = formdata['vars']
+
+    # Catch error if token is faked or expired
+    try:
+        token = get_timed_signer_url("mail_verification_token") \
+                .loads(formdata_vars['token'], max_age=10*24*3600)
+    except BadSignature:
+        messages.add_message(
+            request,
+            messages.ERROR,
+            _('The verification key or user id is incorrect.'))
+
+        return redirect(
+            request,
+            'index')
+
+    # check if it's a valid user id
+    user = User.query.filter_by(id=int(token)).first()
+
+    # no user in db
+    if not user:
+        messages.add_message(
+            request, messages.ERROR,
+            _('The user id is incorrect.'))
+        return redirect(
+            request, 'index')
+
+    # check if user active and has email verified
+    if user.email_verified and user.status == 'active':
+
+        cp_form = forms.ChangePassForm(formdata_vars)
+
+        if request.method == 'POST' and cp_form.validate():
+            user.pw_hash = tools.bcrypt_gen_password_hash(
+                cp_form.password.data)
+            user.save()
+
+            messages.add_message(
+                request,
+                messages.INFO,
+                _("You can now log in using your new password."))
+            return redirect(request, 'mediagoblin.auth.login')
+        else:
+            return render_to_response(
+                request,
+                'mediagoblin/plugins/basic_auth/change_fp.html',
+                {'cp_form': cp_form})
+
+    if not user.email_verified:
+        messages.add_message(
+            request, messages.ERROR,
+            _('You need to verify your email before you can reset your'
+              ' password.'))
+
+    if not user.status == 'active':
+        messages.add_message(
+            request, messages.ERROR,
+            _('You are no longer an active user. Please contact the system'
+              ' admin to reactivate your accoutn.'))
+
+    return redirect(
+        request, 'index')
+
+
+def _process_for_token(request):
+    """
+    Checks for tokens in formdata without prior knowledge of request method
+
+    For now, returns whether the userid and token formdata variables exist, and
+    the formdata variables in a hash. Perhaps an object is warranted?
+    """
+    # retrieve the formdata variables
+    if request.method == 'GET':
+        formdata_vars = request.GET
+    else:
+        formdata_vars = request.form
+
+    formdata = {
+        'vars': formdata_vars,
+        'has_token': 'token' in formdata_vars}
+
+    return formdata
-- 
cgit v1.2.3


From af665c4eb9dfb53ef9ac28567f7f3806ed313093 Mon Sep 17 00:00:00 2001
From: Rodney Ewing <ewing.rj@gmail.com>
Date: Mon, 8 Jul 2013 17:17:12 -0700
Subject: moved change_pass to basic_auth and fixed some typos with the moving
 of forgot pass

---
 mediagoblin/plugins/basic_auth/forms.py            | 13 ++++++
 .../mediagoblin/plugins/basic_auth/change_fp.html  |  2 +-
 .../plugins/basic_auth/change_pass.html            | 52 ++++++++++++++++++++++
 .../plugins/basic_auth/forgot_password.html        |  2 +-
 .../plugins/basic_auth/verification.txt            | 29 ++++++++++++
 mediagoblin/plugins/basic_auth/views.py            | 37 +++++++++++++++
 6 files changed, 133 insertions(+), 2 deletions(-)
 create mode 100644 mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/change_pass.html
 create mode 100644 mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/verification.txt

(limited to 'mediagoblin/plugins')

diff --git a/mediagoblin/plugins/basic_auth/forms.py b/mediagoblin/plugins/basic_auth/forms.py
index e1d38668..c10496f8 100644
--- a/mediagoblin/plugins/basic_auth/forms.py
+++ b/mediagoblin/plugins/basic_auth/forms.py
@@ -61,3 +61,16 @@ class ChangeForgotPassForm(wtforms.Form):
     token = wtforms.HiddenField(
         '',
         [wtforms.validators.Required()])
+
+
+class ChangePassForm(wtforms.Form):
+    old_password = wtforms.PasswordField(
+        _('Old password'),
+        [wtforms.validators.Required()],
+        description=_(
+            "Enter your old password to prove you own this account."))
+    new_password = wtforms.PasswordField(
+        _('New password'),
+        [wtforms.validators.Required(),
+         wtforms.validators.Length(min=6, max=30)],
+        id="password")
diff --git a/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/change_fp.html b/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/change_fp.html
index a3cf9cb9..47cd591e 100644
--- a/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/change_fp.html
+++ b/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/change_fp.html
@@ -29,7 +29,7 @@
 {%- endblock %}
 
