From 2cf26ed42487e80ef0cf390c856bc8510c194bbd Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Thu, 9 Sep 2021 21:51:05 +0300 Subject: [PATCH 01/51] feat: Add registration page - Added a html template of the signup page - Added a href button to the signup page from the login page - Added the form of the signup to the backend and db --- lms/lmsweb/tools/registration.py | 32 +++++++++++++++++++++++++++++ lms/lmsweb/tools/validators.py | 16 +++++++++++++++ lms/lmsweb/views.py | 35 ++++++++++++++++++++++++++------ lms/static/my.css | 12 +++++++---- lms/templates/_formhelpers.html | 13 ++++++++++++ lms/templates/login.html | 8 +++++--- lms/templates/signup.html | 29 ++++++++++++++++++++++++++ requirements.txt | 1 + 8 files changed, 133 insertions(+), 13 deletions(-) create mode 100644 lms/lmsweb/tools/validators.py create mode 100644 lms/templates/_formhelpers.html create mode 100644 lms/templates/signup.html diff --git a/lms/lmsweb/tools/registration.py b/lms/lmsweb/tools/registration.py index e3ee2b50..c2228ff7 100644 --- a/lms/lmsweb/tools/registration.py +++ b/lms/lmsweb/tools/registration.py @@ -1,8 +1,14 @@ import csv +from lms.lmsweb.tools.validators import ( + UniqueEmailRequired, UniqueUsernameRequired, +) import os import typing from flask_babel import gettext as _ # type: ignore +from flask_wtf import FlaskForm +from wtforms import PasswordField, StringField +from wtforms.validators import Email, EqualTo, InputRequired, Length from lms.lmsdb import models from lms.lmsweb import config @@ -11,6 +17,32 @@ import requests +class RegisterForm(FlaskForm): + email = StringField( + 'Email', validators=[ + InputRequired(), Email(message=_('אימייל לא תקין')), + UniqueEmailRequired, Length(max=60), + ], + ) + username = StringField( + 'Username', validators=[ + InputRequired(), UniqueUsernameRequired, Length(min=4, max=20), + ], + ) + fullname = StringField( + 'Full Name', validators=[InputRequired(), Length(min=3, max=60)], + ) + password = PasswordField( + 'Password', validators=[InputRequired(), Length(min=8)], id='password', + ) + confirm = PasswordField( + 'Password Confirmation', validators=[ + InputRequired(), + EqualTo('password', message=_('הסיסמה שהוקלדה אינה זהה')), + ], + ) + + class UserToCreate(typing.NamedTuple): name: str email: str diff --git a/lms/lmsweb/tools/validators.py b/lms/lmsweb/tools/validators.py new file mode 100644 index 00000000..a3272dc3 --- /dev/null +++ b/lms/lmsweb/tools/validators.py @@ -0,0 +1,16 @@ +from flask_babel import gettext as _ # type: ignore +from wtforms.validators import ValidationError + +from lms.lmsdb.models import User + + +def UniqueUsernameRequired(form, field): + username_exists = User.get_or_none(User.username == field.data) + if username_exists: + raise ValidationError(_('שם המשתמש כבר נמצא בשימוש')) + + +def UniqueEmailRequired(form, field): + email_exists = User.get_or_none(User.mail_address == field.data) + if email_exists: + raise ValidationError(_('האימייל כבר נמצא בשימוש')) diff --git a/lms/lmsweb/views.py b/lms/lmsweb/views.py index ad1d188e..acd9d934 100644 --- a/lms/lmsweb/views.py +++ b/lms/lmsweb/views.py @@ -13,7 +13,7 @@ from werkzeug.utils import redirect from lms.lmsdb.models import ( - ALL_MODELS, Comment, Note, RoleOptions, SharedSolution, + ALL_MODELS, Comment, Note, Role, RoleOptions, SharedSolution, Solution, SolutionFile, User, database, ) from lms.lmsweb import babel, limiter, routes, webapp @@ -27,6 +27,7 @@ from lms.lmsweb.redirections import ( PERMISSIVE_CORS, get_next_url, login_manager, ) +from lms.lmsweb.tools.registration import RegisterForm from lms.models import ( comments, notes, notifications, share_link, solutions, upload, ) @@ -83,7 +84,7 @@ def ratelimit_handler(e): f'{LIMITS_PER_MINUTE}/minute;{LIMITS_PER_HOUR}/hour', deduct_when=lambda response: response.status_code != 200, ) -def login(login_error: Optional[str] = None): +def login(login_message: Optional[str] = None): if current_user.is_authenticated: return get_next_url(request.args.get('next')) @@ -91,7 +92,7 @@ def login(login_error: Optional[str] = None): username = request.form.get('username') password = request.form.get('password') next_page = request.form.get('next') - login_error = request.args.get('login_error') + login_message = request.args.get('login_message') user = User.get_or_none(username=username) if request.method == 'POST': @@ -99,11 +100,33 @@ def login(login_error: Optional[str] = None): login_user(user) return get_next_url(next_page) elif user is None or not user.is_password_valid(password): - login_error = 'Invalid username or password' - error_details = {'next': next_page, 'login_error': login_error} + login_message = 'Invalid username or password' + error_details = {'next': next_page, 'login_message': login_message} return redirect(url_for('login', **error_details)) - return render_template('login.html', login_error=login_error) + return render_template('login.html', login_message=login_message) + + +@webapp.route('/signup', methods=['GET', 'POST']) +def signup(): + form = RegisterForm() + + if form.validate_on_submit(): + User.get_or_create(**{ + User.mail_address.name: form.email.data, + User.username.name: form.username.data, + }, defaults={ + User.fullname.name: form.fullname.data, + User.role.name: Role.get_student_role(), + User.password.name: form.password.data, + User.api_key.name: User.random_password(), + }) + + return redirect(url_for( + 'login', login_message='Registration Successfully', + )) + + return render_template('signup.html', form=form) @webapp.route('/logout') diff --git a/lms/static/my.css b/lms/static/my.css index 8380ae18..4e9cd078 100644 --- a/lms/static/my.css +++ b/lms/static/my.css @@ -46,25 +46,29 @@ a { text-align: right; } -#login-container { +#login-container, +#signup-container { height: 100%; align-items: center; display: flex; align-self: center; } -#login { +#login, +#signup { margin: auto; max-width: 420px; padding: 15px; width: 100%; } -#login-logo { +#login-logo, +#signup-logo { margin-bottom: 1rem; } -#login-messege-box { +#login-message-box, +#signup-errors { background: #f1c8c8; color: #860606; } diff --git a/lms/templates/_formhelpers.html b/lms/templates/_formhelpers.html new file mode 100644 index 00000000..4175e804 --- /dev/null +++ b/lms/templates/_formhelpers.html @@ -0,0 +1,13 @@ +{% macro render_field(field, cls) %} +
+ + {{ field(class=cls, **kwargs) | safe }} +
+ {% if field.errors %} + {% for error in field.errors %} + {{ error }} + {% endfor %} + {% endif %} +
+
+{% endmacro %} diff --git a/lms/templates/login.html b/lms/templates/login.html index 3fb5515e..87b13f27 100644 --- a/lms/templates/login.html +++ b/lms/templates/login.html @@ -10,10 +10,10 @@

{{ _('התחברות') }}

{{ _('ברוכים הבאים למערכת התרגילים!') }}
{{ _('הזינו את שם המשתמש והסיסמה שלכם:') }}

- {% if login_error %} -
+ {% if login_message %} +

- {{ login_error }} + {{ login_message }}

{% endif %} @@ -34,6 +34,8 @@

{{ _('התחברות') }}

+
+ {{ _('הרשם') }}
diff --git a/lms/templates/signup.html b/lms/templates/signup.html new file mode 100644 index 00000000..72e5c413 --- /dev/null +++ b/lms/templates/signup.html @@ -0,0 +1,29 @@ +{% extends 'base.html' %} +{% from "_formhelpers.html" import render_field %} + +{% block page_content %} +
+
+
+ +

{{ _('הרשמה') }}

+

+ {{ _('ברוכים הבאים למערכת התרגילים!') }}
+ {{ _('הזינו אימייל וסיסמה לצורך רישום למערכת:') }} +

+
+ {{ render_field(form.email, cls="form-control form-control-lg", placeholder="Email Address") }} + {{ render_field(form.username, cls="form-control form-control-lg", placeholder="User Name") }} + {{ render_field(form.fullname, cls="form-control form-control-lg", placeholder="Full Name") }} + {{ render_field(form.password, cls="form-control form-control-lg", placeholder="Password") }} + {{ render_field(form.confirm, cls="form-control form-control-lg", placeholder="Password Verification") }} + + + +
+
+ {{ _('חזרה לדף ההתחברות') }} +
+
+
+{% endblock %} diff --git a/requirements.txt b/requirements.txt index 86f6b8c7..a90ba429 100644 --- a/requirements.txt +++ b/requirements.txt @@ -19,6 +19,7 @@ debugpy==1.0.0rc2 decorator==4.4.2 diff-cover==2.6.1 docker-pycreds==0.4.0 +email-validator==1.1.3 entrypoints==0.3 eradicate==1.0 flake8-alfred==1.1.1 From 3913a5e92860738dfb00cc742a7f09e9b6356ed3 Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Fri, 10 Sep 2021 19:20:50 +0300 Subject: [PATCH 02/51] feat: Add registration page - Added confirmation email system - Added some tests --- lms/lmsdb/models.py | 10 +++++ lms/lmsweb/__init__.py | 3 ++ lms/lmsweb/config.py.example | 8 ++++ lms/lmsweb/tools/registration.py | 25 ++++++++++- lms/lmsweb/views.py | 60 +++++++++++++++++++++++---- lms/templates/login.html | 2 +- requirements.txt | 5 ++- tests/conftest.py | 9 ++++ tests/samples/config.py.example | 2 + tests/samples/config_copy.py | 2 + tests/test_login.py | 11 +++++ tests/test_registration.py | 71 ++++++++++++++++++++++++++++++++ tests/test_users.py | 2 +- 13 files changed, 197 insertions(+), 13 deletions(-) create mode 100644 tests/test_registration.py diff --git a/lms/lmsdb/models.py b/lms/lmsdb/models.py index 8fd5b812..c5f5d11b 100644 --- a/lms/lmsdb/models.py +++ b/lms/lmsdb/models.py @@ -34,6 +34,7 @@ class RoleOptions(enum.Enum): BANNED = 'Banned' + NOT_CONFIRMED = 'Not_Confirmed' STUDENT = 'Student' STAFF = 'Staff' VIEWER = 'Viewer' @@ -67,6 +68,7 @@ class Role(BaseModel): (RoleOptions.STAFF.value, RoleOptions.STAFF.value), (RoleOptions.VIEWER.value, RoleOptions.VIEWER.value), (RoleOptions.STUDENT.value, RoleOptions.STUDENT.value), + (RoleOptions.NOT_CONFIRMED.value, RoleOptions.NOT_CONFIRMED.value), (RoleOptions.BANNED.value, RoleOptions.BANNED.value), )) @@ -77,6 +79,10 @@ def __str__(self): def get_banned_role(cls) -> 'Role': return cls.get(Role.name == RoleOptions.BANNED.value) + @classmethod + def get_not_confirmed_role(cls) -> 'Role': + return cls.get(Role.name == RoleOptions.NOT_CONFIRMED.value) + @classmethod def get_student_role(cls) -> 'Role': return cls.get(Role.name == RoleOptions.STUDENT.value) @@ -100,6 +106,10 @@ def by_name(cls, name) -> 'Role': def is_banned(self) -> bool: return self.name == RoleOptions.BANNED.value + @property + def is_not_confirmed(self) -> bool: + return self.name == RoleOptions.NOT_CONFIRMED.value + @property def is_student(self) -> bool: return self.name == RoleOptions.STUDENT.value diff --git a/lms/lmsweb/__init__.py b/lms/lmsweb/__init__.py index 5f3a5347..ec48f2ae 100644 --- a/lms/lmsweb/__init__.py +++ b/lms/lmsweb/__init__.py @@ -5,6 +5,7 @@ from flask_babel import Babel # type: ignore from flask_limiter import Limiter # type: ignore from flask_limiter.util import get_remote_address # type: ignore +from flask_mail import Mail # type: ignore from flask_wtf.csrf import CSRFProtect # type: ignore from lms.utils import config_migrator, debug @@ -41,6 +42,8 @@ # Localizing configurations babel = Babel(webapp) +webmail = Mail(webapp) + # Must import files after app's creation from lms.lmsdb import models # NOQA: F401, E402, I202 diff --git a/lms/lmsweb/config.py.example b/lms/lmsweb/config.py.example index 0bf3aca7..d0d64764 100644 --- a/lms/lmsweb/config.py.example +++ b/lms/lmsweb/config.py.example @@ -9,6 +9,14 @@ MAILGUN_API_KEY = os.getenv('MAILGUN_API_KEY') MAILGUN_DOMAIN = os.getenv('MAILGUN_DOMAIN', 'mail.pythonic.guru') SERVER_ADDRESS = os.getenv('SERVER_ADDRESS', '127.0.0.1:5000') +# MAIL CONFIGURATION +MAIL_SERVER = 'smtp.gmail.com' +MAIL_PORT = 465 +MAIL_USE_SSL = True +MAIL_USE_TLS = False +MAIL_USERNAME = 'username@gmail.com' +MAIL_PASSWORD = 'password' + # SESSION_COOKIE_SECURE = True SESSION_COOKIE_HTTPONLY = True SESSION_COOKIE_SAMESITE = 'Lax' diff --git a/lms/lmsweb/tools/registration.py b/lms/lmsweb/tools/registration.py index c2228ff7..c65aeeec 100644 --- a/lms/lmsweb/tools/registration.py +++ b/lms/lmsweb/tools/registration.py @@ -5,18 +5,24 @@ import os import typing +from flask import url_for from flask_babel import gettext as _ # type: ignore +from flask_mail import Message # type: ignore from flask_wtf import FlaskForm +from itsdangerous import URLSafeTimedSerializer from wtforms import PasswordField, StringField from wtforms.validators import Email, EqualTo, InputRequired, Length from lms.lmsdb import models -from lms.lmsweb import config +from lms.lmsweb import config, webmail from lms.utils.log import log import requests +SERIALIZER = URLSafeTimedSerializer(config.SECRET_KEY) + + class RegisterForm(FlaskForm): email = StringField( 'Email', validators=[ @@ -38,7 +44,7 @@ class RegisterForm(FlaskForm): confirm = PasswordField( 'Password Confirmation', validators=[ InputRequired(), - EqualTo('password', message=_('הסיסמה שהוקלדה אינה זהה')), + EqualTo('password', message=_('הסיסמאות שהוקלדו אינן זהות')), ], ) @@ -161,6 +167,21 @@ def _build_user_text(user: UserToCreate) -> str: return msg +def generate_confirmation_token(email: str) -> str: + return SERIALIZER.dumps(email, salt='email-confirmation') + + +def send_confirmation_mail(email: str, fullname: str) -> None: + token = generate_confirmation_token(email) + msg = Message( + 'Confirmation Email - Learn Python', + sender=f'lms@{config.MAILGUN_DOMAIN}', recipients=[email], + ) + link = url_for('confirm_email', token=token, _external=True) + msg.body = f'Hey {fullname},\nYour confirmation link is: {link}' + webmail.send(msg) + + if __name__ == '__main__': registration = UserRegistrationCreator.from_csv_file(config.USERS_CSV) print(registration.users_to_create) # noqa: T001 diff --git a/lms/lmsweb/views.py b/lms/lmsweb/views.py index acd9d934..41d255e6 100644 --- a/lms/lmsweb/views.py +++ b/lms/lmsweb/views.py @@ -5,10 +5,12 @@ jsonify, make_response, render_template, request, send_from_directory, url_for, ) +from flask_babel import gettext as _ # type: ignore from flask_limiter.util import get_remote_address # type: ignore from flask_login import ( # type: ignore current_user, login_required, login_user, logout_user, ) +from itsdangerous import BadSignature, BadTimeSignature, SignatureExpired from werkzeug.datastructures import FileStorage from werkzeug.utils import redirect @@ -27,7 +29,9 @@ from lms.lmsweb.redirections import ( PERMISSIVE_CORS, get_next_url, login_manager, ) -from lms.lmsweb.tools.registration import RegisterForm +from lms.lmsweb.tools.registration import ( + RegisterForm, SERIALIZER, send_confirmation_mail, +) from lms.models import ( comments, notes, notifications, share_link, solutions, upload, ) @@ -96,11 +100,19 @@ def login(login_message: Optional[str] = None): user = User.get_or_none(username=username) if request.method == 'POST': - if user is not None and user.is_password_valid(password): + if ( + user is not None and user.is_password_valid(password) + and not user.role.is_not_confirmed + ): login_user(user) return get_next_url(next_page) - elif user is None or not user.is_password_valid(password): - login_message = 'Invalid username or password' + elif ( + user is None or not user.is_password_valid(password) + or user.role.is_not_confirmed + ): + login_message = _('שם המשתמש או הסיסמה שהוזנו לא תקינים') + if user is not None and user.role.is_not_confirmed: + login_message = _('עליך לאשר את המייל') error_details = {'next': next_page, 'login_message': login_message} return redirect(url_for('login', **error_details)) @@ -110,25 +122,59 @@ def login(login_message: Optional[str] = None): @webapp.route('/signup', methods=['GET', 'POST']) def signup(): form = RegisterForm() - if form.validate_on_submit(): User.get_or_create(**{ User.mail_address.name: form.email.data, User.username.name: form.username.data, }, defaults={ User.fullname.name: form.fullname.data, - User.role.name: Role.get_student_role(), + User.role.name: Role.get_not_confirmed_role(), User.password.name: form.password.data, User.api_key.name: User.random_password(), }) + send_confirmation_mail(form.email.data, form.fullname.data) + return redirect(url_for( - 'login', login_message='Registration Successfully', + 'login', login_message=_('ההרשמה בוצעה בהצלחה'), )) return render_template('signup.html', form=form) +@webapp.route('/confirm-email/') +def confirm_email(token: str): + try: + email = SERIALIZER.loads( + token, salt='email-confirmation', max_age=3600, + ) + user = User.get_or_none(User.mail_address == email) + if user is None: + return fail(404, f'No such user with email {email}.') + if not user.role.is_not_confirmed: + return fail( + 403, f'User has been already confirmed {user.username}', + ) + update = User.update( + role=Role.get_student_role(), + ).where(User.username == user.username) + update.execute() + + return redirect(url_for( + 'login', login_message=( + _('המשתמש שלך אומת בהצלחה, כעת הינך יכול להתחבר למערכת'), + ), + )) + except SignatureExpired: + return redirect(url_for( + 'login', login_message=( + _('קישור האימות פג תוקף, קישור חדש נשלח אל תיבת המייל שלך'), + ), + )) + except (BadSignature, BadTimeSignature): + return fail(404, 'No such signature') + + @webapp.route('/logout') @login_required def logout(): diff --git a/lms/templates/login.html b/lms/templates/login.html index 87b13f27..b1dde490 100644 --- a/lms/templates/login.html +++ b/lms/templates/login.html @@ -35,7 +35,7 @@

