mirror of
https://github.com/freedombox/FreedomBox.git
synced 2026-01-28 08:03:36 +00:00
99 lines
2.7 KiB
Python
99 lines
2.7 KiB
Python
from django.http.response import HttpResponseRedirect
|
|
import functools
|
|
from passlib.hash import bcrypt
|
|
from passlib.exc import PasswordSizeError
|
|
|
|
import cfg
|
|
from model import User
|
|
|
|
|
|
def add_user(username, passphrase, name='', email='', expert=False):
|
|
"""Add a new user with specified username and passphrase.
|
|
"""
|
|
error = None
|
|
if not username: error = "Must specify a username!"
|
|
if not passphrase: error = "Must specify a passphrase!"
|
|
|
|
if error is None:
|
|
if username in map(lambda x: x[0], cfg.users.get_all()):
|
|
error = "User already exists!"
|
|
else:
|
|
try:
|
|
pass_hash = bcrypt.encrypt(passphrase)
|
|
except PasswordSizeError:
|
|
error = "Password is too long."
|
|
|
|
if error is None:
|
|
di = {
|
|
'username':username,
|
|
'name':name,
|
|
'email':email,
|
|
'expert':'on' if expert else 'off',
|
|
'groups':['expert'] if expert else [],
|
|
'passphrase':pass_hash,
|
|
'salt':pass_hash[7:29], # for bcrypt
|
|
}
|
|
new_user = User(di)
|
|
cfg.users.set(username,new_user)
|
|
|
|
if error:
|
|
cfg.log(error)
|
|
return error
|
|
|
|
|
|
def check_credentials(username, passphrase):
|
|
"""Verifies credentials for username and passphrase.
|
|
|
|
Returns None on success or a string describing the error on failure.
|
|
|
|
Handles passwords up to 4096 bytes:
|
|
|
|
>>> len("A" * 4096)
|
|
4096
|
|
>>> len(u"u|2603" * 682)
|
|
4092
|
|
|
|
"""
|
|
if not username or not passphrase:
|
|
error = "No username or password."
|
|
cfg.log(error)
|
|
return error
|
|
|
|
bad_authentication = "Bad username or password."
|
|
hashed_password = None
|
|
|
|
if username not in cfg.users or 'passphrase' not in cfg.users[username]:
|
|
cfg.log(bad_authentication)
|
|
return bad_authentication
|
|
|
|
hashed_password = cfg.users[username]['passphrase']
|
|
|
|
try:
|
|
# time-dependent comparison when non-ASCII characters are used.
|
|
if not bcrypt.verify(passphrase, hashed_password):
|
|
error = bad_authentication
|
|
else:
|
|
error = None
|
|
except PasswordSizeError:
|
|
error = bad_authentication
|
|
|
|
if error:
|
|
cfg.log(error)
|
|
|
|
return error
|
|
|
|
|
|
# XXX: Only required until we start using Django authentication system properly
|
|
def login_required(func):
|
|
"""A decorator to ensure that user is logged in before accessing a view"""
|
|
@functools.wraps(func)
|
|
def wrapper(request, *args, **kwargs):
|
|
"""Check that user is logged in"""
|
|
if not request.session.get(cfg.session_key, None):
|
|
return HttpResponseRedirect(
|
|
cfg.server_dir + "/auth/login?from_page=%s" % request.path)
|
|
|
|
return func(request, *args, **kwargs)
|
|
|
|
return wrapper
|