 {% block mediagoblin_content %}
-  <form action="{{ request.urlgen('mediagoblin.auth.verify_forgot_password') }}"
+  <form action="{{ request.urlgen('mediagoblin.plugins.basic_auth.verify_forgot_password') }}"
         method="POST" enctype="multipart/form-data">
     {{ csrf_token }}
     <div class="form_box">
diff --git a/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/change_pass.html b/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/change_pass.html
new file mode 100644
index 00000000..596a4def
--- /dev/null
+++ b/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/change_pass.html
@@ -0,0 +1,52 @@
+{#
+# GNU MediaGoblin -- federated, autonomous media hosting
+# Copyright (C) 2011, 2012 MediaGoblin contributors.  See AUTHORS.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#}
+{% extends "mediagoblin/base.html" %}
+
+{% import "/mediagoblin/utils/wtforms.html" as wtforms_util %}
+
+{% block mediagoblin_head %}
+  <script type="text/javascript"
+          src="{{ request.staticdirect('/js/show_password.js') }}"></script>
+{% endblock mediagoblin_head %}
+
+{% block title -%}
+  {% trans username=user.username -%}
+    Changing {{ username }}'s password
+  {%- endtrans %} &mdash; {{ super() }}
+{%- endblock %}
+
+{% block mediagoblin_content %}
+  <form action="{{ request.urlgen('mediagoblin.plugins.basic_auth.edit.pass') }}"
+        method="POST" enctype="multipart/form-data">
+    <div class="form_box edit_box">
+      <h1>
+        {%- trans username=user.username -%}
+          Changing {{ username }}'s password
+        {%- endtrans -%}
+      </h1>
+      {{ wtforms_util.render_divs(form, True) }}
+      {{ csrf_token }}
+      <div class="form_submit_buttons">
+        <input type="submit" value="{% trans %}Save{% endtrans %}"
+        class="button_form" />
+      </div>
+    </div>
+  </form>
+{% endblock %}
+
+
diff --git a/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/forgot_password.html b/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/forgot_password.html
index 6cfd2c85..b0028ab6 100644
--- a/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/forgot_password.html
+++ b/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/forgot_password.html
@@ -24,7 +24,7 @@
 {%- endblock %}
 
 {% block mediagoblin_content %}
-  <form action="{{ request.urlgen('mediagoblin.auth.forgot_password') }}"
+  <form action="{{ request.urlgen('mediagoblin.plugins.basic_auth.forgot_password') }}"
         method="POST" enctype="multipart/form-data">
     {{ csrf_token }}
     <div class="form_box">
diff --git a/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/verification.txt b/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/verification.txt
new file mode 100644
index 00000000..d53cd5e8
--- /dev/null
+++ b/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/verification.txt
@@ -0,0 +1,29 @@
+{#
+# GNU MediaGoblin -- federated, autonomous media hosting
+# Copyright (C) 2011, 2012 MediaGoblin contributors.  See AUTHORS.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-#}
+
+{% trans username=username, verification_url=verification_url|safe -%}
+Hi,
+
+We wanted to verify that you are {{ username }}. If this is the case, then 
+please follow the link below to verify your new email address.
+
+{{ verification_url }}
+
+If you are not {{ username }} or didn't request an email change, you can ignore
+this email.
+{%- endtrans %}
diff --git a/mediagoblin/plugins/basic_auth/views.py b/mediagoblin/plugins/basic_auth/views.py
index 64defdad..9a1b75d2 100644
--- a/mediagoblin/plugins/basic_auth/views.py
+++ b/mediagoblin/plugins/basic_auth/views.py
@@ -17,6 +17,7 @@ from itsdangerous import BadSignature
 