{{ _('התחברות') }}

- {{ _('הרשם') }} + {{ _('הירשם') }} diff --git a/requirements.txt b/requirements.txt index a90ba429..baa16b76 100644 --- a/requirements.txt +++ b/requirements.txt @@ -42,7 +42,8 @@ flake8==3.8.3 Flask-Admin==1.5.6 Flask-Babel==2.0.0 Flask-Limiter==1.4 -git+git://github.com/maxcountryman/flask-login@e3d8079#egg=flask-login +Flask-Login==0.5.0 +Flask-Mail==0.9.1 Flask-WTF==0.14.3 Flask==1.1.2 future==0.18.2 @@ -56,7 +57,7 @@ ipykernel==5.3.4 ipython-genutils==0.2.0 ipython==7.18.1 ipywidgets==7.5.1 -itsdangerous==1.1.0 +itsdangerous==2.0.1 jedi==0.17.2 jinja2-pluralize==0.3.0 Jinja2==2.11.3 diff --git a/tests/conftest.py b/tests/conftest.py index 226209dc..b9c7bfaa 100644 --- a/tests/conftest.py +++ b/tests/conftest.py @@ -118,6 +118,10 @@ def create_banned_user(index: int = 0) -> User: return create_user(RoleOptions.BANNED.value, index) +def create_not_confirmed_user(index: int = 0) -> User: + return create_user(RoleOptions.NOT_CONFIRMED.value, index) + + def create_student_user(index: int = 0) -> User: return create_user(RoleOptions.STUDENT.value, index) @@ -141,6 +145,11 @@ def staff_user(staff_password): return create_staff_user() +@pytest.fixture() +def not_confirmed_user(): + return create_not_confirmed_user() + + @pytest.fixture() def student_user(): return create_student_user() diff --git a/tests/samples/config.py.example b/tests/samples/config.py.example index dde2b013..f72fe745 100644 --- a/tests/samples/config.py.example +++ b/tests/samples/config.py.example @@ -13,6 +13,8 @@ FEATURE_FLAG_CHECK_IDENTICAL_CODE_ON = os.getenv( 'FEATURE_FLAG_CHECK_IDENTICAL_CODE_ON', False, ) +TESTING = True + MAIL_WELCOME_MESSAGE = 'welcome-email' USERS_CSV = 'users.csv' diff --git a/tests/samples/config_copy.py b/tests/samples/config_copy.py index 0d2d93ce..ca2f0573 100644 --- a/tests/samples/config_copy.py +++ b/tests/samples/config_copy.py @@ -11,6 +11,8 @@ 'FEATURE_FLAG_CHECK_IDENTICAL_CODE_ON', False, ) +TESTING = True + USERS_CSV = 'users.csv' diff --git a/tests/test_login.py b/tests/test_login.py index f44edc45..fe5165d7 100644 --- a/tests/test_login.py +++ b/tests/test_login.py @@ -23,6 +23,17 @@ def test_login_username_fail(student_user: User): fail_login_response = client.get('/exercises') assert fail_login_response.status_code == 302 + @staticmethod + def test_login_not_confirmed_user(not_confirmed_user: User): + client = webapp.test_client() + login_response = client.post('/login', data={ + 'username': not_confirmed_user.username, + 'password': 'fake pass', + }, follow_redirects=True) + assert login_response.request.path == '/login' + fail_login_response = client.get('/exercises') + assert fail_login_response.status_code == 302 + @staticmethod def test_login_success(student_user: User): client = webapp.test_client() diff --git a/tests/test_registration.py b/tests/test_registration.py new file mode 100644 index 00000000..86009b60 --- /dev/null +++ b/tests/test_registration.py @@ -0,0 +1,71 @@ +from lms.lmsweb.tools.registration import generate_confirmation_token +from lms.lmsdb.models import User +from lms.lmsweb import webapp + + +class TestRegistration: + @staticmethod + def test_invalid_username(student_user: User): + client = webapp.test_client() + response = client.post('/signup', data={ + 'email': 'some_name@mail.com', + 'username': student_user.username, + 'fullname': 'some_name', + 'password': 'some_password', + 'confirm': 'some_password', + }, follow_redirects=True) + assert response.request.path == '/signup' + + client.post('/login', data={ + 'username': student_user.username, + 'password': 'some_password', + }, follow_redirects=True) + fail_login_response = client.get('/exercises') + assert fail_login_response.status_code == 302 + + @staticmethod + def test_invalid_email(student_user: User): + client = webapp.test_client() + response = client.post('/signup', data={ + 'email': student_user.mail_address, + 'username': 'some_user', + 'fullname': 'some_name', + 'password': 'some_password', + 'confirm': 'some_password', + }, follow_redirects=True) + assert response.request.path == '/signup' + + client.post('/login', data={ + 'username': 'some_user', + 'password': 'some_password', + }, follow_redirects=True) + fail_login_response = client.get('/exercises') + assert fail_login_response.status_code == 302 + + @staticmethod + def test_successful_registration(): + client = webapp.test_client() + response = client.post('/signup', data={ + 'email': 'some_user123@mail.com', + 'username': 'some_user', + 'fullname': 'some_name', + 'password': 'some_password', + 'confirm': 'some_password', + }, follow_redirects=True) + assert response.request.path == '/login' + + client.post('/login', data={ + 'username': 'some_user', + 'password': 'some_password', + }, follow_redirects=True) + fail_login_response = client.get('/exercises') + assert fail_login_response.status_code == 302 + + token = generate_confirmation_token('some_user123@mail.com') + client.get(f'/confirm-email/{token}', follow_redirects=True) + client.post('/login', data={ + 'username': 'some_user', + 'password': 'some_password', + }, follow_redirects=True) + fail_login_response = client.get('/exercises') + assert fail_login_response.status_code == 200 diff --git a/tests/test_users.py b/tests/test_users.py index 8adb55b4..06210ab1 100644 --- a/tests/test_users.py +++ b/tests/test_users.py @@ -62,7 +62,7 @@ def test_logout(student_user: User): @staticmethod def test_banned_user(banned_user: User): - client = client = webapp.test_client() + client = webapp.test_client() login_response = client.post('/login', data={ 'username': banned_user.username, 'password': 'fake pass', From d206c6a67e4482aa70e99dc11d1cef707269d444 Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Fri, 10 Sep 2021 19:24:56 +0300 Subject: [PATCH 03/51] Fixed sourcey-ai issues --- lms/lmsdb/models.py | 3 +-- lms/lmsweb/views.py | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/lms/lmsdb/models.py b/lms/lmsdb/models.py index c5f5d11b..9d252d1a 100644 --- a/lms/lmsdb/models.py +++ b/lms/lmsdb/models.py @@ -417,8 +417,7 @@ def set_state(self, new_state: SolutionState, **kwargs) -> bool: **{Solution.state.name: new_state.name}, **kwargs, ).where(requested_solution) - updated = changes.execute() == 1 - return updated + return changes.execute() == 1 def ordered_versions(self) -> Iterable['Solution']: return Solution.select().where( diff --git a/lms/lmsweb/views.py b/lms/lmsweb/views.py index 41d255e6..f79dcdff 100644 --- a/lms/lmsweb/views.py +++ b/lms/lmsweb/views.py @@ -171,7 +171,7 @@ def confirm_email(token: str): _('קישור האימות פג תוקף, קישור חדש נשלח אל תיבת המייל שלך'), ), )) - except (BadSignature, BadTimeSignature): + except BadSignature: return fail(404, 'No such signature') From 6ad4d4d05af4b2d98bfe04209c9ba099cc6ec952 Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Fri, 10 Sep 2021 19:34:04 +0300 Subject: [PATCH 04/51] fixed resend email confirmation --- lms/lmsweb/views.py | 1 + 1 file changed, 1 insertion(+) diff --git a/lms/lmsweb/views.py b/lms/lmsweb/views.py index f79dcdff..0fd92aa7 100644 --- a/lms/lmsweb/views.py +++ b/lms/lmsweb/views.py @@ -166,6 +166,7 @@ def confirm_email(token: str): ), )) except SignatureExpired: + send_confirmation_mail(email, user.fullname) return redirect(url_for( 'login', login_message=( _('קישור האימות פג תוקף, קישור חדש נשלח אל תיבת המייל שלך'), From 6b137afe63b6642ecbbed0fc7e27f9da59166ebb Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Sat, 11 Sep 2021 09:18:39 +0300 Subject: [PATCH 05/51] Added translations --- .../translations/en/LC_MESSAGES/messages.po | 94 ++++++++++++++----- 1 file changed, 72 insertions(+), 22 deletions(-) diff --git a/lms/lmsweb/translations/en/LC_MESSAGES/messages.po b/lms/lmsweb/translations/en/LC_MESSAGES/messages.po index 5b5f12e3..06015a55 100644 --- a/lms/lmsweb/translations/en/LC_MESSAGES/messages.po +++ b/lms/lmsweb/translations/en/LC_MESSAGES/messages.po @@ -7,7 +7,7 @@ msgid "" msgstr "" "Project-Id-Version: lmsweb-1.0\n" "Report-Msgid-Bugs-To: bugs@mesicka.com\n" -"POT-Creation-Date: 2020-10-09 11:20+0300\n" +"POT-Creation-Date: 2021-09-11 09:07+0300\n" "PO-Revision-Date: 2020-09-16 18:29+0300\n" "Last-Translator: Or Ronai\n" "Language: en\n" @@ -16,9 +16,9 @@ msgstr "" "MIME-Version: 1.0\n" "Content-Type: text/plain; charset=utf-8\n" "Content-Transfer-Encoding: 8bit\n" -"Generated-By: Babel 2.8.0\n" +"Generated-By: Babel 2.9.1\n" -#: lmsdb/models.py:632 +#: lmsdb/models.py:698 msgid "כישלון חמור" msgstr "Fatal error" @@ -45,26 +45,63 @@ msgstr "The automatic checker couldn't run your code." msgid "אחי, בדקת את הקוד שלך?" msgstr "Bro, did you check your code?" -#: lmsweb/tools/registration.py:105 +#: lmsweb/views.py:113 +#, fuzzy +msgid "שם המשתמש או הסיסמה שהוזנו לא תקינים" +msgstr "Invalid username or password" + +#: lmsweb/views.py:115 +msgid "עליך לאשר את המייל" +msgstr "You have to confirm your registration with the link sent to your email" + +#: lmsweb/views.py:139 +msgid "ההרשמה בוצעה בהצלחה" +msgstr "Registration successfully" + +#: lmsweb/views.py:165 +msgid "המשתמש שלך אומת בהצלחה, כעת הינך יכול להתחבר למערכת" +msgstr "Your user has been successfully confirmed, you can now login" + +#: lmsweb/views.py:172 +msgid "קישור האימות פג תוקף, קישור חדש נשלח אל תיבת המייל שלך" +msgstr "The confirmation link is expired, new link has been sent to your email" + +#: lmsweb/tools/registration.py:29 +msgid "אימייל לא תקין" +msgstr "Invalid email" + +#: lmsweb/tools/registration.py:47 +msgid "הסיסמאות שהוקלדו אינן זהות" +msgstr "The passwords are not identical" + +#: lmsweb/tools/registration.py:143 msgid "מערכת הגשת התרגילים" msgstr "Exercuse submission system" -#: models/solutions.py:46 +#: lmsweb/tools/validators.py:10 +msgid "שם המשתמש כבר נמצא בשימוש" +msgstr "The username already in use" + +#: lmsweb/tools/validators.py:16 +msgid "האימייל כבר נמצא בשימוש" +msgstr "The email already in use" + +#: models/solutions.py:50 #, python-format msgid "%(solver)s הגיב לך על בדיקת תרגיל \"%(subject)s\"." msgstr "%(solver)s has replied for your \"%(subject)s\" check." -#: models/solutions.py:53 +#: models/solutions.py:57 #, python-format msgid "%(checker)s הגיב לך על תרגיל \"%(subject)s\"." msgstr "%(checker)s replied for \"%(subject)s\"." -#: models/solutions.py:65 +#: models/solutions.py:69 #, python-format msgid "הפתרון שלך לתרגיל \"%(subject)s\" נבדק." msgstr "Your solution for the \"%(subject)s\" exercise has been checked." -#: templates/banned.html:8 templates/login.html:7 +#: templates/banned.html:8 templates/login.html:7 templates/signup.html:8 msgid "תמונת הפרופיל של קורס פייתון" msgstr "Profile picture of the Python Course" @@ -84,7 +121,7 @@ msgstr "Exercise submission system for the Python Course" msgid "תרגילים" msgstr "Exercises" -#: templates/exercises.html:21 +#: templates/exercises.html:21 templates/view.html:101 msgid "הערות על התרגיל" msgstr "Comments for the solution" @@ -108,7 +145,7 @@ msgstr "All Exercises" msgid "התחברות" msgstr "Login" -#: templates/login.html:10 +#: templates/login.html:10 templates/signup.html:11 msgid "ברוכים הבאים למערכת התרגילים!" msgstr "Welcome to the exercise system!" @@ -116,18 +153,22 @@ msgstr "Welcome to the exercise system!" msgid "הזינו את שם המשתמש והסיסמה שלכם:" msgstr "Insert your username and password:" -#: templates/login.html:15 templates/login.html:17 +#: templates/login.html:22 templates/login.html:24 msgid "שם משתמש" msgstr "Username" -#: templates/login.html:21 templates/login.html:23 +#: templates/login.html:28 templates/login.html:30 msgid "סיסמה" msgstr "Password" -#: templates/login.html:28 +#: templates/login.html:35 msgid "התחבר" msgstr "Login" +#: templates/login.html:38 templates/signup.html:22 +msgid "הירשם" +msgstr "Register" + #: templates/navbar.html:8 msgid "הלוגו של פרויקט לומדים פייתון: נחש צהוב על רקע עיגול בצבע תכלת, ומתחתיו כתוב - לומדים פייתון." msgstr "The logo of the Learning Python project: yellow snake on light blue circle background and behind of it written - Learning Python" @@ -164,6 +205,19 @@ msgstr "Check Exercises" msgid "התנתקות" msgstr "Logout" +#: templates/signup.html:9 +#, fuzzy +msgid "הרשמה" +msgstr "Registration" + +#: templates/signup.html:12 +msgid "הזינו אימייל וסיסמה לצורך רישום למערכת:" +msgstr "Insert your email and password for registration:" + +#: templates/signup.html:25 +msgid "חזרה לדף ההתחברות" +msgstr "Back to login page" + #: templates/status.html:7 msgid "חמ\"ל תרגילים" msgstr "Exercises operations room" @@ -256,23 +310,23 @@ msgstr "Submitted" msgid "לא הוגש" msgstr "Not submitted" -#: templates/user.html:43 +#: templates/user.html:44 msgid "פתקיות:" msgstr "Notes:" -#: templates/user.html:60 templates/user.html:62 +#: templates/user.html:49 templates/user.html:51 msgid "פתקית חדשה" msgstr "New Note" -#: templates/user.html:66 +#: templates/user.html:55 msgid "תרגיל משויך:" msgstr "Exercise:" -#: templates/user.html:75 +#: templates/user.html:64 msgid "רמת פרטיות:" msgstr "Privacy Level:" -#: templates/user.html:81 +#: templates/user.html:70 msgid "הוסף פתקית" msgstr "Add Note" @@ -332,10 +386,6 @@ msgstr "Error:" msgid "שגיאת סגל:" msgstr "Staff Error:" -#: templates/view.html:101 -msgid "הערות על התרגיל" -msgstr "Comments for the exercise" - #: templates/view.html:109 msgid "הערות כלליות" msgstr "General comments" From 3798a2d3d2460b8820d2766b2f202d84c57a8f7a Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Sat, 11 Sep 2021 09:23:42 +0300 Subject: [PATCH 06/51] Removed unused module --- lms/lmsweb/views.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lms/lmsweb/views.py b/lms/lmsweb/views.py index 0fd92aa7..f54ade2c 100644 --- a/lms/lmsweb/views.py +++ b/lms/lmsweb/views.py @@ -10,7 +10,7 @@ from flask_login import ( # type: ignore current_user, login_required, login_user, logout_user, ) -from itsdangerous import BadSignature, BadTimeSignature, SignatureExpired +from itsdangerous import BadSignature, SignatureExpired from werkzeug.datastructures import FileStorage from werkzeug.utils import redirect From 1377e9ae9d5e3cec4eaaf2782b4ca2e0ca86a391 Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Sat, 11 Sep 2021 09:44:17 +0300 Subject: [PATCH 07/51] Changed versions of requirements --- requirements.txt | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/requirements.txt b/requirements.txt index baa16b76..105f584a 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,22 +1,22 @@ -amqp==5.0.1 +amqp==5.0.6 arrow==0.16.0 atomicwrites==1.4.0 -attrs==20.2.0 -Babel==2.8.0 +attrs==21.2.0 +Babel==2.9.1 backcall==0.2.0 bandit==1.6.2 bench-it==1.0.1 -billiard==3.6.3.0 -celery==5.0.0 -certifi==2020.6.20 -chardet==3.0.4 +billiard==3.6.4.0 +celery==5.1.2 +certifi==2021.5.30 +chardet==4.0.0 click-didyoumean==0.0.3 -click-repl==0.1.6 +click-repl==0.2.0 click==7.1.2 -colorama==0.4.3 -configparser==5.0.0 +colorama==0.4.4 +configparser==5.0.2 debugpy==1.0.0rc2 -decorator==4.4.2 +decorator==5.0.9 diff-cover==2.6.1 docker-pycreds==0.4.0 email-validator==1.1.3 @@ -44,8 +44,8 @@ Flask-Babel==2.0.0 Flask-Limiter==1.4 Flask-Login==0.5.0 Flask-Mail==0.9.1 -Flask-WTF==0.14.3 -Flask==1.1.2 +Flask-WTF==0.15.1 +Flask==2.0.1 future==0.18.2 gitdb==4.0.5 GitPython==3.1.8 From 93da8605052113e980d350c72eec2fa418b342b7 Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Sat, 11 Sep 2021 09:46:41 +0300 Subject: [PATCH 08/51] Changed versions of requirements --- requirements.txt | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/requirements.txt b/requirements.txt index 105f584a..f8ea7d31 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,22 +1,22 @@ -amqp==5.0.6 +amqp==5.0.1 arrow==0.16.0 atomicwrites==1.4.0 -attrs==21.2.0 -Babel==2.9.1 +attrs==20.2.0 +Babel==2.8.0 backcall==0.2.0 bandit==1.6.2 bench-it==1.0.1 -billiard==3.6.4.0 -celery==5.1.2 -certifi==2021.5.30 -chardet==4.0.0 +billiard==3.6.3.0 +celery==5.0.0 +certifi==2020.6.20 +chardet==3.0.4 click-didyoumean==0.0.3 -click-repl==0.2.0 +click-repl==0.1.6 click==7.1.2 -colorama==0.4.4 -configparser==5.0.2 +colorama==0.4.3 +configparser==5.0.0 debugpy==1.0.0rc2 -decorator==5.0.9 +decorator==4.4.2 diff-cover==2.6.1 docker-pycreds==0.4.0 email-validator==1.1.3 From ec523001f6962c1b090735df0df928d74d0c47ae Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Sat, 11 Sep 2021 09:50:21 +0300 Subject: [PATCH 09/51] Changed versions of requirements --- requirements.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/requirements.txt b/requirements.txt index f8ea7d31..10c2cbb6 100644 --- a/requirements.txt +++ b/requirements.txt @@ -60,14 +60,14 @@ ipywidgets==7.5.1 itsdangerous==2.0.1 jedi==0.17.2 jinja2-pluralize==0.3.0 -Jinja2==2.11.3 +Jinja2==3.0.1 junitparser==1.4.1 jupyter-client==6.1.7 jupyter-console==6.2.0 jupyter-core==4.6.3 jupyter==1.0.0 jupyterlab-pygments==0.1.2 -kombu==5.0.2 +kombu==5.1.0 loguru==0.5.3 MarkupSafe==1.1.1 mccabe==0.6.1 From 4e47d57608f5e6ee9e17bc1a5a50af243479b9ea Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Sat, 11 Sep 2021 09:51:51 +0300 Subject: [PATCH 10/51] Changed versions of requirements --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 10c2cbb6..7a930b68 100644 --- a/requirements.txt +++ b/requirements.txt @@ -117,7 +117,7 @@ typing-extensions==3.7.4.3 urllib3==1.25.10 vine==5.0.0 wcwidth==0.2.5 -Werkzeug==1.0.1 +Werkzeug==2.0.1 wtf-peewee==3.0.2 WTForms==2.3.3 zipp==3.2.0 From 8d08863e856048417369320d74f1ddf6efc6d599 Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Sat, 11 Sep 2021 09:53:38 +0300 Subject: [PATCH 11/51] Changed versions of requirements --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 7a930b68..26c1b856 100644 --- a/requirements.txt +++ b/requirements.txt @@ -69,7 +69,7 @@ jupyter==1.0.0 jupyterlab-pygments==0.1.2 kombu==5.1.0 loguru==0.5.3 -MarkupSafe==1.1.1 +MarkupSafe==2.0.1 mccabe==0.6.1 more-itertools==8.5.0 mypy-extensions==0.4.3 From 366b53fd73a132170401ace1780d712dafbd867f Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Sat, 11 Sep 2021 10:10:41 +0300 Subject: [PATCH 12/51] Changed versions of requirements --- requirements.txt | 94 ++++++++++++++++++++++++------------------------ 1 file changed, 47 insertions(+), 47 deletions(-) diff --git a/requirements.txt b/requirements.txt index 26c1b856..874804e1 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,22 +1,22 @@ -amqp==5.0.1 -arrow==0.16.0 +amqp==5.0.6 +arrow==1.1.0 atomicwrites==1.4.0 -attrs==20.2.0 -Babel==2.8.0 +attrs==21.2.0 +Babel==2.9.1 backcall==0.2.0 -bandit==1.6.2 +bandit==1.7.0 bench-it==1.0.1 -billiard==3.6.3.0 -celery==5.0.0 -certifi==2020.6.20 -chardet==3.0.4 +billiard==3.6.4.0 +celery==5.1.2 +certifi==2021.5.30 +chardet==4.0.0 click-didyoumean==0.0.3 -click-repl==0.1.6 +click-repl==0.2.0 click==7.1.2 -colorama==0.4.3 -configparser==5.0.0 +colorama==0.4.4 +configparser==5.0.2 debugpy==1.0.0rc2 -decorator==4.4.2 +decorator==5.0.9 diff-cover==2.6.1 docker-pycreds==0.4.0 email-validator==1.1.3 @@ -38,7 +38,7 @@ flake8-print==3.1.4 flake8-quotes==3.2.0 flake8-tidy-imports==4.1.0 flake8-todo==0.7 -flake8==3.8.3 +flake8==3.9.2 Flask-Admin==1.5.6 Flask-Babel==2.0.0 Flask-Limiter==1.4 @@ -47,24 +47,24 @@ Flask-Mail==0.9.1 Flask-WTF==0.15.1 Flask==2.0.1 future==0.18.2 -gitdb==4.0.5 -GitPython==3.1.8 -gunicorn==20.0.4 -idna==2.10 +gitdb==4.0.7 +GitPython==3.1.18 +gunicorn==20.1.0 +idna==3.2 importlib-metadata==2.0.0 -inflect==4.1.0 -ipykernel==5.3.4 +inflect==5.3.0 +ipykernel==6.0.3 ipython-genutils==0.2.0 -ipython==7.18.1 -ipywidgets==7.5.1 +ipython==7.26.0 +ipywidgets==7.6.3 itsdangerous==2.0.1 -jedi==0.17.2 +jedi==0.18.0 jinja2-pluralize==0.3.0 Jinja2==3.0.1 -junitparser==1.4.1 -jupyter-client==6.1.7 -jupyter-console==6.2.0 -jupyter-core==4.6.3 +junitparser==2.1.1 +jupyter-client==6.1.12 +jupyter-console==6.4.0 +jupyter-core==4.7.1 jupyter==1.0.0 jupyterlab-pygments==0.1.2 kombu==5.1.0 @@ -74,25 +74,25 @@ mccabe==0.6.1 more-itertools==8.5.0 mypy-extensions==0.4.3 mypy==0.782 -numpy==1.19.2 +numpy==1.21.1 oyaml==1.0 -packaging==20.4 -parso==0.7.1 -pathspec==0.8.0 -pbr==5.5.0 -peewee==3.13.3 +packaging==21.0 +parso==0.8.2 +pathspec==0.9.0 +pbr==5.6.0 +peewee==3.14.4 pexpect==4.8.0 pickleshare==0.7.5 pluggy==0.13.1 -prompt-toolkit==3.0.7 +prompt-toolkit==3.0.19 psycopg2-binary==2.8.6 ptyprocess==0.6.0 py==1.10.0 pycairo==1.19.1 -pycodestyle==2.6.0 +pycodestyle==2.7.0 pycparser==2.20 -pyflakes==2.2.0 -Pygments==2.7.4 +pyflakes==2.3.1 +Pygments==2.9.0 pylint==2.6.0 pynvim==0.4.2 pyodbc==4.0.30 @@ -100,21 +100,21 @@ pyparsing==2.4.7 pyrsistent==0.17.3 pytest-env==0.6.2 pytest==6.1.0 -python-dateutil==2.8.1 +python-dateutil==2.8.2 python-dotenv==0.14.0 pytoml==0.1.21 -pytz==2020.1 +pytz==2021.1 PyYAML==5.4 -pyzmq==19.0.2 -requests==2.24.0 -six==1.15.0 -smmap==3.0.4 +pyzmq==22.2.1 +requests==2.26.0 +six==1.16.0 +smmap==4.0.0 sqlfluff==0.3.6 -stevedore==3.2.2 -traitlets==5.0.4 +stevedore==3.4.0 +traitlets==5.0.5 typed-ast==1.4.1 -typing-extensions==3.7.4.3 -urllib3==1.25.10 +typing-extensions==3.10.0.2 +urllib3==1.26.6 vine==5.0.0 wcwidth==0.2.5 Werkzeug==2.0.1 From 1443bad327820c689ce3163b688dc3cd6e4cdcdb Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Sat, 11 Sep 2021 10:13:43 +0300 Subject: [PATCH 13/51] Removed versions change --- requirements.txt | 106 +++++++++++++++++++++++------------------------ 1 file changed, 53 insertions(+), 53 deletions(-) diff --git a/requirements.txt b/requirements.txt index 874804e1..baa16b76 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,22 +1,22 @@ -amqp==5.0.6 -arrow==1.1.0 +amqp==5.0.1 +arrow==0.16.0 atomicwrites==1.4.0 -attrs==21.2.0 -Babel==2.9.1 +attrs==20.2.0 +Babel==2.8.0 backcall==0.2.0 -bandit==1.7.0 +bandit==1.6.2 bench-it==1.0.1 -billiard==3.6.4.0 -celery==5.1.2 -certifi==2021.5.30 -chardet==4.0.0 +billiard==3.6.3.0 +celery==5.0.0 +certifi==2020.6.20 +chardet==3.0.4 click-didyoumean==0.0.3 -click-repl==0.2.0 +click-repl==0.1.6 click==7.1.2 -colorama==0.4.4 -configparser==5.0.2 +colorama==0.4.3 +configparser==5.0.0 debugpy==1.0.0rc2 -decorator==5.0.9 +decorator==4.4.2 diff-cover==2.6.1 docker-pycreds==0.4.0 email-validator==1.1.3 @@ -38,61 +38,61 @@ flake8-print==3.1.4 flake8-quotes==3.2.0 flake8-tidy-imports==4.1.0 flake8-todo==0.7 -flake8==3.9.2 +flake8==3.8.3 Flask-Admin==1.5.6 Flask-Babel==2.0.0 Flask-Limiter==1.4 Flask-Login==0.5.0 Flask-Mail==0.9.1 -Flask-WTF==0.15.1 -Flask==2.0.1 +Flask-WTF==0.14.3 +Flask==1.1.2 future==0.18.2 -gitdb==4.0.7 -GitPython==3.1.18 -gunicorn==20.1.0 -idna==3.2 +gitdb==4.0.5 +GitPython==3.1.8 +gunicorn==20.0.4 +idna==2.10 importlib-metadata==2.0.0 -inflect==5.3.0 -ipykernel==6.0.3 +inflect==4.1.0 +ipykernel==5.3.4 ipython-genutils==0.2.0 -ipython==7.26.0 -ipywidgets==7.6.3 +ipython==7.18.1 +ipywidgets==7.5.1 itsdangerous==2.0.1 -jedi==0.18.0 +jedi==0.17.2 jinja2-pluralize==0.3.0 -Jinja2==3.0.1 -junitparser==2.1.1 -jupyter-client==6.1.12 -jupyter-console==6.4.0 -jupyter-core==4.7.1 +Jinja2==2.11.3 +junitparser==1.4.1 +jupyter-client==6.1.7 +jupyter-console==6.2.0 +jupyter-core==4.6.3 jupyter==1.0.0 jupyterlab-pygments==0.1.2 -kombu==5.1.0 +kombu==5.0.2 loguru==0.5.3 -MarkupSafe==2.0.1 +MarkupSafe==1.1.1 mccabe==0.6.1 more-itertools==8.5.0 mypy-extensions==0.4.3 mypy==0.782 -numpy==1.21.1 +numpy==1.19.2 oyaml==1.0 -packaging==21.0 -parso==0.8.2 -pathspec==0.9.0 -pbr==5.6.0 -peewee==3.14.4 +packaging==20.4 +parso==0.7.1 +pathspec==0.8.0 +pbr==5.5.0 +peewee==3.13.3 pexpect==4.8.0 pickleshare==0.7.5 pluggy==0.13.1 -prompt-toolkit==3.0.19 +prompt-toolkit==3.0.7 psycopg2-binary==2.8.6 ptyprocess==0.6.0 py==1.10.0 pycairo==1.19.1 -pycodestyle==2.7.0 +pycodestyle==2.6.0 pycparser==2.20 -pyflakes==2.3.1 -Pygments==2.9.0 +pyflakes==2.2.0 +Pygments==2.7.4 pylint==2.6.0 pynvim==0.4.2 pyodbc==4.0.30 @@ -100,24 +100,24 @@ pyparsing==2.4.7 pyrsistent==0.17.3 pytest-env==0.6.2 pytest==6.1.0 -python-dateutil==2.8.2 +python-dateutil==2.8.1 python-dotenv==0.14.0 pytoml==0.1.21 -pytz==2021.1 +pytz==2020.1 PyYAML==5.4 -pyzmq==22.2.1 -requests==2.26.0 -six==1.16.0 -smmap==4.0.0 +pyzmq==19.0.2 +requests==2.24.0 +six==1.15.0 +smmap==3.0.4 sqlfluff==0.3.6 -stevedore==3.4.0 -traitlets==5.0.5 +stevedore==3.2.2 +traitlets==5.0.4 typed-ast==1.4.1 -typing-extensions==3.10.0.2 -urllib3==1.26.6 +typing-extensions==3.7.4.3 +urllib3==1.25.10 vine==5.0.0 wcwidth==0.2.5 -Werkzeug==2.0.1 +Werkzeug==1.0.1 wtf-peewee==3.0.2 WTForms==2.3.3 zipp==3.2.0 From 1d00a274e3f0f57573135ceeab1c34aa6ad3d4b8 Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Sat, 11 Sep 2021 12:54:27 +0300 Subject: [PATCH 14/51] Fixed tests --- tests/conftest.py | 26 +++++++++++++++++++++++++- tests/samples/config.py.example | 1 - tests/samples/config_copy.py | 1 - tests/test_login.py | 2 +- tests/test_registration.py | 23 +++++++++++++---------- 5 files changed, 39 insertions(+), 14 deletions(-) diff --git a/tests/conftest.py b/tests/conftest.py index b9c7bfaa..d9966dba 100644 --- a/tests/conftest.py +++ b/tests/conftest.py @@ -1,11 +1,11 @@ import datetime from functools import wraps -from lms.models import notes import os import random import string from typing import List, Optional +from flask import template_rendered from flask.testing import FlaskClient from peewee import SqliteDatabase import pytest @@ -49,6 +49,11 @@ def db(db_in_memory): db_in_memory.rollback() +@pytest.fixture(autouse=True, scope='session') +def app(): + return webapp + + @pytest.fixture(autouse=True, scope='session') def celery_eager(): public_app.conf.update(task_always_eager=True) @@ -65,6 +70,11 @@ def webapp_configurations(): limiter.enabled = False +@pytest.fixture(autouse=True, scope='session') +def disable_mail_sending(): + webapp.config['TESTING'] = True + + def disable_shareable_solutions(): webapp.config['SHAREABLE_SOLUTIONS'] = False @@ -168,6 +178,20 @@ def admin_user(): ) +@pytest.fixture(autouse=True, scope='session') +def captured_templates(app): + recorded = [] + + def record(sender, template, context, **kwargs): + recorded.append((template, context)) + + template_rendered.connect(record, app) + try: + yield recorded + finally: + template_rendered.disconnect(record, app) + + def create_notification( student_user: User, solution: Solution, diff --git a/tests/samples/config.py.example b/tests/samples/config.py.example index f72fe745..abdf7fc2 100644 --- a/tests/samples/config.py.example +++ b/tests/samples/config.py.example @@ -13,7 +13,6 @@ FEATURE_FLAG_CHECK_IDENTICAL_CODE_ON = os.getenv( 'FEATURE_FLAG_CHECK_IDENTICAL_CODE_ON', False, ) -TESTING = True MAIL_WELCOME_MESSAGE = 'welcome-email' diff --git a/tests/samples/config_copy.py b/tests/samples/config_copy.py index ca2f0573..d56c7b9d 100644 --- a/tests/samples/config_copy.py +++ b/tests/samples/config_copy.py @@ -11,7 +11,6 @@ 'FEATURE_FLAG_CHECK_IDENTICAL_CODE_ON', False, ) -TESTING = True USERS_CSV = 'users.csv' diff --git a/tests/test_login.py b/tests/test_login.py index fe5165d7..714c66f7 100644 --- a/tests/test_login.py +++ b/tests/test_login.py @@ -14,7 +14,7 @@ def test_login_password_fail(student_user: User): assert fail_login_response.status_code == 302 @staticmethod - def test_login_username_fail(student_user: User): + def test_login_username_fail(): client = webapp.test_client() client.post('/login', data={ 'username': 'wrong_user', diff --git a/tests/test_registration.py b/tests/test_registration.py index 86009b60..956b0d18 100644 --- a/tests/test_registration.py +++ b/tests/test_registration.py @@ -3,18 +3,19 @@ from lms.lmsweb import webapp -class TestRegistration: +class TestReg: @staticmethod - def test_invalid_username(student_user: User): + def test_invalid_username(student_user: User, captured_templates): client = webapp.test_client() - response = client.post('/signup', data={ + client.post('/signup', data={ 'email': 'some_name@mail.com', 'username': student_user.username, 'fullname': 'some_name', 'password': 'some_password', 'confirm': 'some_password', }, follow_redirects=True) - assert response.request.path == '/signup' + template, _ = captured_templates[-1] + assert template.name == "signup.html" client.post('/login', data={ 'username': student_user.username, @@ -24,16 +25,17 @@ def test_invalid_username(student_user: User): assert fail_login_response.status_code == 302 @staticmethod - def test_invalid_email(student_user: User): + def test_invalid_email(student_user: User, captured_templates): client = webapp.test_client() - response = client.post('/signup', data={ + client.post('/signup', data={ 'email': student_user.mail_address, 'username': 'some_user', 'fullname': 'some_name', 'password': 'some_password', 'confirm': 'some_password', }, follow_redirects=True) - assert response.request.path == '/signup' + template, _ = captured_templates[-1] + assert template.name == 'signup.html' client.post('/login', data={ 'username': 'some_user', @@ -43,16 +45,17 @@ def test_invalid_email(student_user: User): assert fail_login_response.status_code == 302 @staticmethod - def test_successful_registration(): + def test_successful_registration(captured_templates): client = webapp.test_client() - response = client.post('/signup', data={ + client.post('/signup', data={ 'email': 'some_user123@mail.com', 'username': 'some_user', 'fullname': 'some_name', 'password': 'some_password', 'confirm': 'some_password', }, follow_redirects=True) - assert response.request.path == '/login' + template, _ = captured_templates[-1] + assert template.name == 'login.html' client.post('/login', data={ 'username': 'some_user', From 036bdf5ef273a619aaadccf6af729156f4c44138 Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Sat, 11 Sep 2021 13:18:44 +0300 Subject: [PATCH 15/51] Fixed a test --- tests/test_login.py | 8 ++++++-- tests/test_registration.py | 2 +- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/tests/test_login.py b/tests/test_login.py index 714c66f7..642440c2 100644 --- a/tests/test_login.py +++ b/tests/test_login.py @@ -24,13 +24,17 @@ def test_login_username_fail(): assert fail_login_response.status_code == 302 @staticmethod - def test_login_not_confirmed_user(not_confirmed_user: User): + def test_login_not_confirmed_user( + not_confirmed_user: User, captured_templates, + ): client = webapp.test_client() login_response = client.post('/login', data={ 'username': not_confirmed_user.username, 'password': 'fake pass', }, follow_redirects=True) - assert login_response.request.path == '/login' + template, _ = captured_templates[-1] + assert template.name == 'login.html' + fail_login_response = client.get('/exercises') assert fail_login_response.status_code == 302 diff --git a/tests/test_registration.py b/tests/test_registration.py index 956b0d18..800739c7 100644 --- a/tests/test_registration.py +++ b/tests/test_registration.py @@ -3,7 +3,7 @@ from lms.lmsweb import webapp -class TestReg: +class TestRegistration: @staticmethod def test_invalid_username(student_user: User, captured_templates): client = webapp.test_client() From b4261022ad208e03430945fc8977a74e9487bd9f Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Sat, 11 Sep 2021 14:55:21 +0300 Subject: [PATCH 16/51] Fixed test and updated client fixture --- lms/lmsweb/tools/registration.py | 5 +++-- tests/conftest.py | 12 ++++++------ tests/test_flask_limiter.py | 11 +++++------ tests/test_login.py | 17 +++++++---------- tests/test_registration.py | 16 +++++++++------- tests/test_users.py | 6 +++--- 6 files changed, 33 insertions(+), 34 deletions(-) diff --git a/lms/lmsweb/tools/registration.py b/lms/lmsweb/tools/registration.py index c65aeeec..643d8665 100644 --- a/lms/lmsweb/tools/registration.py +++ b/lms/lmsweb/tools/registration.py @@ -14,7 +14,7 @@ from wtforms.validators import Email, EqualTo, InputRequired, Length from lms.lmsdb import models -from lms.lmsweb import config, webmail +from lms.lmsweb import config, webapp, webmail from lms.utils.log import log import requests @@ -179,7 +179,8 @@ def send_confirmation_mail(email: str, fullname: str) -> None: ) link = url_for('confirm_email', token=token, _external=True) msg.body = f'Hey {fullname},\nYour confirmation link is: {link}' - webmail.send(msg) + if not webapp.config.get('TESTING'): + webmail.send(msg) if __name__ == '__main__': diff --git a/tests/conftest.py b/tests/conftest.py index d9966dba..f6fa8fff 100644 --- a/tests/conftest.py +++ b/tests/conftest.py @@ -49,9 +49,9 @@ def db(db_in_memory): db_in_memory.rollback() -@pytest.fixture(autouse=True, scope='session') -def app(): - return webapp +@pytest.fixture(autouse=True, scope='function') +def client(): + return webapp.test_client() @pytest.fixture(autouse=True, scope='session') @@ -179,17 +179,17 @@ def admin_user(): @pytest.fixture(autouse=True, scope='session') -def captured_templates(app): +def captured_templates(): recorded = [] def record(sender, template, context, **kwargs): recorded.append((template, context)) - template_rendered.connect(record, app) + template_rendered.connect(record, webapp) try: yield recorded finally: - template_rendered.disconnect(record, app) + template_rendered.disconnect(record, webapp) def create_notification( diff --git a/tests/test_flask_limiter.py b/tests/test_flask_limiter.py index 311cff55..3457230d 100644 --- a/tests/test_flask_limiter.py +++ b/tests/test_flask_limiter.py @@ -1,3 +1,5 @@ +from flask.testing import FlaskClient + from lms.lmsweb import routes from lms.lmsdb.models import Solution, User from lms.lmsweb import webapp @@ -7,8 +9,7 @@ class TestLimiter: @staticmethod @conftest.use_limiter - def test_limiter_login_fails(student_user: User): - client = webapp.test_client() + def test_limiter_login_fails(client: FlaskClient, student_user: User): for _ in range(webapp.config['LIMITS_PER_MINUTE'] - 1): response = client.post('/login', data={ 'username': student_user.username, @@ -25,16 +26,14 @@ def test_limiter_login_fails(student_user: User): @staticmethod @conftest.use_limiter - def test_limiter_login_refreshes(): - client = webapp.test_client() + def test_limiter_login_refreshes(client: FlaskClient): for _ in range(webapp.config['LIMITS_PER_MINUTE'] + 1): response = client.get('/login') assert response.status_code == 200 @staticmethod @conftest.use_limiter - def test_limiter_login_success(student_user: User): - client = webapp.test_client() + def test_limiter_login_success(client: FlaskClient, student_user: User): client.post('/login', data={ 'username': student_user.username, 'password': 'fake5', diff --git a/tests/test_login.py b/tests/test_login.py index 642440c2..c2d90074 100644 --- a/tests/test_login.py +++ b/tests/test_login.py @@ -1,11 +1,11 @@ +from flask.testing import FlaskClient + from lms.lmsdb.models import User -from lms.lmsweb import webapp class TestLogin: @staticmethod - def test_login_password_fail(student_user: User): - client = webapp.test_client() + def test_login_password_fail(client: FlaskClient, student_user: User): client.post('/login', data={ 'username': student_user.username, 'password': 'wrong_pass', @@ -14,8 +14,7 @@ def test_login_password_fail(student_user: User): assert fail_login_response.status_code == 302 @staticmethod - def test_login_username_fail(): - client = webapp.test_client() + def test_login_username_fail(client: FlaskClient): client.post('/login', data={ 'username': 'wrong_user', 'password': 'fake pass', @@ -25,10 +24,9 @@ def test_login_username_fail(): @staticmethod def test_login_not_confirmed_user( - not_confirmed_user: User, captured_templates, + client: FlaskClient, not_confirmed_user: User, captured_templates, ): - client = webapp.test_client() - login_response = client.post('/login', data={ + client.post('/login', data={ 'username': not_confirmed_user.username, 'password': 'fake pass', }, follow_redirects=True) @@ -39,8 +37,7 @@ def test_login_not_confirmed_user( assert fail_login_response.status_code == 302 @staticmethod - def test_login_success(student_user: User): - client = webapp.test_client() + def test_login_success(client: FlaskClient, student_user: User): client.post('/login', data={ 'username': student_user.username, 'password': 'fake pass', diff --git a/tests/test_registration.py b/tests/test_registration.py index 800739c7..ed53c223 100644 --- a/tests/test_registration.py +++ b/tests/test_registration.py @@ -1,12 +1,14 @@ +from flask.testing import FlaskClient + from lms.lmsweb.tools.registration import generate_confirmation_token from lms.lmsdb.models import User -from lms.lmsweb import webapp class TestRegistration: @staticmethod - def test_invalid_username(student_user: User, captured_templates): - client = webapp.test_client() + def test_invalid_username( + client: FlaskClient, student_user: User, captured_templates, + ): client.post('/signup', data={ 'email': 'some_name@mail.com', 'username': student_user.username, @@ -25,8 +27,9 @@ def test_invalid_username(student_user: User, captured_templates): assert fail_login_response.status_code == 302 @staticmethod - def test_invalid_email(student_user: User, captured_templates): - client = webapp.test_client() + def test_invalid_email( + client: FlaskClient, student_user: User, captured_templates, + ): client.post('/signup', data={ 'email': student_user.mail_address, 'username': 'some_user', @@ -45,8 +48,7 @@ def test_invalid_email(student_user: User, captured_templates): assert fail_login_response.status_code == 302 @staticmethod - def test_successful_registration(captured_templates): - client = webapp.test_client() + def test_successful_registration(client: FlaskClient, captured_templates): client.post('/signup', data={ 'email': 'some_user123@mail.com', 'username': 'some_user', diff --git a/tests/test_users.py b/tests/test_users.py index 06210ab1..043570ca 100644 --- a/tests/test_users.py +++ b/tests/test_users.py @@ -1,5 +1,6 @@ +from flask.testing import FlaskClient + from lms.lmsdb.models import User -from lms.lmsweb import webapp from tests import conftest @@ -61,8 +62,7 @@ def test_logout(student_user: User): assert logout_response.status_code == 200 @staticmethod - def test_banned_user(banned_user: User): - client = webapp.test_client() + def test_banned_user(client: FlaskClient, banned_user: User): login_response = client.post('/login', data={ 'username': banned_user.username, 'password': 'fake pass', From c2ffa37a7bfd176fa5244b4a9f476cbfb4960e57 Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Sat, 11 Sep 2021 15:10:30 +0300 Subject: [PATCH 17/51] Added tests for coverage --- tests/test_registration.py | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/tests/test_registration.py b/tests/test_registration.py index ed53c223..05ef637f 100644 --- a/tests/test_registration.py +++ b/tests/test_registration.py @@ -74,3 +74,31 @@ def test_successful_registration(client: FlaskClient, captured_templates): }, follow_redirects=True) fail_login_response = client.get('/exercises') assert fail_login_response.status_code == 200 + + @staticmethod + def test_bad_token(client: FlaskClient): + bad_token = "fake-token43@$@" + fail_confirm_response = client.get( + f'/confirm-email/{bad_token}', follow_redirects=True, + ) + assert fail_confirm_response.status_code == 404 + + @staticmethod + def