 from mediagoblin import messages
 from mediagoblin.db.models import User
+from mediagoblin.decorators import require_active_login
 from mediagoblin.plugins.basic_auth import forms, tools
 from mediagoblin.tools.crypto import get_timed_signer_url
 from mediagoblin.tools.mail import email_debug_message
@@ -178,3 +179,39 @@ def _process_for_token(request):
         'has_token': 'token' in formdata_vars}
 
     return formdata
+
+
+@require_active_login
+def change_pass(request):
+    form = forms.ChangePassForm(request.form)
+    user = request.user
+
+    if request.method == 'POST' and form.validate():
+
+        if not tools.bcrypt_check_password(
+                form.old_password.data, user.pw_hash):
+            form.old_password.errors.append(
+                _('Wrong password'))
+
+            return render_to_response(
+                request,
+                'mediagoblin/plugins/basic_auth/change_pass.html',
+                {'form': form,
+                 'user': user})
+
+        # Password matches
+        user.pw_hash = tools.bcrypt_gen_password_hash(
+            form.new_password.data)
+        user.save()
+
+        messages.add_message(
+            request, messages.SUCCESS,
+            _('Your password was changed successfully'))
+
+        return redirect(request, 'mediagoblin.edit.account')
+
+    return render_to_response(
+        request,
+        'mediagoblin/plugins/basic_auth/change_pass.html',
+        {'form': form,
+         'user': user})
-- 
cgit v1.2.3


From 36f901fbbd68479a911058f4ec3b9717e81e2b92 Mon Sep 17 00:00:00 2001
From: Rodney Ewing <ewing.rj@gmail.com>
Date: Mon, 8 Jul 2013 17:28:21 -0700
Subject: used template hooks instead of hardcoding basic_auth functionality
 into templates

---
 mediagoblin/plugins/basic_auth/__init__.py         | 11 ++++++++++
 .../basic_auth/static/js/autofilledin_password.js  | 25 ++++++++++++++++++++++
 .../mediagoblin/plugins/basic_auth/edit_link.html  | 25 ++++++++++++++++++++++
 .../mediagoblin/plugins/basic_auth/fp_head.html    | 20 +++++++++++++++++
 .../mediagoblin/plugins/basic_auth/fp_link.html    | 25 ++++++++++++++++++++++
 .../mediagoblin/plugins/openid/login.html          |  4 ++--
 6 files changed, 108 insertions(+), 2 deletions(-)
 create mode 100644 mediagoblin/plugins/basic_auth/static/js/autofilledin_password.js
 create mode 100644 mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/edit_link.html
 create mode 100644 mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/fp_head.html
 create mode 100644 mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/fp_link.html

(limited to 'mediagoblin/plugins')

diff --git a/mediagoblin/plugins/basic_auth/__init__.py b/mediagoblin/plugins/basic_auth/__init__.py
index 913ccba4..06059a07 100644
--- a/mediagoblin/plugins/basic_auth/__init__.py
+++ b/mediagoblin/plugins/basic_auth/__init__.py
@@ -13,6 +13,7 @@
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
+from pkg_resources import resource_filename
 import os
 
 from mediagoblin.plugins.basic_auth import forms as auth_forms
@@ -21,6 +22,8 @@ from mediagoblin.auth.tools import create_basic_user
 from mediagoblin.db.models import User
 from mediagoblin.tools import pluginapi
 from sqlalchemy import or_
+from mediagoblin.tools.staticdirect import PluginStatic
+
 
 PLUGIN_DIR = os.path.dirname(__file__)
 
@@ -42,6 +45,11 @@ def setup_plugin():
     pluginapi.register_routes(routes)
     pluginapi.register_template_path(os.path.join(PLUGIN_DIR, 'templates'))
 