test_use_token_twice(client: FlaskClient): + client.post('/signup', data={ + 'email': 'some_user123@mail.com', + 'username': 'some_user', + 'fullname': 'some_name', + 'password': 'some_password', + 'confirm': 'some_password', + }, follow_redirects=True) + token = generate_confirmation_token('some_user123@mail.com') + success_token_response = client.get( + f'/confirm-email/{token}', follow_redirects=True, + ) + assert success_token_response.status_code == 200 + + fail_token_response = client.get( + f'/confirm-email/{token}', follow_redirects=True, + ) + assert fail_token_response.status_code == 403 From fda15583e72c296f5887bfc709dbcc49d2e2e539 Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Sat, 11 Sep 2021 21:32:48 +0300 Subject: [PATCH 18/51] Added a test for signature expired --- lms/lmsweb/config.py.example | 2 ++ lms/lmsweb/views.py | 7 ++++-- tests/test_registration.py | 43 ++++++++++++++++++++++++++++++++++-- 3 files changed, 48 insertions(+), 4 deletions(-) diff --git a/lms/lmsweb/config.py.example b/lms/lmsweb/config.py.example index bee1d7eb..ed899797 100644 --- a/lms/lmsweb/config.py.example +++ b/lms/lmsweb/config.py.example @@ -10,6 +10,8 @@ MAILGUN_DOMAIN = os.getenv('MAILGUN_DOMAIN', 'mail.pythonic.guru') SERVER_ADDRESS = os.getenv('SERVER_ADDRESS', '127.0.0.1:5000') SITE_NAME = 'Learning Python' +CONFIRMATION_TIME = 3600 + # MAIL CONFIGURATION MAIL_SERVER = 'smtp.gmail.com' MAIL_PORT = 465 diff --git a/lms/lmsweb/views.py b/lms/lmsweb/views.py index a252ce85..94139508 100644 --- a/lms/lmsweb/views.py +++ b/lms/lmsweb/views.py @@ -23,7 +23,8 @@ AdminModelView, SPECIAL_MAPPING, admin, managers_only, ) from lms.lmsweb.config import ( - LANGUAGES, LIMITS_PER_HOUR, LIMITS_PER_MINUTE, LOCALE, MAX_UPLOAD_SIZE, + CONFIRMATION_TIME, LANGUAGES, LIMITS_PER_HOUR, + LIMITS_PER_MINUTE, LOCALE, MAX_UPLOAD_SIZE, ) from lms.lmsweb.forms.register import RegisterForm from lms.lmsweb.manifest import MANIFEST @@ -157,7 +158,9 @@ def confirm_email(user_id: int, token: str): 403, f'User has been already confirmed {user.username}', ) - SERIALIZER.loads(token, salt=retrieve_salt(user), max_age=3600) + SERIALIZER.loads( + token, salt=retrieve_salt(user), max_age=CONFIRMATION_TIME, + ) update = User.update( role=Role.get_student_role(), ).where(User.username == user.username) diff --git a/tests/test_registration.py b/tests/test_registration.py index 0b97e75c..dd5188c0 100644 --- a/tests/test_registration.py +++ b/tests/test_registration.py @@ -1,5 +1,9 @@ +import time +from unittest.mock import Mock, patch + from flask.testing import FlaskClient +from lms.lmsweb.config import CONFIRMATION_TIME from lms.lmsdb.models import User from lms.models.register import generate_confirmation_token @@ -73,8 +77,8 @@ def test_successful_registration(client: FlaskClient, captured_templates): 'username': 'some_user', 'password': 'some_password', }, follow_redirects=True) - fail_login_response = client.get('/exercises') - assert fail_login_response.status_code == 200 + success_login_response = client.get('/exercises') + assert success_login_response.status_code == 200 @staticmethod def test_bad_token_or_id(client: FlaskClient): @@ -110,3 +114,38 @@ def test_use_token_twice(client: FlaskClient): f'/confirm-email/{user.id}/{token}', follow_redirects=True, ) assert fail_token_response.status_code == 403 + + @staticmethod + def test_expired_token(client: FlaskClient): + client.post('/signup', data={ + 'email': 'some_user123@mail.com', + 'username': 'some_user', + 'fullname': 'some_name', + 'password': 'some_password', + 'confirm': 'some_password', + }, follow_redirects=True) + user = User.get_or_none(User.username == 'some_user') + token = generate_confirmation_token(user) + + fake_time = time.time() + CONFIRMATION_TIME + 1 + with patch('time.time', Mock(return_value=fake_time)): + client.get( + f'/confirm-email/{user.id}/{token}', follow_redirects=True, + ) + client.post('/login', data={ + 'username': 'some_user', + 'password': 'some_password', + }, follow_redirects=True) + fail_login_response = client.get('/exercises') + assert fail_login_response.status_code == 302 + + token = generate_confirmation_token(user) + client.get( + f'/confirm-email/{user.id}/{token}', follow_redirects=True, + ) + client.post('/login', data={ + 'username': 'some_user', + 'password': 'some_password', + }, follow_redirects=True) + success_login_response = client.get('/exercises') + assert success_login_response.status_code == 200 From 6ad81a2d817ba3f729680636cea627cca7a3cb9c Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Sat, 11 Sep 2021 21:36:44 +0300 Subject: [PATCH 19/51] Removed unnecessary condition --- lms/lmsweb/views.py | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/lms/lmsweb/views.py b/lms/lmsweb/views.py index 94139508..5079aad7 100644 --- a/lms/lmsweb/views.py +++ b/lms/lmsweb/views.py @@ -109,10 +109,7 @@ def login(login_message: Optional[str] = None): login_user(user) return get_next_url(next_page) - elif ( - user is None or not user.is_password_valid(password) - or user.role.is_unverified - ): + elif user is None or not user.is_password_valid(password): login_message = _('שם המשתמש או הסיסמה שהוזנו לא תקינים') error_details = {'next': next_page, 'login_message': login_message} return redirect(url_for('login', **error_details)) From eb717f18d0f6fa73230f6fd5157a4498cd6be468 Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Sat, 11 Sep 2021 21:40:26 +0300 Subject: [PATCH 20/51] Added role attribute --- lms/lmsweb/views.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lms/lmsweb/views.py b/lms/lmsweb/views.py index 5079aad7..2ead24f5 100644 --- a/lms/lmsweb/views.py +++ b/lms/lmsweb/views.py @@ -114,7 +114,7 @@ def login(login_message: Optional[str] = None): error_details = {'next': next_page, 'login_message': login_message} return redirect(url_for('login', **error_details)) - elif user.is_unverified: + elif user.role.is_unverified: login_message = _('עליך לאשר את המייל') error_details = {'next': next_page, 'login_message': login_message} return redirect(url_for('login', **error_details)) From 7e87dadee94fb24906cc3a08ecf3308aefa9aa1b Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Sun, 12 Sep 2021 11:22:51 +0300 Subject: [PATCH 21/51] - Fixed babel translations - Added few _('...') instead of some english phrases - Moved out the auth logic into models/users - Added MAIL_DEFAULT_SENDER variable to the config - Changed the retrieve_salt method --- lms/lmsweb/config.py.example | 1 + lms/lmsweb/tools/validators.py | 9 ++- .../translations/en/LC_MESSAGES/messages.po | 63 +++++++++------- lms/lmsweb/views.py | 71 ++++++++----------- lms/models/errors.py | 8 +-- lms/models/register.py | 18 +---- lms/models/users.py | 28 ++++++++ lms/templates/signup.html | 12 ++-- 8 files changed, 118 insertions(+), 92 deletions(-) create mode 100644 lms/models/users.py diff --git a/lms/lmsweb/config.py.example b/lms/lmsweb/config.py.example index ed899797..58917cf8 100644 --- a/lms/lmsweb/config.py.example +++ b/lms/lmsweb/config.py.example @@ -19,6 +19,7 @@ MAIL_USE_SSL = True MAIL_USE_TLS = False MAIL_USERNAME = 'username@gmail.com' MAIL_PASSWORD = 'password' +MAIL_DEFAULT_SENDER = 'username@gmail.com' # ADMIN PANEL FLASK_ADMIN_FLUID_LAYOUT = True diff --git a/lms/lmsweb/tools/validators.py b/lms/lmsweb/tools/validators.py index a3272dc3..2f502b60 100644 --- a/lms/lmsweb/tools/validators.py +++ b/lms/lmsweb/tools/validators.py @@ -1,16 +1,21 @@ from flask_babel import gettext as _ # type: ignore +from wtforms.fields.core import StringField from wtforms.validators import ValidationError from lms.lmsdb.models import User -def UniqueUsernameRequired(form, field): +def UniqueUsernameRequired( + _form: 'RegisterForm', field: StringField, # type: ignore # NOQA: F821 +) -> None: username_exists = User.get_or_none(User.username == field.data) if username_exists: raise ValidationError(_('שם המשתמש כבר נמצא בשימוש')) -def UniqueEmailRequired(form, field): +def UniqueEmailRequired( + _form: 'RegisterForm', field: StringField, # type: ignore # NOQA: F821 +) -> None: email_exists = User.get_or_none(User.mail_address == field.data) if email_exists: raise ValidationError(_('האימייל כבר נמצא בשימוש')) diff --git a/lms/lmsweb/translations/en/LC_MESSAGES/messages.po b/lms/lmsweb/translations/en/LC_MESSAGES/messages.po index 4041d7b1..d224a88e 100644 --- a/lms/lmsweb/translations/en/LC_MESSAGES/messages.po +++ b/lms/lmsweb/translations/en/LC_MESSAGES/messages.po @@ -7,7 +7,7 @@ msgid "" msgstr "" "Project-Id-Version: lmsweb-1.0\n" "Report-Msgid-Bugs-To: bugs@mesicka.com\n" -"POT-Creation-Date: 2021-09-11 19:16+0300\n" +"POT-Creation-Date: 2021-09-12 11:15+0300\n" "PO-Revision-Date: 2020-09-16 18:29+0300\n" "Last-Translator: Or Ronai\n" "Language: en\n" @@ -45,27 +45,19 @@ msgstr "The automatic checker couldn't run your code." msgid "אחי, בדקת את הקוד שלך?" msgstr "Bro, did you check your code?" -#: lmsweb/views.py:115 -#, fuzzy -msgid "שם המשתמש או הסיסמה שהוזנו לא תקינים" -msgstr "Invalid username or password" - -#: lmsweb/views.py:120 -msgid "עליך לאשר את המייל" -msgstr "You have to confirm your registration with the link sent to your email" - -#: lmsweb/views.py:144 +#: lmsweb/views.py:134 msgid "ההרשמה בוצעה בהצלחה" msgstr "Registration successfully" -#: lmsweb/views.py:168 -msgid "המשתמש שלך אומת בהצלחה, כעת הינך יכול להתחבר למערכת" -msgstr "Your user has been successfully confirmed, you can now login" - -#: lmsweb/views.py:176 +#: lmsweb/views.py:156 msgid "קישור האימות פג תוקף, קישור חדש נשלח אל תיבת המייל שלך" msgstr "The confirmation link is expired, new link has been sent to your email" +#: lmsweb/views.py:169 +#, fuzzy +msgid "המשתמש שלך אומת בהצלחה, כעת אתה יכול להתחבר למערכת" +msgstr "Your user has been successfully confirmed, you can now login" + #: lmsweb/forms/register.py:14 msgid "אימייל לא תקין" msgstr "Invalid email" @@ -78,22 +70,22 @@ msgstr "The passwords are not identical" msgid "מערכת הגשת התרגילים" msgstr "Exercuse submission system" -#: lmsweb/tools/validators.py:10 +#: lmsweb/tools/validators.py:13 msgid "שם המשתמש כבר נמצא בשימוש" msgstr "The username already in use" -#: lmsweb/tools/validators.py:16 +#: lmsweb/tools/validators.py:21 msgid "האימייל כבר נמצא בשימוש" msgstr "The email already in use" -#: models/register.py:31 +#: models/register.py:20 #, python-format msgid "מייל אימות - %(site_name)s" msgstr "Confirmation mail - %(site_name)s" -#: models/register.py:39 -#, python-format -msgid "שלום %(fullname)s,\n לינק האימות שלך למערכת הוא: %(link)s" +#: models/register.py:25 +#, fuzzy, python-format +msgid "שלום %(fullname)s,\nלינק האימות שלך למערכת הוא: %(link)s" msgstr "Hello %(fullname)s,\n Your confirmation link is: %(link)s" #: models/solutions.py:50 @@ -111,6 +103,16 @@ msgstr "%(checker)s replied for \"%(subject)s\"." msgid "הפתרון שלך לתרגיל \"%(subject)s\" נבדק." msgstr "Your solution for the \"%(subject)s\" exercise has been checked." +#: models/users.py:25 +#, fuzzy +msgid "שם המשתמש או הסיסמה שהוזנו לא תקינים" +msgstr "Invalid username or password" + +#: models/users.py:27 +#, fuzzy +msgid "עליך לאשר את מייל האימות" +msgstr "You have to confirm your registration with the link sent to your email" + #: templates/banned.html:8 templates/login.html:7 templates/signup.html:8 msgid "תמונת הפרופיל של קורס פייתון" msgstr "Profile picture of the Python Course" @@ -163,11 +165,11 @@ msgstr "Welcome to the exercise system!" msgid "הזינו את שם המשתמש והסיסמה שלכם:" msgstr "Insert your username and password:" -#: templates/login.html:22 templates/login.html:24 +#: templates/login.html:22 templates/login.html:24 templates/signup.html:16 msgid "שם משתמש" msgstr "Username" -#: templates/login.html:28 templates/login.html:30 +#: templates/login.html:28 templates/login.html:30 templates/signup.html:18 msgid "סיסמה" msgstr "Password" @@ -224,6 +226,19 @@ msgstr "Registration" msgid "הזינו אימייל וסיסמה לצורך רישום למערכת:" msgstr "Insert your email and password for registration:" +#: templates/signup.html:15 +msgid "כתובת אימייל" +msgstr "Email Address" + +#: templates/signup.html:17 +msgid "שם מלא" +msgstr "Full Name" + +#: templates/signup.html:19 +#, fuzzy +msgid "אימות סיסמה" +msgstr "Password Confirmation" + #: templates/signup.html:25 msgid "חזרה לדף ההתחברות" msgstr "Back to login page" diff --git a/lms/lmsweb/views.py b/lms/lmsweb/views.py index 2ead24f5..6a89f376 100644 --- a/lms/lmsweb/views.py +++ b/lms/lmsweb/views.py @@ -34,10 +34,12 @@ from lms.models import ( comments, notes, notifications, share_link, solutions, upload, ) -from lms.models.errors import FileSizeError, LmsError, UploadError, fail -from lms.models.register import ( - SERIALIZER, retrieve_salt, send_confirmation_mail, +from lms.models.errors import ( + FileSizeError, ForbiddenPermission, LmsError, + UnauthorizedError, UploadError, fail, ) +from lms.models.register import SERIALIZER, send_confirmation_mail +from lms.models.users import auth, retrieve_salt from lms.utils.consts import RTL_LANGUAGES from lms.utils.files import ( get_language_name_by_extension, get_mime_type_by_extention, @@ -91,7 +93,6 @@ def ratelimit_handler(e): deduct_when=lambda response: response.status_code != 200, ) def login(login_message: Optional[str] = None): - if current_user.is_authenticated: return get_next_url(request.args.get('next')) @@ -99,26 +100,18 @@ def login(login_message: Optional[str] = None): password = request.form.get('password') next_page = request.form.get('next') login_message = request.args.get('login_message') - user = User.get_or_none(username=username) if request.method == 'POST': - if ( - user is not None and user.is_password_valid(password) - and not user.role.is_unverified - ): + try: + user = auth(username, password) + except (ForbiddenPermission, UnauthorizedError) as e: + error_message, _ = e.args + error_details = {'next': next_page, 'login_message': error_message} + return redirect(url_for('login', **error_details)) + else: login_user(user) return get_next_url(next_page) - elif user is None or not user.is_password_valid(password): - login_message = _('שם המשתמש או הסיסמה שהוזנו לא תקינים') - error_details = {'next': next_page, 'login_message': login_message} - return redirect(url_for('login', **error_details)) - - elif user.role.is_unverified: - login_message = _('עליך לאשר את המייל') - error_details = {'next': next_page, 'login_message': login_message} - return redirect(url_for('login', **error_details)) - return render_template('login.html', login_message=login_message) @@ -128,16 +121,15 @@ def signup(): if not form.validate_on_submit(): return render_template('signup.html', form=form) - user = User.get_or_create(**{ + user = User.create(**{ User.mail_address.name: form.email.data, User.username.name: form.username.data, - }, defaults={ User.fullname.name: form.fullname.data, User.role.name: Role.get_unverified_role(), User.password.name: form.password.data, User.api_key.name: User.random_password(), }) - send_confirmation_mail(user[0]) + send_confirmation_mail(user) return redirect(url_for( 'login', login_message=_('ההרשמה בוצעה בהצלחה'), )) @@ -145,29 +137,17 @@ def signup(): @webapp.route('/confirm-email//') def confirm_email(user_id: int, token: str): - try: - user = User.get_or_none(User.id == user_id) - if user is None: - return fail(404, f'No such user with id {user_id}.') + user = User.get_or_none(User.id == user_id) + if user is None: + return fail(404, f'No such user with id {user_id}.') - if not user.role.is_unverified: - return fail( - 403, f'User has been already confirmed {user.username}', - ) + if not user.role.is_unverified: + return fail(403, f'User has been already confirmed {user.username}') + try: SERIALIZER.loads( token, salt=retrieve_salt(user), max_age=CONFIRMATION_TIME, ) - update = User.update( - role=Role.get_student_role(), - ).where(User.username == user.username) - update.execute() - - return redirect(url_for( - 'login', login_message=( - _('המשתמש שלך אומת בהצלחה, כעת הינך יכול להתחבר למערכת'), - ), - )) except SignatureExpired: send_confirmation_mail(user) @@ -179,6 +159,17 @@ def confirm_email(user_id: int, token: str): except BadSignature: return fail(404, 'No such signature') + else: + update = User.update( + role=Role.get_student_role(), + ).where(User.username == user.username) + update.execute() + return redirect(url_for( + 'login', login_message=( + _('המשתמש שלך אומת בהצלחה, כעת אתה יכול להתחבר למערכת'), + ), + )) + @webapp.route('/logout') @login_required diff --git a/lms/models/errors.py b/lms/models/errors.py index ef13bc6e..1a2ec15d 100644 --- a/lms/models/errors.py +++ b/lms/models/errors.py @@ -13,10 +13,6 @@ class BadUploadFile(LmsError): pass -class EmptyPasswordError(LmsError): - pass - - class FileSizeError(LmsError): pass @@ -33,6 +29,10 @@ class NotValidRequest(LmsError): # Error 400 pass +class UnauthorizedError(LmsError): # Error 401 + pass + + class ForbiddenPermission(LmsError): # Error 403 pass diff --git a/lms/models/register.py b/lms/models/register.py index 3eee1a39..f19937cb 100644 --- a/lms/models/register.py +++ b/lms/models/register.py @@ -1,5 +1,3 @@ -import re - from flask import url_for from flask_babel import gettext as _ # type: ignore from flask_mail import Message # type: ignore @@ -7,21 +5,12 @@ from lms.lmsdb.models import User from lms.lmsweb import config, webapp, webmail -from lms.models.errors import EmptyPasswordError, UnhashedPasswordError +from lms.models.users import retrieve_salt SERIALIZER = URLSafeTimedSerializer(config.SECRET_KEY) -def retrieve_salt(user: User) -> str: - try: - re.findall(r'\$(.*)\$', user.password)[0] - except IndexError: - if user.password.name: - raise UnhashedPasswordError - raise EmptyPasswordError - - def generate_confirmation_token(user: User) -> str: return SERIALIZER.dumps(user.mail_address, salt=retrieve_salt(user)) @@ -29,10 +18,7 @@ def generate_confirmation_token(user: User) -> str: def send_confirmation_mail(user: User) -> None: token = generate_confirmation_token(user) subject = _('מייל אימות - %(site_name)s', site_name=config.SITE_NAME) - msg = Message( - subject, sender=f'lms@{config.MAILGUN_DOMAIN}', - recipients=[user.mail_address], - ) + msg = Message(subject, recipients=[user.mail_address]) link = url_for( 'confirm_email', user_id=user.id, token=token, _external=True, ) diff --git a/lms/models/users.py b/lms/models/users.py new file mode 100644 index 00000000..9a3df17e --- /dev/null +++ b/lms/models/users.py @@ -0,0 +1,28 @@ +import re + +from flask_babel import gettext as _ # type: ignore + +from lms.lmsdb.models import User +from lms.models.errors import ( + ForbiddenPermission, UnauthorizedError, UnhashedPasswordError, +) + + +def retrieve_salt(user: User) -> str: + HASHED_PASSWORD = re.compile( + r'^pbkdf2.+?\$(?P.+?)\$(?P.+)', + ) + password = HASHED_PASSWORD.match(user.password) + try: + return password.groupdict().get('salt') + except AttributeError: # should never happen + raise UnhashedPasswordError + + +def auth(username: str, password: str) -> User: + user = User.get_or_none(username=username) + if user is None or not user.is_password_valid(password): + raise UnauthorizedError(_('שם המשתמש או הסיסמה שהוזנו לא תקינים'), 400) + elif user.role.is_unverified: + raise ForbiddenPermission(_('עליך לאשר את מייל האימות'), 403) + return user diff --git a/lms/templates/signup.html b/lms/templates/signup.html index 72e5c413..b888068b 100644 --- a/lms/templates/signup.html +++ b/lms/templates/signup.html @@ -11,12 +11,12 @@

{{ _('הרשמה') }}

{{ _('ברוכים הבאים למערכת התרגילים!') }}
{{ _('הזינו אימייל וסיסמה לצורך רישום למערכת:') }}

-
- {{ render_field(form.email, cls="form-control form-control-lg", placeholder="Email Address") }} - {{ render_field(form.username, cls="form-control form-control-lg", placeholder="User Name") }} - {{ render_field(form.fullname, cls="form-control form-control-lg", placeholder="Full Name") }} - {{ render_field(form.password, cls="form-control form-control-lg", placeholder="Password") }} - {{ render_field(form.confirm, cls="form-control form-control-lg", placeholder="Password Verification") }} + + {{ render_field(form.email, cls="form-control form-control-lg", placeholder=_('כתובת אימייל')) }} + {{ render_field(form.username, cls="form-control form-control-lg", placeholder=_('שם משתמש')) }} + {{ render_field(form.fullname, cls="form-control form-control-lg", placeholder=_('שם מלא')) }} + {{ render_field(form.password, cls="form-control form-control-lg", placeholder=_('סיסמה')) }} + {{ render_field(form.confirm, cls="form-control form-control-lg", placeholder=_('אימות סיסמה')) }} From 19ecb65b8c40b3c51493dd9cb8abbdb84573ed3e Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Sun, 12 Sep 2021 11:37:40 +0300 Subject: [PATCH 22/51] Fixed a test to check bad signature token --- lms/lmsweb/views.py | 1 + tests/test_registration.py | 10 +++++++++- 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/lms/lmsweb/views.py b/lms/lmsweb/views.py index 6a89f376..64fc5eed 100644 --- a/lms/lmsweb/views.py +++ b/lms/lmsweb/views.py @@ -157,6 +157,7 @@ def confirm_email(user_id: int, token: str): ), )) except BadSignature: + print('here') return fail(404, 'No such signature') else: diff --git a/tests/test_registration.py b/tests/test_registration.py index dd5188c0..df1e2e48 100644 --- a/tests/test_registration.py +++ b/tests/test_registration.py @@ -82,9 +82,17 @@ def test_successful_registration(client: FlaskClient, captured_templates): @staticmethod def test_bad_token_or_id(client: FlaskClient): + client.post('/signup', data={ + 'email': 'some_user123@mail.com', + 'username': 'some_user', + 'fullname': 'some_name', + 'password': 'some_password', + 'confirm': 'some_password', + }, follow_redirects=True) + user = User.get_or_none(User.username == 'some_user') bad_token = "fake-token43@$@" fail_confirm_response = client.get( - f'/confirm-email/1/{bad_token}', follow_redirects=True, + f'/confirm-email/{user.id}/{bad_token}', follow_redirects=True, ) assert fail_confirm_response.status_code == 404 From 71fbb2f26a6577d28546bf4c1ddbfe8a8a77b0e2 Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Sun, 12 Sep 2021 11:38:12 +0300 Subject: [PATCH 23/51] Fixed a test --- lms/lmsweb/views.py | 1 - 1 file changed, 1 deletion(-) diff --git a/lms/lmsweb/views.py b/lms/lmsweb/views.py index 64fc5eed..6a89f376 100644 --- a/lms/lmsweb/views.py +++ b/lms/lmsweb/views.py @@ -157,7 +157,6 @@ def confirm_email(user_id: int, token: str): ), )) except BadSignature: - print('here') return fail(404, 'No such signature') else: From d4bd32a0e5ff035ae437380e6977f83771791ece Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Sun, 12 Sep 2021 12:58:12 +0300 Subject: [PATCH 24/51] Moved out the HASHED_PASSWORD in order to be global variable, and added an error message to the UnhashedPasswordError --- lms/models/users.py | 8 ++++---- tests/conftest.py | 2 +- tests/samples/config.py.example | 1 - 3 files changed, 5 insertions(+), 6 deletions(-) diff --git a/lms/models/users.py b/lms/models/users.py index 9a3df17e..bb2720a6 100644 --- a/lms/models/users.py +++ b/lms/models/users.py @@ -8,15 +8,15 @@ ) +HASHED_PASSWORD = re.compile(r'^pbkdf2.+?\$(?P.+?)\$(?P.+)') + + def retrieve_salt(user: User) -> str: - HASHED_PASSWORD = re.compile( - r'^pbkdf2.+?\$(?P.+?)\$(?P.+)', - ) password = HASHED_PASSWORD.match(user.password) try: return password.groupdict().get('salt') except AttributeError: # should never happen - raise UnhashedPasswordError + raise UnhashedPasswordError('Password format is invalid.') def auth(username: str, password: str) -> User: diff --git a/tests/conftest.py b/tests/conftest.py index 7dad6fda..27f8620c 100644 --- a/tests/conftest.py +++ b/tests/conftest.py @@ -178,7 +178,7 @@ def admin_user(): ) -@pytest.fixture(autouse=True, scope='session') +@pytest.fixture(autouse=True, scope='function') def captured_templates(): recorded = [] diff --git a/tests/samples/config.py.example b/tests/samples/config.py.example index abdf7fc2..dde2b013 100644 --- a/tests/samples/config.py.example +++ b/tests/samples/config.py.example @@ -14,7 +14,6 @@ FEATURE_FLAG_CHECK_IDENTICAL_CODE_ON = os.getenv( ) - MAIL_WELCOME_MESSAGE = 'welcome-email' USERS_CSV = 'users.csv' ERRORS_CSV = 'errors.csv' From 436fc9fc855f22e2d44245532f70f71cc7229fb5 Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Sun, 12 Sep 2021 15:13:41 +0300 Subject: [PATCH 25/51] Added a configuration of registration open, and a test --- lms/lmsweb/config.py.example | 2 ++ .../translations/en/LC_MESSAGES/messages.po | 14 +++++++++----- lms/lmsweb/views.py | 5 +++++ lms/templates/login.html | 2 ++ tests/conftest.py | 9 +++++++++ tests/test_registration.py | 19 +++++++++++++++++++ 6 files changed, 46 insertions(+), 5 deletions(-) diff --git a/lms/lmsweb/config.py.example b/lms/lmsweb/config.py.example index 58917cf8..d1c500f5 100644 --- a/lms/lmsweb/config.py.example +++ b/lms/lmsweb/config.py.example @@ -10,6 +10,8 @@ MAILGUN_DOMAIN = os.getenv('MAILGUN_DOMAIN', 'mail.pythonic.guru') SERVER_ADDRESS = os.getenv('SERVER_ADDRESS', '127.0.0.1:5000') SITE_NAME = 'Learning Python' +# REGISTRATION CONFIGURATIONS +REGISTRATION_OPEN = True CONFIRMATION_TIME = 3600 # MAIL CONFIGURATION diff --git a/lms/lmsweb/translations/en/LC_MESSAGES/messages.po b/lms/lmsweb/translations/en/LC_MESSAGES/messages.po index d224a88e..0c35ce13 100644 --- a/lms/lmsweb/translations/en/LC_MESSAGES/messages.po +++ b/lms/lmsweb/translations/en/LC_MESSAGES/messages.po @@ -7,7 +7,7 @@ msgid "" msgstr "" "Project-Id-Version: lmsweb-1.0\n" "Report-Msgid-Bugs-To: bugs@mesicka.com\n" -"POT-Creation-Date: 2021-09-12 11:15+0300\n" +"POT-Creation-Date: 2021-09-12 15:10+0300\n" "PO-Revision-Date: 2020-09-16 18:29+0300\n" "Last-Translator: Or Ronai\n" "Language: en\n" @@ -45,15 +45,19 @@ msgstr "The automatic checker couldn't run your code." msgid "אחי, בדקת את הקוד שלך?" msgstr "Bro, did you check your code?" -#: lmsweb/views.py:134 +#: lmsweb/views.py:122 +msgid "לא ניתן להירשם כעת" +msgstr "Can not register now" + +#: lmsweb/views.py:139 msgid "ההרשמה בוצעה בהצלחה" msgstr "Registration successfully" -#: lmsweb/views.py:156 +#: lmsweb/views.py:161 msgid "קישור האימות פג תוקף, קישור חדש נשלח אל תיבת המייל שלך" msgstr "The confirmation link is expired, new link has been sent to your email" -#: lmsweb/views.py:169 +#: lmsweb/views.py:174 #, fuzzy msgid "המשתמש שלך אומת בהצלחה, כעת אתה יכול להתחבר למערכת" msgstr "Your user has been successfully confirmed, you can now login" @@ -177,7 +181,7 @@ msgstr "Password" msgid "התחבר" msgstr "Login" -#: templates/login.html:38 templates/signup.html:22 +#: templates/login.html:39 templates/signup.html:22 msgid "הירשם" msgstr "Register" diff --git a/lms/lmsweb/views.py b/lms/lmsweb/views.py index 6a89f376..a80e687c 100644 --- a/lms/lmsweb/views.py +++ b/lms/lmsweb/views.py @@ -117,6 +117,11 @@ def login(login_message: Optional[str] = None): @webapp.route('/signup', methods=['GET', 'POST']) def signup(): + if not webapp.config.get('REGISTRATION_OPEN', False): + return redirect(url_for( + 'login', login_message=_('לא ניתן להירשם כעת'), + )) + form = RegisterForm() if not form.validate_on_submit(): return render_template('signup.html', form=form) diff --git a/lms/templates/login.html b/lms/templates/login.html index b1dde490..789d1723 100644 --- a/lms/templates/login.html +++ b/lms/templates/login.html @@ -34,8 +34,10 @@

{{ _('התחברות') }}

+ {% if config.REGISTRATION_OPEN %}
{{ _('הירשם') }} + {% endif %} diff --git a/tests/conftest.py b/tests/conftest.py index 27f8620c..93caf4b9 100644 --- a/tests/conftest.py +++ b/tests/conftest.py @@ -75,6 +75,11 @@ def disable_mail_sending(): webapp.config['TESTING'] = True +@pytest.fixture(autouse=True, scope='session') +def enable_registration(): + webapp.config['REGISTRATION_OPEN'] = True + + def disable_shareable_solutions(): webapp.config['SHAREABLE_SOLUTIONS'] = False @@ -87,6 +92,10 @@ def enable_users_comments(): webapp.config['USERS_COMMENTS'] = True +def disable_registration(): + webapp.config['REGISTRATION_OPEN'] = False + + def use_limiter(func): @wraps(func) def wrapper(*args, **kwargs): diff --git a/tests/test_registration.py b/tests/test_registration.py index df1e2e48..f09b4d49 100644 --- a/tests/test_registration.py +++ b/tests/test_registration.py @@ -6,6 +6,7 @@ from lms.lmsweb.config import CONFIRMATION_TIME from lms.lmsdb.models import User from lms.models.register import generate_confirmation_token +from tests import conftest class TestRegistration: @@ -157,3 +158,21 @@ def test_expired_token(client: FlaskClient): }, follow_redirects=True) success_login_response = client.get('/exercises') assert success_login_response.status_code == 200 + + @staticmethod + def test_registartion_closed(client: FlaskClient, captured_templates): + conftest.disable_registration() + client.post('/signup', data={ + 'email': 'some_user123@mail.com', + 'username': 'some_user', + 'fullname': 'some_name', + 'password': 'some_password', + 'confirm': 'some_password', + }, follow_redirects=True) + user = User.get_or_none(User.username == 'some_user') + assert user is None + + response = client.get('/signup') + template, _ = captured_templates[-1] + assert template.name == 'login.html' + assert '/signup' not in response.get_data(as_text=True) From 1c45f577dc38ff213a3a17305fdf442e1ff4e18c Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Tue, 14 Sep 2021 18:09:52 +0300 Subject: [PATCH 26/51] feat: Add change password page - Added tests - Added a ref link from user's page - Added the form background - Added the template and the css style --- lms/lmsdb/models.py | 11 +++++++- lms/lmsweb/forms/change_password.py | 27 ++++++++++++++++++ lms/lmsweb/tools/registration.py | 4 +++ lms/lmsweb/views.py | 43 ++++++++++++++++++++++++++--- lms/models/register.py | 30 -------------------- lms/models/users.py | 42 ++++++++++++++++++++++++++++ lms/static/my.css | 12 ++++++-- lms/templates/changepassword.html | 23 +++++++++++++++ lms/templates/user.html | 6 ++++ tests/conftest.py | 17 +++++++++--- tests/test_registration.py | 2 +- tests/test_users.py | 26 +++++++++++++++++ 12 files changed, 200 insertions(+), 43 deletions(-) create mode 100644 lms/lmsweb/forms/change_password.py delete mode 100644 lms/models/register.py create mode 100644 lms/templates/changepassword.html diff --git a/lms/lmsdb/models.py b/lms/lmsdb/models.py index 8277e1a5..fcc94848 100644 --- a/lms/lmsdb/models.py +++ b/lms/lmsdb/models.py @@ -138,6 +138,10 @@ class User(UserMixin, BaseModel): password = CharField() role = ForeignKeyField(Role, backref='users') api_key = CharField() + session_token = CharField(unique=True) + + def get_id(self): + return str(self.session_token) def is_password_valid(self, password): return check_password_hash(self.password, password) @@ -152,6 +156,7 @@ def get_system_user(cls) -> 'User': User.role.name: Role.get_staff_role(), User.password.name: cls.random_password(), User.api_key.name: cls.random_password(), + User.session_token.name: 'something', }) return instance @@ -922,7 +927,11 @@ def create_demo_users(): user = dict(zip(fields, entity)) password = User.random_password() api_key = User.random_password(stronger=True) - User.create(**user, password=password, api_key=api_key) + session_token = generate_string() + User.create( + **user, password=password, api_key=api_key, + session_token=session_token, + ) print(f"User: {user['username']}, Password: {password}") # noqa: T001 diff --git a/lms/lmsweb/forms/change_password.py b/lms/lmsweb/forms/change_password.py new file mode 100644 index 00000000..14ff4e7c --- /dev/null +++ b/lms/lmsweb/forms/change_password.py @@ -0,0 +1,27 @@ +from flask_babel import gettext as _ # type: ignore +from flask_wtf import FlaskForm +from wtforms import PasswordField +from wtforms.validators import EqualTo, InputRequired, Length, ValidationError + + +class ChangePasswordForm(FlaskForm): + current_password = PasswordField( + 'Password', validators=[InputRequired(), Length(min=8)], id='password', + ) + password = PasswordField( + 'Password', validators=[InputRequired(), Length(min=8)], id='password', + ) + confirm = PasswordField( + 'Password Confirmation', validators=[ + InputRequired(), + EqualTo('password', message=_('הסיסמאות שהוקלדו אינן זהות')), + ], + ) + + def __init__(self, user, *args, **kwargs): + super(ChangePasswordForm, self).__init__(*args, **kwargs) + self.user = user + + def validate_current_password(self, field): + if not self.user.is_password_valid(field.data): + raise ValidationError(_('הסיסמה הנוכחית שהוזנה שגויה')) diff --git a/lms/lmsweb/tools/registration.py b/lms/lmsweb/tools/registration.py index e3ee2b50..9c02a00a 100644 --- a/lms/lmsweb/tools/registration.py +++ b/lms/lmsweb/tools/registration.py @@ -6,6 +6,7 @@ from lms.lmsdb import models from lms.lmsweb import config +from lms.models.users import generate_session_token from lms.utils.log import log import requests @@ -88,6 +89,9 @@ def _get_or_create_user_in_model(user: UserToCreate) -> None: models.User.fullname.name: f'{user.name}', models.User.role.name: models.Role.get_student_role(), models.User.password.name: user.password, + models.User.session_token.name: generate_session_token( + user.email, user.password, + ) }) def _send_user_email_registration(self, user: UserToCreate) -> None: diff --git a/lms/lmsweb/views.py b/lms/lmsweb/views.py index a80e687c..78a7cf94 100644 --- a/lms/lmsweb/views.py +++ b/lms/lmsweb/views.py @@ -12,6 +12,7 @@ ) from itsdangerous import BadSignature, SignatureExpired from werkzeug.datastructures import FileStorage +from werkzeug.security import generate_password_hash from werkzeug.utils import redirect from lms.lmsdb.models import ( @@ -26,6 +27,7 @@ CONFIRMATION_TIME, LANGUAGES, LIMITS_PER_HOUR, LIMITS_PER_MINUTE, LOCALE, MAX_UPLOAD_SIZE, ) +from lms.lmsweb.forms.change_password import ChangePasswordForm from lms.lmsweb.forms.register import RegisterForm from lms.lmsweb.manifest import MANIFEST from lms.lmsweb.redirections import ( @@ -38,8 +40,10 @@ FileSizeError, ForbiddenPermission, LmsError, UnauthorizedError, UploadError, fail, ) -from lms.models.register import SERIALIZER, send_confirmation_mail -from lms.models.users import auth, retrieve_salt +from lms.models.users import ( + SERIALIZER, auth, generate_session_token, retrieve_salt, + send_change_password_mail, send_confirmation_mail, +) from lms.utils.consts import RTL_LANGUAGES from lms.utils.files import ( get_language_name_by_extension, get_mime_type_by_extention, @@ -75,8 +79,8 @@ def _db_close(exc): @login_manager.user_loader -def load_user(user_id): - return User.get_or_none(id=user_id) +def load_user(session_token): + return User.get_or_none(session_token=session_token) @webapp.errorhandler(429) @@ -126,6 +130,9 @@ def signup(): if not form.validate_on_submit(): return render_template('signup.html', form=form) + session_token = generate_session_token( + form.username.data, form.password.data, + ) user = User.create(**{ User.mail_address.name: form.email.data, User.username.name: form.username.data, @@ -133,6 +140,7 @@ def signup(): User.role.name: Role.get_unverified_role(), User.password.name: form.password.data, User.api_key.name: User.random_password(), + User.session_token.name: session_token, }) send_confirmation_mail(user) return redirect(url_for( @@ -176,6 +184,33 @@ def confirm_email(user_id: int, token: str): )) +@webapp.route('/change-password', methods=['GET', 'POST']) +@login_required +def change_password(): + user = User.get_or_none(User.id == current_user.id) + if user is None: + return fail(404, 'User not found.') + + form = ChangePasswordForm(user) + if not form.validate_on_submit(): + return render_template('changepassword.html', form=form) + + update = User.update( + password=generate_password_hash(form.password.data), + session_token=generate_session_token( + user.username, form.password.data + ), + ).where(User.username == user.username) + update.execute() + logout_user() + send_change_password_mail(user) + return redirect(url_for( + 'login', login_message=( + _('הסיסמה שלך שונתה בהצלחה'), + ), + )) + + @webapp.route('/logout') @login_required def logout(): diff --git a/lms/models/register.py b/lms/models/register.py deleted file mode 100644 index f19937cb..00000000 --- a/lms/models/register.py +++ /dev/null @@ -1,30 +0,0 @@ -from flask import url_for -from flask_babel import gettext as _ # type: ignore -from flask_mail import Message # type: ignore -from itsdangerous import URLSafeTimedSerializer - -from lms.lmsdb.models import User -from lms.lmsweb import config, webapp, webmail -from lms.models.users import retrieve_salt - - -SERIALIZER = URLSafeTimedSerializer(config.SECRET_KEY) - - -def generate_confirmation_token(user: User) -> str: - return SERIALIZER.dumps(user.mail_address, salt=retrieve_salt(user)) - - -def send_confirmation_mail(user: User) -> None: - token = generate_confirmation_token(user) - subject = _('מייל אימות - %(site_name)s', site_name=config.SITE_NAME) - msg = Message(subject, recipients=[user.mail_address]) - link = url_for( - 'confirm_email', user_id=user.id, token=token, _external=True, - ) - msg.body = _( - 'שלום %(fullname)s,\nלינק האימות שלך למערכת הוא: %(link)s', - fullname=user.fullname, link=link, - ) - if not webapp.config.get('TESTING'): - webmail.send(msg) diff --git a/lms/models/users.py b/lms/models/users.py index bb2720a6..8f9119da 100644 --- a/lms/models/users.py +++ b/lms/models/users.py @@ -1,13 +1,18 @@ import re +from flask import url_for from flask_babel import gettext as _ # type: ignore +from flask_mail import Message # type: ignore +from itsdangerous import URLSafeTimedSerializer from lms.lmsdb.models import User +from lms.lmsweb import config, webapp, webmail from lms.models.errors import ( ForbiddenPermission, UnauthorizedError, UnhashedPasswordError, ) +SERIALIZER = URLSafeTimedSerializer(config.SECRET_KEY) HASHED_PASSWORD = re.compile(r'^pbkdf2.+?\$(?P.+?)\$(?P.+)') @@ -26,3 +31,40 @@ def auth(username: str, password: str) -> User: elif user.role.is_unverified: raise ForbiddenPermission(_('עליך לאשר את מייל האימות'), 403) return user + + +def generate_confirmation_token(user: User) -> str: + return SERIALIZER.dumps(user.mail_address, salt=retrieve_salt(user)) + + +def generate_session_token(username: str, password: str) -> str: + return SERIALIZER.dumps([username, password]) + + +def send_confirmation_mail(user: User) -> None: + token = generate_confirmation_token(user) + subject = _('מייל אימות - %(site_name)s', site_name=config.SITE_NAME) + msg = Message(subject, recipients=[user.mail_address]) + link = url_for( + 'confirm_email', user_id=user.id, token=token, _external=True, + ) + msg.body = _( + 'שלום %(fullname)s,\nלינק האימות שלך למערכת הוא: %(link)s', + fullname=user.fullname, link=link, + ) + if not webapp.config.get('TESTING'): + webmail.send(msg) + + +def send_change_password_mail(user: User) -> None: + subject = _('שינוי סיסמה - %(site_name)s', site_name=config.SITE_NAME) + msg = Message(subject, recipients=[user.mail_address]) + msg.body = _( + 'שלום %(fullname)s. הסיסמה שלך באתר %(site_name)s שונתה.\n' + 'אם אתה לא עשית את זה צור קשר עם הנהלת האתר.\n' + 'כתובת המייל: %(site_mail)s', + fullname=user.fullname, site_name=config.SITE_NAME, + site_mail=config.MAIL_DEFAULT_SENDER, + ) + if not webapp.config.get('TESTING'): + webmail.send(msg) diff --git a/lms/static/my.css b/lms/static/my.css index 4e9cd078..5cd970e8 100644 --- a/lms/static/my.css +++ b/lms/static/my.css @@ -47,7 +47,8 @@ a { } #login-container, -#signup-container { +#signup-container, +#changepassword-container { height: 100%; align-items: center; display: flex; @@ -55,7 +56,8 @@ a { } #login, -#signup { +#signup, +#changepassword { margin: auto; max-width: 420px; padding: 15px; @@ -735,6 +737,10 @@ code .grader-add .fa { text-align: center; } +/* #change-password-user { + text-align: center; +} /* + #archive-row { text-align: center; } @@ -814,7 +820,7 @@ code .grader-add .fa { width: 80vw; } -#user .user-details { +#user .user-actions { margin-bottom: 5em; } diff --git a/lms/templates/changepassword.html b/lms/templates/changepassword.html new file mode 100644 index 00000000..882c947d --- /dev/null +++ b/lms/templates/changepassword.html @@ -0,0 +1,23 @@ +{% extends 'base.html' %} +{% from "_formhelpers.html" import render_field %} + +{% block page_content %} +
+
+
+