+    pluginapi.register_template_hooks(
+        {'edit_link': 'mediagoblin/plugins/basic_auth/edit_link.html',
+         'fp_link': 'mediagoblin/plugins/basic_auth/fp_link.html',
+         'fp_head': 'mediagoblin/plugins/basic_auth/fp_head.html'})
+
 
 def get_user(**kwargs):
     username = kwargs.pop('username', None)
@@ -103,4 +111,7 @@ hooks = {
     'auth_check_password': check_password,
     'auth_fake_login_attempt': auth_tools.fake_login_attempt,
     'template_global_context': append_to_global_context,
+    'static_setup': lambda: PluginStatic(
+        'coreplugin_basic_auth',
+        resource_filename('mediagoblin.plugins.basic_auth', 'static'))
 }
diff --git a/mediagoblin/plugins/basic_auth/static/js/autofilledin_password.js b/mediagoblin/plugins/basic_auth/static/js/autofilledin_password.js
new file mode 100644
index 00000000..45e867fe
--- /dev/null
+++ b/mediagoblin/plugins/basic_auth/static/js/autofilledin_password.js
@@ -0,0 +1,25 @@
+/**
+ * GNU MediaGoblin -- federated, autonomous media hosting
+ * Copyright (C) 2012 MediaGoblin contributors.  See AUTHORS.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+$(document).ready(function(){
+  $('#forgot_password').click(function(event){
+    event.preventDefault();
+    window.location.pathname = $(this).attr('href') + '?username=' +
+                               $('#username').val();
+  });
+});
diff --git a/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/edit_link.html b/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/edit_link.html
new file mode 100644
index 00000000..9fd09ab1
--- /dev/null
+++ b/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/edit_link.html
@@ -0,0 +1,25 @@
+{#
+# GNU MediaGoblin -- federated, autonomous media hosting
+# Copyright (C) 2011, 2012 MediaGoblin contributors.  See AUTHORS.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#}
+
+{% block change_pass_link %}
+  <p>
+    <a href="{{ request.urlgen('mediagoblin.plugins.basic_auth.edit.pass') }}">
+      {% trans %}Change your password.{% endtrans %}
+    </a>
+  </p>
+{% endblock %}
diff --git a/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/fp_head.html b/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/fp_head.html
new file mode 100644
index 00000000..292dce28
--- /dev/null
+++ b/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/fp_head.html
@@ -0,0 +1,20 @@
+{#
+# GNU MediaGoblin -- federated, autonomous media hosting
+# Copyright (C) 2011, 2012 MediaGoblin contributors.  See AUTHORS.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+ You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#}
+
+<script type="text/javascript"
+          src="{{ request.staticdirect('/js/autofilledin_password.js', 'coreplugin_basic_auth') }}"></script>
diff --git a/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/fp_link.html b/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/fp_link.html
new file mode 100644
index 00000000..404358d8
--- /dev/null
+++ b/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/fp_link.html
@@ -0,0 +1,25 @@
+{#
+# GNU MediaGoblin -- federated, autonomous media hosting
+# Copyright (C) 2011, 2012 MediaGoblin contributors.  See AUTHORS.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#}
+
+{% block fp_link %}
+  <p>
+    <a href="{{ request.urlgen('mediagoblin.plugins.basic_auth.forgot_password') }}" id="forgot_password">
+      {% trans %}Forgot your password?{% endtrans %}</a>
+  </p>
+{% endblock %}
+
diff --git a/mediagoblin/plugins/openid/templates/mediagoblin/plugins/openid/login.html b/mediagoblin/plugins/openid/templates/mediagoblin/plugins/openid/login.html
index 8d74c2b9..193a3b2d 100644
--- a/mediagoblin/plugins/openid/templates/mediagoblin/plugins/openid/login.html
+++ b/mediagoblin/plugins/openid/templates/mediagoblin/plugins/openid/login.html
@@ -20,8 +20,8 @@
 {% import "/mediagoblin/utils/wtforms.html" as wtforms_util %}
 
 {% block mediagoblin_head %}
-  <script type="text/javascript"
-          src="{{ request.staticdirect('/js/autofilledin_password.js') }}"></script>
+ {{ super() }}
+ {% template_hook("fp_head") %}
 {% endblock %}
 
 {% block title -%}
-- 
cgit v1.2.3


From 229f0bd8fb69463876be274598224150c7aff387 Mon Sep 17 00:00:00 2001
From: Rodney Ewing <ewing.rj@gmail.com>
Date: Mon, 8 Jul 2013 17:34:18 -0700
Subject: fixed typo to check allow_registration not if auth is enabled

---
 mediagoblin/plugins/openid/views.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'mediagoblin/plugins')

diff --git a/mediagoblin/plugins/openid/views.py b/mediagoblin/plugins/openid/views.py
index b639a4cb..bb2de7ab 100644
--- a/mediagoblin/plugins/openid/views.py
+++ b/mediagoblin/plugins/openid/views.py
@@ -195,11 +195,11 @@ def finish_login(request):
             return redirect(request, "index")
     else:
         # No user, need to register
-        if not mg_globals.app.auth:
+        if not mg_globals.app_config['allow_registration']:
             messages.add_message(
                 request,
                 messages.WARNING,
-                _('Sorry, authentication is disabled on this instance.'))
+                _('Sorry, registration is disabled on this instance.'))
             return redirect(request, 'index')
 
         # Get email and nickname from response
-- 
cgit v1.2.3


From 581e52c26424e6db0d2ce430e8766e8a8c929586 Mon Sep 17 00:00:00 2001
From: Rodney Ewing <ewing.rj@gmail.com>
Date: Mon, 8 Jul 2013 17:34:52 -0700
Subject: deleted misplaced template

---
 .../plugins/basic_auth/verification.txt            | 29 ----------------------
 1 file changed, 29 deletions(-)
 delete mode 100644 mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/verification.txt

(limited to 'mediagoblin/plugins')

diff --git a/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/verification.txt b/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/verification.txt
deleted file mode 100644
index d53cd5e8..00000000
--- a/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/verification.txt
+++ /dev/null
@@ -1,29 +0,0 @@
-{#
-# GNU MediaGoblin -- federated, autonomous media hosting
-# Copyright (C) 2011, 2012 MediaGoblin contributors.  See AUTHORS.
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU Affero General Public License as published by
-# the Free Software Foundation, either version 3 of the License, or
-# (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU Affero General Public License for more details.
-#
-# You should have received a copy of the GNU Affero General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
--#}
-
-{% trans username=username, verification_url=verification_url|safe -%}
-Hi,
-
-We wanted to verify that you are {{ username }}. If this is the case, then 
-please follow the link below to verify your new email address.
-
-{{ verification_url }}
-
-If you are not {{ username }} or didn't request an email change, you can ignore
-this email.
-{%- endtrans %}
-- 
cgit v1.2.3


From f66e4282d481fbc97e9c38eb805232a0a2d21960 Mon Sep 17 00:00:00 2001
From: Rodney Ewing <ewing.rj@gmail.com>
Date: Tue, 9 Jul 2013 11:01:00 -0700
Subject: moved create account link on login page to a hook

---
 mediagoblin/plugins/basic_auth/__init__.py         |  4 +++-
 .../plugins/basic_auth/create_account_link.html    | 27 ++++++++++++++++++++++
 2 files changed, 30 insertions(+), 1 deletion(-)
 create mode 100644 mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/create_account_link.html

(limited to 'mediagoblin/plugins')

diff --git a/mediagoblin/plugins/basic_auth/__init__.py b/mediagoblin/plugins/basic_auth/__init__.py
index 06059a07..64564c7f 100644
--- a/mediagoblin/plugins/basic_auth/__init__.py
+++ b/mediagoblin/plugins/basic_auth/__init__.py
@@ -48,7 +48,9 @@ def setup_plugin():
     pluginapi.register_template_hooks(
         {'edit_link': 'mediagoblin/plugins/basic_auth/edit_link.html',
          'fp_link': 'mediagoblin/plugins/basic_auth/fp_link.html',
-         'fp_head': 'mediagoblin/plugins/basic_auth/fp_head.html'})
+         'fp_head': 'mediagoblin/plugins/basic_auth/fp_head.html',
+         'create_account':
+            'mediagoblin/plugins/basic_auth/create_account_link.html'})
 