{{ _('שינוי סיסמה') }}

+

+ {{ _('הזינו סיסמה ישנה וסיסמה חדשה לצורך שינוי הסיסמה:') }} +

+
+ {{ render_field(form.current_password, cls="form-control form-control-lg", placeholder=_('סיסמה נוכחית')) }} + {{ render_field(form.password, cls="form-control form-control-lg", placeholder=_('סיסמה חדשה')) }} + {{ render_field(form.confirm, cls="form-control form-control-lg", placeholder=_('אימות סיסמה חדשה')) }} + + + +
+
+
+
+{% endblock %} diff --git a/lms/templates/user.html b/lms/templates/user.html index 8523bd80..1509d41f 100644 --- a/lms/templates/user.html +++ b/lms/templates/user.html @@ -12,6 +12,12 @@

{{ _('פרטי משתמש:') }}

  • {{ _('דואר אלקטרוני:') }} {{ user.mail_address | e }}
    • +

    {{ _('תרגילים שהוגשו:') }}

    diff --git a/tests/conftest.py b/tests/conftest.py index 93caf4b9..6877da8d 100644 --- a/tests/conftest.py +++ b/tests/conftest.py @@ -19,6 +19,7 @@ from lms.lmstests.sandbox import celery_app as sandbox_app from lms.lmsweb import limiter, routes, webapp from lms.models import notifications +from lms.models.users import generate_session_token @pytest.fixture(autouse=True, scope='session') @@ -123,13 +124,17 @@ def create_user( role_name: str = RoleOptions.STUDENT.value, index: int = 1, ) -> User: + username = f'{role_name}-{index}' + password = 'fake pass' + session_token = generate_session_token(username, password) return User.create( # NOQA: S106 - username=f'{role_name}-{index}', + username=username, fullname=f'A{role_name}', mail_address=f'so-{role_name}-{index}@mail.com', - password='fake pass', + password=password, api_key='fake key', role=Role.by_name(role_name), + session_token=session_token, ) @@ -177,13 +182,17 @@ def student_user(): @pytest.fixture() def admin_user(): admin_role = Role.get(Role.name == RoleOptions.ADMINISTRATOR.value) + username = 'Yam' + password = 'fake pass' + session_token = generate_session_token(username, password) return User.create( # NOQA: B106, S106 - username='Yam', + username=username, fullname='Buya', mail_address='mymail@mail.com', - password='fake pass', + password=password, api_key='fake key', role=admin_role, + session_token=session_token, ) diff --git a/tests/test_registration.py b/tests/test_registration.py index f09b4d49..a3615d13 100644 --- a/tests/test_registration.py +++ b/tests/test_registration.py @@ -5,7 +5,7 @@ from lms.lmsweb.config import CONFIRMATION_TIME from lms.lmsdb.models import User -from lms.models.register import generate_confirmation_token +from lms.models.users import generate_confirmation_token from tests import conftest diff --git a/tests/test_users.py b/tests/test_users.py index 043570ca..85cb24cb 100644 --- a/tests/test_users.py +++ b/tests/test_users.py @@ -68,3 +68,29 @@ def test_banned_user(client: FlaskClient, banned_user: User): 'password': 'fake pass', }, follow_redirects=True) assert 'banned' in login_response.get_data(as_text=True) + + @staticmethod + def test_invalid_change_password(captured_templates): + student_user = conftest.create_student_user(index=1) + client = conftest.get_logged_user(student_user.username) + client.post('/change-password', data={ + 'current_password': 'wrong pass', + 'password': 'some_password', + 'confirm': 'some_password', + }, follow_redirects=True) + template, _ = captured_templates[-1] + assert template.name == "changepassword.html" + + @staticmethod + def test_valid_change_password(captured_templates): + student_user = conftest.create_student_user(index=1) + client = conftest.get_logged_user(student_user.username) + client.post('/change-password', data={ + 'current_password': 'fake pass', + 'password': 'some_password', + 'confirm': 'some_password', + }, follow_redirects=True) + template, _ = captured_templates[-1] + assert template.name == "login.html" + check_logout_response = client.get('/exercises') + assert check_logout_response.status_code == 302 From 647378f1cb76a2c149d28704be1f64b421ae9260 Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Tue, 14 Sep 2021 18:59:36 +0300 Subject: [PATCH 27/51] Added a comma --- lms/lmsweb/tools/registration.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lms/lmsweb/tools/registration.py b/lms/lmsweb/tools/registration.py index 9c02a00a..048c142b 100644 --- a/lms/lmsweb/tools/registration.py +++ b/lms/lmsweb/tools/registration.py @@ -91,7 +91,7 @@ def _get_or_create_user_in_model(user: UserToCreate) -> None: models.User.password.name: user.password, models.User.session_token.name: generate_session_token( user.email, user.password, - ) + ), }) def _send_user_email_registration(self, user: UserToCreate) -> None: From e6dcbd5432c0959193adb42995d7ac74cbdcd6d9 Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Tue, 14 Sep 2021 19:03:13 +0300 Subject: [PATCH 28/51] Added a comma --- lms/lmsweb/views.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lms/lmsweb/views.py b/lms/lmsweb/views.py index 3081e4c5..6a25735b 100644 --- a/lms/lmsweb/views.py +++ b/lms/lmsweb/views.py @@ -200,7 +200,7 @@ def change_password(): update = User.update( password=generate_password_hash(form.password.data), session_token=generate_session_token( - user.username, form.password.data + user.username, form.password.data, ), ).where(User.username == user.username) update.execute() From 505d1872a3ce796ea343f49e8e2b8799e5174b6c Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Wed, 15 Sep 2021 09:34:46 +0300 Subject: [PATCH 29/51] - Moved the send mails methods into utils/mail.py - Added _invalid_tries to session in order to limit the tries of invalid change password - Added INVALID_TRIES variable to the config --- lms/lmsdb/models.py | 2 +- lms/lmsweb/config.py.example | 3 +++ lms/lmsweb/forms/change_password.py | 6 +++++ lms/lmsweb/views.py | 20 ++++++++-------- lms/models/users.py | 33 +------------------------- lms/templates/user.html | 4 +++- lms/utils/mail.py | 36 +++++++++++++++++++++++++++++ 7 files changed, 59 insertions(+), 45 deletions(-) create mode 100644 lms/utils/mail.py diff --git a/lms/lmsdb/models.py b/lms/lmsdb/models.py index fcc94848..327be737 100644 --- a/lms/lmsdb/models.py +++ b/lms/lmsdb/models.py @@ -156,7 +156,7 @@ def get_system_user(cls) -> 'User': User.role.name: Role.get_staff_role(), User.password.name: cls.random_password(), User.api_key.name: cls.random_password(), - User.session_token.name: 'something', + User.session_token.name: cls.random_password(), }) return instance diff --git a/lms/lmsweb/config.py.example b/lms/lmsweb/config.py.example index d1c500f5..f2e71dc7 100644 --- a/lms/lmsweb/config.py.example +++ b/lms/lmsweb/config.py.example @@ -63,3 +63,6 @@ LOCALE = 'en' # Limiter settings LIMITS_PER_MINUTE = 5 LIMITS_PER_HOUR = 50 + +# Change password settings +INVALID_TRIES = 5 diff --git a/lms/lmsweb/forms/change_password.py b/lms/lmsweb/forms/change_password.py index 14ff4e7c..b06350cb 100644 --- a/lms/lmsweb/forms/change_password.py +++ b/lms/lmsweb/forms/change_password.py @@ -1,8 +1,11 @@ +from flask import session from flask_babel import gettext as _ # type: ignore from flask_wtf import FlaskForm from wtforms import PasswordField from wtforms.validators import EqualTo, InputRequired, Length, ValidationError +from lms.lmsweb.config import INVALID_TRIES + class ChangePasswordForm(FlaskForm): current_password = PasswordField( @@ -23,5 +26,8 @@ def __init__(self, user, *args, **kwargs): self.user = user def validate_current_password(self, field): + if session['_invalid_tries'] == INVALID_TRIES: + raise ValidationError(_('הזנת סיסמה שגוייה מספר רב מידי של פעמים')) if not self.user.is_password_valid(field.data): + session['_invalid_tries'] += 1 raise ValidationError(_('הסיסמה הנוכחית שהוזנה שגויה')) diff --git a/lms/lmsweb/views.py b/lms/lmsweb/views.py index 6a25735b..67a9a06a 100644 --- a/lms/lmsweb/views.py +++ b/lms/lmsweb/views.py @@ -2,8 +2,8 @@ import arrow # type: ignore from flask import ( - jsonify, make_response, render_template, - request, send_from_directory, url_for, + jsonify, make_response, render_template, request, + send_from_directory, session, url_for, ) from flask_babel import gettext as _ # type: ignore from flask_limiter.util import get_remote_address # type: ignore @@ -12,7 +12,6 @@ ) from itsdangerous import BadSignature, SignatureExpired from werkzeug.datastructures import FileStorage -from werkzeug.security import generate_password_hash from werkzeug.utils import redirect from lms.lmsdb.models import ( @@ -42,13 +41,13 @@ ) from lms.models.users import ( SERIALIZER, auth, generate_session_token, retrieve_salt, - send_change_password_mail, send_confirmation_mail, ) from lms.utils.consts import RTL_LANGUAGES from lms.utils.files import ( get_language_name_by_extension, get_mime_type_by_extention, ) from lms.utils.log import log +from lms.utils.mail import send_change_password_mail, send_confirmation_mail HIGH_ROLES = {str(RoleOptions.STAFF), str(RoleOptions.ADMINISTRATOR)} @@ -114,6 +113,7 @@ def login(login_message: Optional[str] = None): return redirect(url_for('login', **error_details)) else: login_user(user) + session['_invalid_tries'] = 0 return get_next_url(next_page) return render_template('login.html', login_message=login_message) @@ -197,13 +197,11 @@ def change_password(): if not form.validate_on_submit(): return render_template('changepassword.html', form=form) - update = User.update( - password=generate_password_hash(form.password.data), - session_token=generate_session_token( - user.username, form.password.data, - ), - ).where(User.username == user.username) - update.execute() + user.password = form.password.data + user.session_token = generate_session_token( + user.username, form.password.data, + ) + user.save() logout_user() send_change_password_mail(user) return redirect(url_for( diff --git a/lms/models/users.py b/lms/models/users.py index 8f9119da..19ac8d21 100644 --- a/lms/models/users.py +++ b/lms/models/users.py @@ -1,12 +1,10 @@ import re -from flask import url_for from flask_babel import gettext as _ # type: ignore -from flask_mail import Message # type: ignore from itsdangerous import URLSafeTimedSerializer from lms.lmsdb.models import User -from lms.lmsweb import config, webapp, webmail +from lms.lmsweb import config from lms.models.errors import ( ForbiddenPermission, UnauthorizedError, UnhashedPasswordError, ) @@ -39,32 +37,3 @@ def generate_confirmation_token(user: User) -> str: def generate_session_token(username: str, password: str) -> str: return SERIALIZER.dumps([username, password]) - - -def send_confirmation_mail(user: User) -> None: - token = generate_confirmation_token(user) - subject = _('מייל אימות - %(site_name)s', site_name=config.SITE_NAME) - msg = Message(subject, recipients=[user.mail_address]) - link = url_for( - 'confirm_email', user_id=user.id, token=token, _external=True, - ) - msg.body = _( - 'שלום %(fullname)s,\nלינק האימות שלך למערכת הוא: %(link)s', - fullname=user.fullname, link=link, - ) - if not webapp.config.get('TESTING'): - webmail.send(msg) - - -def send_change_password_mail(user: User) -> None: - subject = _('שינוי סיסמה - %(site_name)s', site_name=config.SITE_NAME) - msg = Message(subject, recipients=[user.mail_address]) - msg.body = _( - 'שלום %(fullname)s. הסיסמה שלך באתר %(site_name)s שונתה.\n' - 'אם אתה לא עשית את זה צור קשר עם הנהלת האתר.\n' - 'כתובת המייל: %(site_mail)s', - fullname=user.fullname, site_name=config.SITE_NAME, - site_mail=config.MAIL_DEFAULT_SENDER, - ) - if not webapp.config.get('TESTING'): - webmail.send(msg) diff --git a/lms/templates/user.html b/lms/templates/user.html index 1509d41f..a58d8fa4 100644 --- a/lms/templates/user.html +++ b/lms/templates/user.html @@ -15,7 +15,9 @@

    {{ _('פרטי משתמש:') }}

    diff --git a/lms/utils/mail.py b/lms/utils/mail.py new file mode 100644 index 00000000..f3330b16 --- /dev/null +++ b/lms/utils/mail.py @@ -0,0 +1,36 @@ +from flask import url_for +from flask_babel import gettext as _ # type: ignore +from flask_mail import Message # type: ignore + +from lms.lmsdb.models import User +from lms.lmsweb import config, webapp, webmail +from lms.models.users import generate_confirmation_token + + +def send_confirmation_mail(user: User) -> None: + token = generate_confirmation_token(user) + subject = _('מייל אימות - %(site_name)s', site_name=config.SITE_NAME) + msg = Message(subject, recipients=[user.mail_address]) + link = url_for( + 'confirm_email', user_id=user.id, token=token, _external=True, + ) + msg.body = _( + 'שלום %(fullname)s,\nלינק האימות שלך למערכת הוא: %(link)s', + fullname=user.fullname, link=link, + ) + if not webapp.config.get('TESTING'): + webmail.send(msg) + + +def send_change_password_mail(user: User) -> None: + subject = _('שינוי סיסמה - %(site_name)s', site_name=config.SITE_NAME) + msg = Message(subject, recipients=[user.mail_address]) + msg.body = _( + 'שלום %(fullname)s. הסיסמה שלך באתר %(site_name)s שונתה.\n' + 'אם אתה לא עשית את זה צור קשר עם הנהלת האתר.\n' + 'כתובת המייל: %(site_mail)s', + fullname=user.fullname, site_name=config.SITE_NAME, + site_mail=config.MAIL_DEFAULT_SENDER, + ) + if not webapp.config.get('TESTING'): + webmail.send(msg) From e65511c042f205b27ee67fa660acd6acfafa1eaa Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Wed, 15 Sep 2021 10:05:33 +0300 Subject: [PATCH 30/51] Added a test for invalid_tries change password --- tests/test_users.py | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/tests/test_users.py b/tests/test_users.py index 85cb24cb..40991afd 100644 --- a/tests/test_users.py +++ b/tests/test_users.py @@ -1,6 +1,7 @@ from flask.testing import FlaskClient from lms.lmsdb.models import User +from lms.lmsweb.config import INVALID_TRIES from tests import conftest @@ -73,13 +74,14 @@ def test_banned_user(client: FlaskClient, banned_user: User): def test_invalid_change_password(captured_templates): student_user = conftest.create_student_user(index=1) client = conftest.get_logged_user(student_user.username) - client.post('/change-password', data={ - 'current_password': 'wrong pass', - 'password': 'some_password', - 'confirm': 'some_password', - }, follow_redirects=True) - template, _ = captured_templates[-1] - assert template.name == "changepassword.html" + for _ in range(INVALID_TRIES): + client.post('/change-password', data={ + 'current_password': 'wrong pass', + 'password': 'some_password', + 'confirm': 'some_password', + }, follow_redirects=True) + template, _ = captured_templates[-1] + assert template.name == "changepassword.html" @staticmethod def test_valid_change_password(captured_templates): From f2e5b0fd7b2465fdac920a8e75e81d729b3421a7 Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Wed, 15 Sep 2021 10:10:17 +0300 Subject: [PATCH 31/51] Added a test for invalid_tries change password --- tests/test_users.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/test_users.py b/tests/test_users.py index 40991afd..704c0bf5 100644 --- a/tests/test_users.py +++ b/tests/test_users.py @@ -74,7 +74,7 @@ def test_banned_user(client: FlaskClient, banned_user: User): def test_invalid_change_password(captured_templates): student_user = conftest.create_student_user(index=1) client = conftest.get_logged_user(student_user.username) - for _ in range(INVALID_TRIES): + for _ in range(INVALID_TRIES + 1): client.post('/change-password', data={ 'current_password': 'wrong pass', 'password': 'some_password', From c4621fd129e80b82d5e832701710503438d92e59 Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Wed, 15 Sep 2021 10:49:06 +0300 Subject: [PATCH 32/51] Added a test for invalid_tries change password --- tests/test_users.py | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/tests/test_users.py b/tests/test_users.py index 704c0bf5..35629cf5 100644 --- a/tests/test_users.py +++ b/tests/test_users.py @@ -74,7 +74,7 @@ def test_banned_user(client: FlaskClient, banned_user: User): def test_invalid_change_password(captured_templates): student_user = conftest.create_student_user(index=1) client = conftest.get_logged_user(student_user.username) - for _ in range(INVALID_TRIES + 1): + for _ in range(INVALID_TRIES): client.post('/change-password', data={ 'current_password': 'wrong pass', 'password': 'some_password', @@ -83,6 +83,14 @@ def test_invalid_change_password(captured_templates): template, _ = captured_templates[-1] assert template.name == "changepassword.html" + client.post('/change-password', data={ + 'current_password': 'fake pass', + 'password': 'some_password', + 'confirm': 'some_password', + }, follow_redirects=True) + template, _ = captured_templates[-1] + assert template.name == "changepassword.html" + @staticmethod def test_valid_change_password(captured_templates): student_user = conftest.create_student_user(index=1) From 9e1bd571f87e0863afbf5ded3621a906fffc040c Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Wed, 15 Sep 2021 12:46:20 +0300 Subject: [PATCH 33/51] - Added forgot my password template and css style - Added a link from login page - Added in the backend the forms - Added mails to reset password - Added tests --- lms/lmsweb/forms/reset_password.py | 27 +++++++++ lms/lmsweb/tools/validators.py | 8 +++ lms/lmsweb/views.py | 62 ++++++++++++++++++++- lms/models/users.py | 2 +- lms/static/my.css | 11 ++-- lms/templates/_formhelpers.html | 2 +- lms/templates/login.html | 1 + lms/templates/recoverpassword.html | 23 ++++++++ lms/templates/resetpassword.html | 22 ++++++++ lms/templates/signup.html | 2 +- lms/utils/mail.py | 19 ++++++- tests/test_registration.py | 10 ++-- tests/test_users.py | 88 +++++++++++++++++++++++++++++- 13 files changed, 261 insertions(+), 16 deletions(-) create mode 100644 lms/lmsweb/forms/reset_password.py create mode 100644 lms/templates/recoverpassword.html create mode 100644 lms/templates/resetpassword.html diff --git a/lms/lmsweb/forms/reset_password.py b/lms/lmsweb/forms/reset_password.py new file mode 100644 index 00000000..49bc9afe --- /dev/null +++ b/lms/lmsweb/forms/reset_password.py @@ -0,0 +1,27 @@ +from lms.lmsweb.tools.validators import EmailNotExists +from flask_babel import gettext as _ # type: ignore +from flask_wtf import FlaskForm +from wtforms import StringField +from wtforms.fields.simple import PasswordField +from wtforms.validators import Email, EqualTo, InputRequired, Length + + +class ResetPassForm(FlaskForm): + email = StringField( + 'Email', validators=[ + InputRequired(), Email(message=_('אימייל לא תקין')), + EmailNotExists, + ], + ) + + +class RecoverPassForm(FlaskForm): + password = PasswordField( + 'Password', validators=[InputRequired(), Length(min=8)], id='password', + ) + confirm = PasswordField( + 'Password Confirmation', validators=[ + InputRequired(), + EqualTo('password', message=_('הסיסמאות שהוקלדו אינן זהות')), + ], + ) diff --git a/lms/lmsweb/tools/validators.py b/lms/lmsweb/tools/validators.py index 2f502b60..580c68d9 100644 --- a/lms/lmsweb/tools/validators.py +++ b/lms/lmsweb/tools/validators.py @@ -19,3 +19,11 @@ def UniqueEmailRequired( email_exists = User.get_or_none(User.mail_address == field.data) if email_exists: raise ValidationError(_('האימייל כבר נמצא בשימוש')) + + +def EmailNotExists( + _form: 'ResetPassForm', field: StringField, # type: ignore # NOQA: F821 +) -> None: + email_exists = User.get_or_none(User.mail_address == field.data) + if not email_exists: + raise ValidationError(_('האימייל לא רשום במערכת')) diff --git a/lms/lmsweb/views.py b/lms/lmsweb/views.py index 67a9a06a..857e6488 100644 --- a/lms/lmsweb/views.py +++ b/lms/lmsweb/views.py @@ -28,6 +28,7 @@ ) from lms.lmsweb.forms.change_password import ChangePasswordForm from lms.lmsweb.forms.register import RegisterForm +from lms.lmsweb.forms.reset_password import RecoverPassForm, ResetPassForm from lms.lmsweb.manifest import MANIFEST from lms.lmsweb.redirections import ( PERMISSIVE_CORS, get_next_url, login_manager, @@ -47,7 +48,10 @@ get_language_name_by_extension, get_mime_type_by_extention, ) from lms.utils.log import log -from lms.utils.mail import send_change_password_mail, send_confirmation_mail +from lms.utils.mail import ( + send_change_password_mail, send_confirmation_mail, + send_reset_password_mail, +) HIGH_ROLES = {str(RoleOptions.STAFF), str(RoleOptions.ADMINISTRATOR)} @@ -211,6 +215,62 @@ def change_password(): )) +@webapp.route('/reset-password', methods=['GET', 'POST']) +@limiter.limit(f'{LIMITS_PER_MINUTE}/minute;{LIMITS_PER_HOUR}/hour') +def reset_password(): + form = ResetPassForm() + if not form.validate_on_submit(): + return render_template('resetpassword.html', form=form) + + user = User.get_or_none(User.mail_address == form.email.data) + + send_reset_password_mail(user) + return redirect(url_for( + 'login', login_message=_('קישור לאיפוס הסיסמה נשלח בהצלחה'), + )) + + +@webapp.route( + '/recover-password//', methods=['GET', 'POST'], +) +@limiter.limit(f'{LIMITS_PER_MINUTE}/minute;{LIMITS_PER_HOUR}/hour') +def recover_password(user_id: int, token: str): + user = User.get_or_none(User.id == user_id) + if user is None: + return fail(404, 'The authentication code is invalid.') + + try: + SERIALIZER.loads( + token, salt=retrieve_salt(user), max_age=CONFIRMATION_TIME, + ) + + except SignatureExpired: + return redirect(url_for( + 'login', login_message=( + _('קישור איפוס הסיסמה פג תוקף'), + ), + )) + except BadSignature: + return fail(404, 'The authentication code is invalid.') + + else: + form = RecoverPassForm() + if not form.validate_on_submit(): + return render_template( + 'recoverpassword.html', form=form, id=user.id, token=token, + ) + user.password = form.password.data + user.session_token = generate_session_token( + user.username, form.password.data, + ) + user.save() + return redirect(url_for( + 'login', login_message=( + _('הסיסמה שלך שונתה בהצלחה'), + ), + )) + + @webapp.route('/logout') @login_required def logout(): diff --git a/lms/models/users.py b/lms/models/users.py index 19ac8d21..9542c0e8 100644 --- a/lms/models/users.py +++ b/lms/models/users.py @@ -31,7 +31,7 @@ def auth(username: str, password: str) -> User: return user -def generate_confirmation_token(user: User) -> str: +def generate_user_token(user: User) -> str: return SERIALIZER.dumps(user.mail_address, salt=retrieve_salt(user)) diff --git a/lms/static/my.css b/lms/static/my.css index 5cd970e8..499351b6 100644 --- a/lms/static/my.css +++ b/lms/static/my.css @@ -48,7 +48,8 @@ a { #login-container, #signup-container, -#changepassword-container { +#changepassword-container, +#resetpassword-container { height: 100%; align-items: center; display: flex; @@ -57,7 +58,8 @@ a { #login, #signup, -#changepassword { +#changepassword, +#resetpassword { margin: auto; max-width: 420px; padding: 15px; @@ -65,12 +67,13 @@ a { } #login-logo, -#signup-logo { +#signup-logo, +#resetpassword-logo { margin-bottom: 1rem; } #login-message-box, -#signup-errors { +#form-errors { background: #f1c8c8; color: #860606; } diff --git a/lms/templates/_formhelpers.html b/lms/templates/_formhelpers.html index 4175e804..85aa7a7d 100644 --- a/lms/templates/_formhelpers.html +++ b/lms/templates/_formhelpers.html @@ -2,7 +2,7 @@
    {{ field(class=cls, **kwargs) | safe }} -
    +
    {% if field.errors %} {% for error in field.errors %} {{ error }} diff --git a/lms/templates/login.html b/lms/templates/login.html index b57f9238..f26ae6f6 100644 --- a/lms/templates/login.html +++ b/lms/templates/login.html @@ -33,6 +33,7 @@