 
 def get_user(**kwargs):
diff --git a/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/create_account_link.html b/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/create_account_link.html
new file mode 100644
index 00000000..7425630b
--- /dev/null
+++ b/mediagoblin/plugins/basic_auth/templates/mediagoblin/plugins/basic_auth/create_account_link.html
@@ -0,0 +1,27 @@
+{#
+# GNU MediaGoblin -- federated, autonomous media hosting
+# Copyright (C) 2011, 2012 MediaGoblin contributors.  See AUTHORS.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#}
+
+{% block create_account %}
+  {% if allow_registration %}
+    <p>
+      {% trans %}Don't have an account yet?{% endtrans %} 
+      <a href="{{ request.urlgen('mediagoblin.auth.register') }}">
+        {%- trans %}Create one here!{% endtrans %}</a>
+    </p>
+  {% endif %}
+{% endblock %}
-- 
cgit v1.2.3


From 33b5cebe750a8bc8a96401bd6cda729fa9b00a9d Mon Sep 17 00:00:00 2001
From: Rodney Ewing <ewing.rj@gmail.com>
Date: Tue, 9 Jul 2013 16:52:37 -0700
Subject: fixed some typos and missed imports

---
 mediagoblin/plugins/basic_auth/tools.py | 10 +++++++---
 mediagoblin/plugins/basic_auth/views.py |  2 +-
 2 files changed, 8 insertions(+), 4 deletions(-)

(limited to 'mediagoblin/plugins')

diff --git a/mediagoblin/plugins/basic_auth/tools.py b/mediagoblin/plugins/basic_auth/tools.py
index 97393976..f943bf39 100644
--- a/mediagoblin/plugins/basic_auth/tools.py
+++ b/mediagoblin/plugins/basic_auth/tools.py
@@ -16,6 +16,11 @@
 import bcrypt
 import random
 
+from mediagoblin import mg_globals
+from mediagoblin.tools.crypto import get_timed_signer_url
+from mediagoblin.tools.mail import send_email
+from mediagoblin.tools.template import render_template
+
 
 def bcrypt_check_password(raw_pass, stored_hash, extra_salt=None):
     """
@@ -101,10 +106,10 @@ def send_fp_verification_email(user, request):
             .dumps(user.id)
 
     rendered_email = render_template(
-        request, 'mediagoblin/auth/fp_verification_email.txt',
+        request, 'mediagoblin/plugins/basic_auth/fp_verification_email.txt',
         {'username': user.username,
          'verification_url': EMAIL_FP_VERIFICATION_TEMPLATE.format(
-             uri=request.urlgen('mediagoblin.auth.verify_forgot_password',
+             uri=request.urlgen('mediagoblin.plugins.basic_auth.verify_forgot_password',
                                 qualified=True),
              fp_verification_key=fp_verification_key)})
 
@@ -114,4 +119,3 @@ def send_fp_verification_email(user, request):
         [user.email],
         'GNU MediaGoblin - Change forgotten password!',
         rendered_email)
-
diff --git a/mediagoblin/plugins/basic_auth/views.py b/mediagoblin/plugins/basic_auth/views.py
index 9a1b75d2..d0941ae5 100644
--- a/mediagoblin/plugins/basic_auth/views.py
+++ b/mediagoblin/plugins/basic_auth/views.py
@@ -127,7 +127,7 @@ def verify_forgot_password(request):
     # check if user active and has email verified
     if user.email_verified and user.status == 'active':
 
-        cp_form = forms.ChangePassForm(formdata_vars)
+        cp_form = forms.ChangeForgotPassForm(formdata_vars)
 
         if request.method == 'POST' and cp_form.validate():
             user.pw_hash = tools.bcrypt_gen_password_hash(
-- 
cgit v1.2.3