    {{ _('התחברות') }}

    + {{ _('שכחת את הסיסמה?') }} {% if config.REGISTRATION_OPEN %}
    diff --git a/lms/templates/recoverpassword.html b/lms/templates/recoverpassword.html new file mode 100644 index 00000000..c1b19799 --- /dev/null +++ b/lms/templates/recoverpassword.html @@ -0,0 +1,23 @@ +{% extends 'base.html' %} +{% from "_formhelpers.html" import render_field %} + +{% block page_content %} +
    +
    +
    + +

    {{ _('איפוס סיסמה') }}

    +

    + {{ _('הזינו סיסמה לצורך שינוי הסיסמה:') }} +

    +
    + {{ render_field(form.password, cls="form-control form-control-lg", placeholder=_('סיסמה חדשה')) }} + {{ render_field(form.confirm, cls="form-control form-control-lg", placeholder=_('אימות סיסמה חדשה')) }} + + + + +
    +
    +
    +{% endblock %} diff --git a/lms/templates/resetpassword.html b/lms/templates/resetpassword.html new file mode 100644 index 00000000..32ef554a --- /dev/null +++ b/lms/templates/resetpassword.html @@ -0,0 +1,22 @@ +{% extends 'base.html' %} +{% from "_formhelpers.html" import render_field %} + +{% block page_content %} +
    +
    +
    + +

    {{ _('איפוס סיסמה') }}

    +

    + {{ _('הזינו אימייל לצורך שליחת קישור לאיפוס הסיסמה:') }} +

    +
    + {{ render_field(form.email, cls="form-control form-control-lg", placeholder=_('כתובת אימייל')) }} + + +
    + {{ _('חזרה לדף ההתחברות') }} +
    +
    +
    +{% endblock %} diff --git a/lms/templates/signup.html b/lms/templates/signup.html index b888068b..d65e6afb 100644 --- a/lms/templates/signup.html +++ b/lms/templates/signup.html @@ -21,7 +21,7 @@

    {{ _('הרשמה') }}

    -
    +
    {{ _('חזרה לדף ההתחברות') }}
    diff --git a/lms/utils/mail.py b/lms/utils/mail.py index f3330b16..d762847f 100644 --- a/lms/utils/mail.py +++ b/lms/utils/mail.py @@ -4,11 +4,11 @@ from lms.lmsdb.models import User from lms.lmsweb import config, webapp, webmail -from lms.models.users import generate_confirmation_token +from lms.models.users import generate_user_token def send_confirmation_mail(user: User) -> None: - token = generate_confirmation_token(user) + token = generate_user_token(user) subject = _('מייל אימות - %(site_name)s', site_name=config.SITE_NAME) msg = Message(subject, recipients=[user.mail_address]) link = url_for( @@ -22,6 +22,21 @@ def send_confirmation_mail(user: User) -> None: webmail.send(msg) +def send_reset_password_mail(user: User) -> None: + token = generate_user_token(user) + subject = _('מייל איפוס סיסמה - %(site_name)s', site_name=config.SITE_NAME) + msg = Message(subject, recipients=[user.mail_address]) + link = url_for( + 'recover_password', user_id=user.id, token=token, _external=True, + ) + msg.body = _( + 'שלום %(fullname)s,\nלינק לצורך איפוס הסיסמה שלך הוא: %(link)s', + fullname=user.fullname, link=link, + ) + if not webapp.config.get('TESTING'): + webmail.send(msg) + + def send_change_password_mail(user: User) -> None: subject = _('שינוי סיסמה - %(site_name)s', site_name=config.SITE_NAME) msg = Message(subject, recipients=[user.mail_address]) diff --git a/tests/test_registration.py b/tests/test_registration.py index a3615d13..c0469d77 100644 --- a/tests/test_registration.py +++ b/tests/test_registration.py @@ -5,7 +5,7 @@ from lms.lmsweb.config import CONFIRMATION_TIME from lms.lmsdb.models import User -from lms.models.users import generate_confirmation_token +from lms.models.users import generate_user_token from tests import conftest @@ -72,7 +72,7 @@ def test_successful_registration(client: FlaskClient, captured_templates): assert fail_login_response.status_code == 302 user = User.get_or_none(User.username == 'some_user') - token = generate_confirmation_token(user) + token = generate_user_token(user) client.get(f'/confirm-email/{user.id}/{token}', follow_redirects=True) client.post('/login', data={ 'username': 'some_user', @@ -113,7 +113,7 @@ def test_use_token_twice(client: FlaskClient): 'confirm': 'some_password', }, follow_redirects=True) user = User.get_or_none(User.username == 'some_user') - token = generate_confirmation_token(user) + token = generate_user_token(user) success_token_response = client.get( f'/confirm-email/{user.id}/{token}', follow_redirects=True, ) @@ -134,7 +134,7 @@ def test_expired_token(client: FlaskClient): 'confirm': 'some_password', }, follow_redirects=True) user = User.get_or_none(User.username == 'some_user') - token = generate_confirmation_token(user) + token = generate_user_token(user) fake_time = time.time() + CONFIRMATION_TIME + 1 with patch('time.time', Mock(return_value=fake_time)): @@ -148,7 +148,7 @@ def test_expired_token(client: FlaskClient): fail_login_response = client.get('/exercises') assert fail_login_response.status_code == 302 - token = generate_confirmation_token(user) + token = generate_user_token(user) client.get( f'/confirm-email/{user.id}/{token}', follow_redirects=True, ) diff --git a/tests/test_users.py b/tests/test_users.py index 35629cf5..d6df2842 100644 --- a/tests/test_users.py +++ b/tests/test_users.py @@ -1,7 +1,11 @@ +import time +from unittest.mock import Mock, patch + from flask.testing import FlaskClient from lms.lmsdb.models import User -from lms.lmsweb.config import INVALID_TRIES +from lms.lmsweb.config import CONFIRMATION_TIME, INVALID_TRIES +from lms.models.users import generate_user_token from tests import conftest @@ -104,3 +108,85 @@ def test_valid_change_password(captured_templates): assert template.name == "login.html" check_logout_response = client.get('/exercises') assert check_logout_response.status_code == 302 + + @staticmethod + def test_forgot_my_password(client: FlaskClient, captured_templates): + user = conftest.create_student_user(index=1) + client.post('/reset-password', data={ + 'email': 'fake-mail@mail.com', + }, follow_redirects=True) + template, _ = captured_templates[-1] + assert template.name == "resetpassword.html" + + client.post('/reset-password', data={ + 'email': user.mail_address, + }, follow_redirects=True) + template, _ = captured_templates[-1] + assert template.name == "login.html" + + token = generate_user_token(user) + client.post(f'/recover-password/{user.id}/{token}', data={ + 'password': 'wrong pass', + 'confirm': 'different pass', + }, follow_redirects=True) + template, _ = captured_templates[-1] + assert template.name == "recoverpassword.html" + + client.post(f'/recover-password/{user.id}/{token}', data={ + 'password': 'new pass', + 'confirm': 'new pass', + }, follow_redirects=True) + template, _ = captured_templates[-1] + assert template.name == "login.html" + + second_try_response = client.post( + f'/recover-password/{user.id}/{token}', data={ + 'password': 'new pass1', + 'confirm': 'new pass1', + }, follow_redirects=True, + ) + assert second_try_response.status_code == 404 + + client.post('/login', data={ + 'username': user.username, + 'password': 'fake pass', + }, follow_redirects=True) + template, _ = captured_templates[-1] + assert template.name == 'login.html' + + client.post('/login', data={ + 'username': user.username, + 'password': 'new pass', + }, follow_redirects=True) + template, _ = captured_templates[-1] + assert template.name == 'exercises.html' + + @staticmethod + def test_expired_token(client: FlaskClient): + user = conftest.create_student_user(index=1) + client.post('/reset-password', data={ + 'email': user.mail_address, + }, follow_redirects=True) + token = generate_user_token(user) + + fake_time = time.time() + CONFIRMATION_TIME + 1 + with patch('time.time', Mock(return_value=fake_time)): + client.post( + f'/recover-password/{user.id}/{token}', data={ + 'password': 'new pass1', + 'confirm': 'new pass1', + }, follow_redirects=True, + ) + client.post('/login', data={ + 'username': user.username, + 'password': 'new pass1', + }, follow_redirects=True) + fail_login_response = client.get('/exercises') + assert fail_login_response.status_code == 302 + + client.post('/login', data={ + 'username': user.username, + 'password': 'fake pass', + }, follow_redirects=True) + fail_login_response = client.get('/exercises') + assert fail_login_response.status_code == 200 From 1d27a182415e3e12306021b57af95a6dddbc107a Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Wed, 15 Sep 2021 17:36:18 +0300 Subject: [PATCH 34/51] Fixed some changes requested --- lms/lmsweb/forms/change_password.py | 4 ++-- lms/lmsweb/views.py | 32 ++++++++++++++++------------- lms/templates/changepassword.html | 2 +- lms/templates/login.html | 6 +++--- lms/templates/recoverpassword.html | 2 +- lms/templates/resetpassword.html | 2 +- lms/templates/signup.html | 2 +- lms/utils/mail.py | 30 +++++++++++++++++++-------- 8 files changed, 48 insertions(+), 32 deletions(-) diff --git a/lms/lmsweb/forms/change_password.py b/lms/lmsweb/forms/change_password.py index b06350cb..388df1ac 100644 --- a/lms/lmsweb/forms/change_password.py +++ b/lms/lmsweb/forms/change_password.py @@ -26,8 +26,8 @@ def __init__(self, user, *args, **kwargs): self.user = user def validate_current_password(self, field): - if session['_invalid_tries'] == INVALID_TRIES: - raise ValidationError(_('הזנת סיסמה שגוייה מספר רב מידי של פעמים')) + if session['_invalid_tries'] >= INVALID_TRIES: + raise ValidationError(_('הזנת סיסמה שגויה מספר רב מדי של פעמים')) if not self.user.is_password_valid(field.data): session['_invalid_tries'] += 1 raise ValidationError(_('הסיסמה הנוכחית שהוזנה שגויה')) diff --git a/lms/lmsweb/views.py b/lms/lmsweb/views.py index 857e6488..c2048bae 100644 --- a/lms/lmsweb/views.py +++ b/lms/lmsweb/views.py @@ -254,21 +254,25 @@ def recover_password(user_id: int, token: str): return fail(404, 'The authentication code is invalid.') else: - form = RecoverPassForm() - if not form.validate_on_submit(): - return render_template( - 'recoverpassword.html', form=form, id=user.id, token=token, - ) - user.password = form.password.data - user.session_token = generate_session_token( - user.username, form.password.data, + return recover_password_check(user, token) + + +def recover_password_check(user: User, token: str): + form = RecoverPassForm() + if not form.validate_on_submit(): + return render_template( + 'recoverpassword.html', form=form, id=user.id, token=token, ) - user.save() - return redirect(url_for( - 'login', login_message=( - _('הסיסמה שלך שונתה בהצלחה'), - ), - )) + user.password = form.password.data + user.session_token = generate_session_token( + user.username, form.password.data, + ) + user.save() + return redirect(url_for( + 'login', login_message=( + _('הסיסמה שלך שונתה בהצלחה'), + ), + )) @webapp.route('/logout') diff --git a/lms/templates/changepassword.html b/lms/templates/changepassword.html index 882c947d..6e32eb91 100644 --- a/lms/templates/changepassword.html +++ b/lms/templates/changepassword.html @@ -9,7 +9,7 @@

    {{ _('שינוי סיסמה')

    {{ _('הזינו סיסמה ישנה וסיסמה חדשה לצורך שינוי הסיסמה:') }}

    -
    + {{ render_field(form.current_password, cls="form-control form-control-lg", placeholder=_('סיסמה נוכחית')) }} {{ render_field(form.password, cls="form-control form-control-lg", placeholder=_('סיסמה חדשה')) }} {{ render_field(form.confirm, cls="form-control form-control-lg", placeholder=_('אימות סיסמה חדשה')) }} diff --git a/lms/templates/login.html b/lms/templates/login.html index f26ae6f6..f76945de 100644 --- a/lms/templates/login.html +++ b/lms/templates/login.html @@ -17,7 +17,7 @@

    {{ _('התחברות') }}

    {% endif %} - +
    @@ -33,11 +33,11 @@

    {{ _('התחברות') }}

    - {{ _('שכחת את הסיסמה?') }} + {{ _('שכחת את הסיסמה?') }} {% if config.REGISTRATION_OPEN %}
    - {{ _('הירשם') }} + {{ _('הירשם') }} {% endif %}
    diff --git a/lms/templates/recoverpassword.html b/lms/templates/recoverpassword.html index c1b19799..10caf141 100644 --- a/lms/templates/recoverpassword.html +++ b/lms/templates/recoverpassword.html @@ -10,7 +10,7 @@

    {{ _('איפוס סיסמה')

    {{ _('הזינו סיסמה לצורך שינוי הסיסמה:') }}

    -
    + {{ render_field(form.password, cls="form-control form-control-lg", placeholder=_('סיסמה חדשה')) }} {{ render_field(form.confirm, cls="form-control form-control-lg", placeholder=_('אימות סיסמה חדשה')) }} diff --git a/lms/templates/resetpassword.html b/lms/templates/resetpassword.html index 32ef554a..fc5024ba 100644 --- a/lms/templates/resetpassword.html +++ b/lms/templates/resetpassword.html @@ -10,7 +10,7 @@

    {{ _('איפוס סיסמה')

    {{ _('הזינו אימייל לצורך שליחת קישור לאיפוס הסיסמה:') }}

    - + {{ render_field(form.email, cls="form-control form-control-lg", placeholder=_('כתובת אימייל')) }} diff --git a/lms/templates/signup.html b/lms/templates/signup.html index d65e6afb..226478fa 100644 --- a/lms/templates/signup.html +++ b/lms/templates/signup.html @@ -11,7 +11,7 @@

    {{ _('הרשמה') }}

    {{ _('ברוכים הבאים למערכת התרגילים!') }}
    {{ _('הזינו אימייל וסיסמה לצורך רישום למערכת:') }}

    -
    + {{ render_field(form.email, cls="form-control form-control-lg", placeholder=_('כתובת אימייל')) }} {{ render_field(form.username, cls="form-control form-control-lg", placeholder=_('שם משתמש')) }} {{ render_field(form.fullname, cls="form-control form-control-lg", placeholder=_('שם מלא')) }} diff --git a/lms/utils/mail.py b/lms/utils/mail.py index d762847f..1c59909a 100644 --- a/lms/utils/mail.py +++ b/lms/utils/mail.py @@ -1,3 +1,5 @@ +from functools import wraps + from flask import url_for from flask_babel import gettext as _ # type: ignore from flask_mail import Message # type: ignore @@ -7,7 +9,18 @@ from lms.models.users import generate_user_token -def send_confirmation_mail(user: User) -> None: +def send_message(func): + @wraps(func) + def wrapper(*args, **kwargs): + msg = func(*args, **kwargs) + if not webapp.config.get('TESTING'): + webmail.send(msg) + + return wrapper + + +@send_message +def send_confirmation_mail(user: User) -> Message: token = generate_user_token(user) subject = _('מייל אימות - %(site_name)s', site_name=config.SITE_NAME) msg = Message(subject, recipients=[user.mail_address]) @@ -18,11 +31,11 @@ def send_confirmation_mail(user: User) -> None: 'שלום %(fullname)s,\nלינק האימות שלך למערכת הוא: %(link)s', fullname=user.fullname, link=link, ) - if not webapp.config.get('TESTING'): - webmail.send(msg) + return msg -def send_reset_password_mail(user: User) -> None: +@send_message +def send_reset_password_mail(user: User) -> Message: token = generate_user_token(user) subject = _('מייל איפוס סיסמה - %(site_name)s', site_name=config.SITE_NAME) msg = Message(subject, recipients=[user.mail_address]) @@ -33,11 +46,11 @@ def send_reset_password_mail(user: User) -> None: 'שלום %(fullname)s,\nלינק לצורך איפוס הסיסמה שלך הוא: %(link)s', fullname=user.fullname, link=link, ) - if not webapp.config.get('TESTING'): - webmail.send(msg) + return msg -def send_change_password_mail(user: User) -> None: +@send_message +def send_change_password_mail(user: User) -> Message: subject = _('שינוי סיסמה - %(site_name)s', site_name=config.SITE_NAME) msg = Message(subject, recipients=[user.mail_address]) msg.body = _( @@ -47,5 +60,4 @@ def send_change_password_mail(user: User) -> None: fullname=user.fullname, site_name=config.SITE_NAME, site_mail=config.MAIL_DEFAULT_SENDER, ) - if not webapp.config.get('TESTING'): - webmail.send(msg) + return msg From 14d8f2b3563efdce7e4a117a079e37ed66336649 Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Wed, 15 Sep 2021 18:40:59 +0300 Subject: [PATCH 35/51] Fixed translations --- .../translations/en/LC_MESSAGES/messages.po | 200 ++++++++++++++---- 1 file changed, 155 insertions(+), 45 deletions(-) diff --git a/lms/lmsweb/translations/en/LC_MESSAGES/messages.po b/lms/lmsweb/translations/en/LC_MESSAGES/messages.po index 0c35ce13..8e6aaa7e 100644 --- a/lms/lmsweb/translations/en/LC_MESSAGES/messages.po +++ b/lms/lmsweb/translations/en/LC_MESSAGES/messages.po @@ -7,7 +7,7 @@ msgid "" msgstr "" "Project-Id-Version: lmsweb-1.0\n" "Report-Msgid-Bugs-To: bugs@mesicka.com\n" -"POT-Creation-Date: 2021-09-12 15:10+0300\n" +"POT-Creation-Date: 2021-09-15 18:29+0300\n" "PO-Revision-Date: 2020-09-16 18:29+0300\n" "Last-Translator: Or Ronai\n" "Language: en\n" @@ -18,7 +18,7 @@ msgstr "" "Content-Transfer-Encoding: 8bit\n" "Generated-By: Babel 2.9.1\n" -#: lmsdb/models.py:698 +#: lmsdb/models.py:703 msgid "כישלון חמור" msgstr "Fatal error" @@ -45,34 +45,56 @@ msgstr "The automatic checker couldn't run your code." msgid "אחי, בדקת את הקוד שלך?" msgstr "Bro, did you check your code?" -#: lmsweb/views.py:122 +#: lmsweb/views.py:131 msgid "לא ניתן להירשם כעת" msgstr "Can not register now" -#: lmsweb/views.py:139 +#: lmsweb/views.py:152 msgid "ההרשמה בוצעה בהצלחה" msgstr "Registration successfully" -#: lmsweb/views.py:161 +#: lmsweb/views.py:175 msgid "קישור האימות פג תוקף, קישור חדש נשלח אל תיבת המייל שלך" msgstr "The confirmation link is expired, new link has been sent to your email" -#: lmsweb/views.py:174 +#: lmsweb/views.py:188 #, fuzzy msgid "המשתמש שלך אומת בהצלחה, כעת אתה יכול להתחבר למערכת" msgstr "Your user has been successfully confirmed, you can now login" -#: lmsweb/forms/register.py:14 -msgid "אימייל לא תקין" -msgstr "Invalid email" +#: lmsweb/views.py:213 lmsweb/views.py:273 +#, fuzzy +msgid "הסיסמה שלך שונתה בהצלחה" +msgstr "Your password has successfully changed" + +#: lmsweb/views.py:229 +msgid "קישור לאיפוס הסיסמה נשלח בהצלחה" +msgstr "Password reset link has successfully sent" + +#: lmsweb/views.py:250 +msgid "קישור איפוס הסיסמה פג תוקף" +msgstr "Reset password link is expired" -#: lmsweb/forms/register.py:32 +#: lmsweb/forms/change_password.py:20 lmsweb/forms/register.py:32 +#: lmsweb/forms/reset_password.py:25 msgid "הסיסמאות שהוקלדו אינן זהות" msgstr "The passwords are not identical" -#: lmsweb/tools/registration.py:105 +#: lmsweb/forms/change_password.py:30 +msgid "הזנת סיסמה שגויה מספר רב מדי של פעמים" +msgstr "Invalid old password has been inserted too many times" + +#: lmsweb/forms/change_password.py:33 +msgid "הסיסמה הנוכחית שהוזנה שגויה" +msgstr "Invalid current password" + +#: lmsweb/forms/register.py:14 lmsweb/forms/reset_password.py:12 +msgid "אימייל לא תקין" +msgstr "Invalid email" + +#: lmsweb/tools/registration.py:109 msgid "מערכת הגשת התרגילים" -msgstr "Exercuse submission system" +msgstr "Exercise submission system" #: lmsweb/tools/validators.py:13 msgid "שם המשתמש כבר נמצא בשימוש" @@ -82,15 +104,10 @@ msgstr "The username already in use" msgid "האימייל כבר נמצא בשימוש" msgstr "The email already in use" -#: models/register.py:20 -#, python-format -msgid "מייל אימות - %(site_name)s" -msgstr "Confirmation mail - %(site_name)s" - -#: models/register.py:25 -#, fuzzy, python-format -msgid "שלום %(fullname)s,\nלינק האימות שלך למערכת הוא: %(link)s" -msgstr "Hello %(fullname)s,\n Your confirmation link is: %(link)s" +#: lmsweb/tools/validators.py:29 +#, fuzzy +msgid "האימייל לא רשום במערכת" +msgstr "Invalid email" #: models/solutions.py:50 #, python-format @@ -107,17 +124,19 @@ msgstr "%(checker)s replied for \"%(subject)s\"." msgid "הפתרון שלך לתרגיל \"%(subject)s\" נבדק." msgstr "Your solution for the \"%(subject)s\" exercise has been checked." -#: models/users.py:25 +#: models/users.py:28 #, fuzzy msgid "שם המשתמש או הסיסמה שהוזנו לא תקינים" msgstr "Invalid username or password" -#: models/users.py:27 +#: models/users.py:30 #, fuzzy msgid "עליך לאשר את מייל האימות" msgstr "You have to confirm your registration with the link sent to your email" -#: templates/banned.html:8 templates/login.html:7 templates/signup.html:8 +#: templates/banned.html:8 templates/login.html:7 +#: templates/recoverpassword.html:8 templates/resetpassword.html:8 +#: templates/signup.html:8 msgid "תמונת הפרופיל של קורס פייתון" msgstr "Profile picture of the Python Course" @@ -133,6 +152,35 @@ msgstr "For more details please contact the management team." msgid "מערכת הגשת תרגילים לקורס פייתון" msgstr "Exercise submission system for the Python Course" +#: templates/changepassword.html:8 +#, fuzzy +msgid "שינוי סיסמה" +msgstr "Change Password" + +#: templates/changepassword.html:10 +#, fuzzy +msgid "הזינו סיסמה ישנה וסיסמה חדשה לצורך שינוי הסיסמה:" +msgstr "Insert current password and new password for changing it:" + +#: templates/changepassword.html:13 +msgid "סיסמה נוכחית" +msgstr "Current password" + +#: templates/changepassword.html:14 templates/recoverpassword.html:14 +#, fuzzy +msgid "סיסמה חדשה" +msgstr "Password" + +#: templates/changepassword.html:15 templates/recoverpassword.html:15 +#, fuzzy +msgid "אימות סיסמה חדשה" +msgstr "Password Confirmation" + +#: templates/changepassword.html:18 templates/user.html:19 +#, fuzzy +msgid "שנה סיסמה" +msgstr "Change Password" + #: templates/exercises.html:8 msgid "תרגילים" msgstr "Exercises" @@ -181,7 +229,11 @@ msgstr "Password" msgid "התחבר" msgstr "Login" -#: templates/login.html:39 templates/signup.html:22 +#: templates/login.html:36 +msgid "שכחת את הסיסמה?" +msgstr "Forgot your password?" + +#: templates/login.html:40 templates/signup.html:22 msgid "הירשם" msgstr "Register" @@ -221,6 +273,38 @@ msgstr "Check Exercises" msgid "התנתקות" msgstr "Logout" +#: templates/recoverpassword.html:9 templates/resetpassword.html:9 +#, fuzzy +msgid "איפוס סיסמה" +msgstr "Reset Password" + +#: templates/recoverpassword.html:11 +#, fuzzy +msgid "הזינו סיסמה לצורך שינוי הסיסמה:" +msgstr "Insert password for changing it:" + +#: templates/recoverpassword.html:18 +#, fuzzy +msgid "אפס סיסמה" +msgstr "Reset Password" + +#: templates/resetpassword.html:11 +#, fuzzy +msgid "הזינו אימייל לצורך שליחת קישור לאיפוס הסיסמה:" +msgstr "Insert your email for getting link to reset it:" + +#: templates/resetpassword.html:14 templates/signup.html:15 +msgid "כתובת אימייל" +msgstr "Email Address" + +#: templates/resetpassword.html:15 +msgid "שלח מייל איפוס סיסמה" +msgstr "Send Reset Password Link" + +#: templates/resetpassword.html:18 templates/signup.html:25 +msgid "חזרה לדף ההתחברות" +msgstr "Back to login page" + #: templates/signup.html:9 #, fuzzy msgid "הרשמה" @@ -230,10 +314,6 @@ msgstr "Registration" msgid "הזינו אימייל וסיסמה לצורך רישום למערכת:" msgstr "Insert your email and password for registration:" -#: templates/signup.html:15 -msgid "כתובת אימייל" -msgstr "Email Address" - #: templates/signup.html:17 msgid "שם מלא" msgstr "Full Name" @@ -243,10 +323,6 @@ msgstr "Full Name" msgid "אימות סיסמה" msgstr "Password Confirmation" -#: templates/signup.html:25 -msgid "חזרה לדף ההתחברות" -msgstr "Back to login page" - #: templates/status.html:7 msgid "חמ\"ל תרגילים" msgstr "Exercises operations room" @@ -308,54 +384,58 @@ msgid "דואר אלקטרוני:" msgstr "Email Address:" #: templates/user.html:16 +msgid "פעולות:" +msgstr "Actions:" + +#: templates/user.html:24 msgid "תרגילים שהוגשו:" msgstr "Exercises Submitted:" -#: templates/user.html:21 +#: templates/user.html:29 msgid "שם תרגיל" msgstr "Exercise name" -#: templates/user.html:22 +#: templates/user.html:30 msgid "מצב הגשה" msgstr "Submission status" -#: templates/user.html:23 +#: templates/user.html:31 msgid "הגשה" msgstr "Submission" -#: templates/user.html:24 +#: templates/user.html:32 msgid "בודק" msgstr "Checker" -#: templates/user.html:33 +#: templates/user.html:41 msgid "נבדק" msgstr "Checked" -#: templates/user.html:33 +#: templates/user.html:41 msgid "הוגש" msgstr "Submitted" -#: templates/user.html:33 +#: templates/user.html:41 msgid "לא הוגש" msgstr "Not submitted" -#: templates/user.html:44 +#: templates/user.html:52 msgid "פתקיות:" msgstr "Notes:" -#: templates/user.html:49 templates/user.html:51 +#: templates/user.html:57 templates/user.html:59 msgid "פתקית חדשה" msgstr "New Note" -#: templates/user.html:55 +#: templates/user.html:63 msgid "תרגיל משויך:" msgstr "Exercise:" -#: templates/user.html:64 +#: templates/user.html:72 msgid "רמת פרטיות:" msgstr "Privacy Level:" -#: templates/user.html:70 +#: templates/user.html:78 msgid "הוסף פתקית" msgstr "Add Note" @@ -426,3 +506,33 @@ msgstr "Checker comments" #: templates/view.html:127 msgid "סיימתי לבדוק!" msgstr "Done Checking!" + +#: utils/mail.py:25 +#, python-format +msgid "מייל אימות - %(site_name)s" +msgstr "Confirmation mail - %(site_name)s" + +#: utils/mail.py:30 +#, fuzzy, python-format +msgid "שלום %(fullname)s,\nלינק האימות שלך למערכת הוא: %(link)s" +msgstr "Hello %(fullname)s,\n Your confirmation link is: %(link)s" + +#: utils/mail.py:40 +#, fuzzy, python-format +msgid "מייל איפוס סיסמה - %(site_name)s" +msgstr "Reset password mail - %(site_name)s" + +#: utils/mail.py:45 +#, fuzzy, python-format +msgid "שלום %(fullname)s,\nלינק לצורך איפוס הסיסמה שלך הוא: %(link)s" +msgstr "Hello %(fullname)s,\nYour reset password link is: %(link)s" + +#: utils/mail.py:54 +#, fuzzy, python-format +msgid "שינוי סיסמה - %(site_name)s" +msgstr "Changing password - %(site_name)s" + +#: utils/mail.py:56 +#, python-format +msgid "שלום %(fullname)s. הסיסמה שלך באתר %(site_name)s שונתה.\nאם אתה לא עשית את זה צור קשר עם הנהלת האתר.\nכתובת המייל: %(site_mail)s" +msgstr "Hello %(fullname)s. Your password in %(site_name)s site has been changed.\nIf you didn't do it please contact with the site management.\nMail address: %(site_mail)s" From 0670c7e90107169cfc053c62992b49223600df09 Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Sat, 18 Sep 2021 12:19:31 +0300 Subject: [PATCH 36/51] Fixed some issues --- lms/lmsweb/config.py.example | 2 +- lms/lmsweb/forms/change_password.py | 6 +++--- lms/lmsweb/views.py | 4 ++-- lms/templates/user.html | 2 +- tests/test_users.py | 4 ++-- 5 files changed, 9 insertions(+), 9 deletions(-) diff --git a/lms/lmsweb/config.py.example b/lms/lmsweb/config.py.example index f2e71dc7..bbd82775 100644 --- a/lms/lmsweb/config.py.example +++ b/lms/lmsweb/config.py.example @@ -65,4 +65,4 @@ LIMITS_PER_MINUTE = 5 LIMITS_PER_HOUR = 50 # Change password settings -INVALID_TRIES = 5 +MAX_INVALID_PASSWORD_TRIES = 5 diff --git a/lms/lmsweb/forms/change_password.py b/lms/lmsweb/forms/change_password.py index 388df1ac..7ded2800 100644 --- a/lms/lmsweb/forms/change_password.py +++ b/lms/lmsweb/forms/change_password.py @@ -4,7 +4,7 @@ from wtforms import PasswordField from wtforms.validators import EqualTo, InputRequired, Length, ValidationError -from lms.lmsweb.config import INVALID_TRIES +from lms.lmsweb.config import MAX_INVALID_PASSWORD_TRIES class ChangePasswordForm(FlaskForm): @@ -26,8 +26,8 @@ def __init__(self, user, *args, **kwargs): self.user = user def validate_current_password(self, field): - if session['_invalid_tries'] >= INVALID_TRIES: + if session['_invalid_password_tries'] >= MAX_INVALID_PASSWORD_TRIES: raise ValidationError(_('הזנת סיסמה שגויה מספר רב מדי של פעמים')) if not self.user.is_password_valid(field.data): - session['_invalid_tries'] += 1 + session['_invalid_password_tries'] += 1 raise ValidationError(_('הסיסמה הנוכחית שהוזנה שגויה')) diff --git a/lms/lmsweb/views.py b/lms/lmsweb/views.py index c2048bae..13a8a006 100644 --- a/lms/lmsweb/views.py +++ b/lms/lmsweb/views.py @@ -117,7 +117,7 @@ def login(login_message: Optional[str] = None): return redirect(url_for('login', **error_details)) else: login_user(user) - session['_invalid_tries'] = 0 + session['_invalid_password_tries'] = 0 return get_next_url(next_page) return render_template('login.html', login_message=login_message) @@ -222,7 +222,7 @@ def reset_password(): if not form.validate_on_submit(): return render_template('resetpassword.html', form=form) - user = User.get_or_none(User.mail_address == form.email.data) + user = User.get(User.mail_address == form.email.data) send_reset_password_mail(user) return redirect(url_for( diff --git a/lms/templates/user.html b/lms/templates/user.html index a58d8fa4..2a1c46fb 100644 --- a/lms/templates/user.html +++ b/lms/templates/user.html @@ -16,7 +16,7 @@

    {{ _('פרטי משתמש:') }}

    {{ _('פעולות:') }}

    diff --git a/tests/test_users.py b/tests/test_users.py index d6df2842..fe2008ae 100644 --- a/tests/test_users.py +++ b/tests/test_users.py @@ -4,7 +4,7 @@ from flask.testing import FlaskClient from lms.lmsdb.models import User -from lms.lmsweb.config import CONFIRMATION_TIME, INVALID_TRIES +from lms.lmsweb.config import CONFIRMATION_TIME, MAX_INVALID_PASSWORD_TRIES from lms.models.users import generate_user_token from tests import conftest @@ -78,7 +78,7 @@ def test_banned_user(client: FlaskClient, banned_user: User): def test_invalid_change_password(captured_templates): student_user = conftest.create_student_user(index=1) client = conftest.get_logged_user(student_user.username) - for _ in range(INVALID_TRIES): + for _ in range(MAX_INVALID_PASSWORD_TRIES): client.post('/change-password', data={ 'current_password': 'wrong pass', 'password': 'some_password', From 786527ba81433643ae7b95e945222072f7b86996 Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Sat, 18 Sep 2021 17:11:24 +0300 Subject: [PATCH 37/51] Changed session token to be uuid --- lms/lmsdb/models.py | 11 +++++------ lms/lmsweb/tools/registration.py | 4 ---- lms/lmsweb/views.py | 18 +++--------------- lms/models/users.py | 4 ---- tests/conftest.py | 5 ----- 5 files changed, 8 insertions(+), 34 deletions(-) diff --git a/lms/lmsdb/models.py b/lms/lmsdb/models.py index 327be737..397e74f6 100644 --- a/lms/lmsdb/models.py +++ b/lms/lmsdb/models.py @@ -1,13 +1,14 @@ -from collections import Counter import enum import html import secrets import string +from collections import Counter from datetime import datetime from typing import ( Any, Dict, Iterable, List, Optional, TYPE_CHECKING, Tuple, Type, Union, cast, ) +from uuid import uuid4 from flask_babel import gettext as _ # type: ignore from flask_login import UserMixin, current_user # type: ignore @@ -138,10 +139,10 @@ class User(UserMixin, BaseModel): password = CharField() role = ForeignKeyField(Role, backref='users') api_key = CharField() - session_token = CharField(unique=True) + uuid = CharField(default=uuid4, unique=True) def get_id(self): - return str(self.session_token) + return str(self.uuid) def is_password_valid(self, password): return check_password_hash(self.password, password) @@ -156,7 +157,6 @@ def get_system_user(cls) -> 'User': User.role.name: Role.get_staff_role(), User.password.name: cls.random_password(), User.api_key.name: cls.random_password(), - User.session_token.name: cls.random_password(), }) return instance @@ -206,6 +206,7 @@ def on_save_handler(model_class, instance, created): is_password_changed = not instance.password.startswith('pbkdf2:sha256') if created or is_password_changed: instance.password = generate_password_hash(instance.password) + instance.uuid = uuid4() is_api_key_changed = not instance.api_key.startswith('pbkdf2:sha256') if created or is_api_key_changed: @@ -927,10 +928,8 @@ def create_demo_users(): user = dict(zip(fields, entity)) password = User.random_password() api_key = User.random_password(stronger=True) - session_token = generate_string() User.create( **user, password=password, api_key=api_key, - session_token=session_token, ) print(f"User: {user['username']}, Password: {password}") # noqa: T001 diff --git a/lms/lmsweb/tools/registration.py b/lms/lmsweb/tools/registration.py index 048c142b..e3ee2b50 100644 --- a/lms/lmsweb/tools/registration.py +++ b/lms/lmsweb/tools/registration.py @@ -6,7 +6,6 @@ from lms.lmsdb import models from lms.lmsweb import config -from lms.models.users import generate_session_token from lms.utils.log import log import requests @@ -89,9 +88,6 @@ def _get_or_create_user_in_model(user: UserToCreate) -> None: models.User.fullname.name: f'{user.name}', models.User.role.name: models.Role.get_student_role(), models.User.password.name: user.password, - models.User.session_token.name: generate_session_token( - user.email, user.password, - ), }) def _send_user_email_registration(self, user: UserToCreate) -> None: diff --git a/lms/lmsweb/views.py b/lms/lmsweb/views.py index 13a8a006..f3fdd915 100644 --- a/lms/lmsweb/views.py +++ b/lms/lmsweb/views.py @@ -40,9 +40,7 @@ FileSizeError, ForbiddenPermission, LmsError, UnauthorizedError, UploadError, fail, ) -from lms.models.users import ( - SERIALIZER, auth, generate_session_token, retrieve_salt, -) +from lms.models.users import SERIALIZER, auth, retrieve_salt from lms.utils.consts import RTL_LANGUAGES from lms.utils.files import ( get_language_name_by_extension, get_mime_type_by_extention, @@ -82,8 +80,8 @@ def _db_close(exc): @login_manager.user_loader -def load_user(session_token): - return User.get_or_none(session_token=session_token) +def load_user(uuid): + return User.get_or_none(uuid=uuid) @webapp.errorhandler(429) @@ -135,9 +133,6 @@ def signup(): if not form.validate_on_submit(): return render_template('signup.html', form=form) - session_token = generate_session_token( - form.username.data, form.password.data, - ) user = User.create(**{ User.mail_address.name: form.email.data, User.username.name: form.username.data, @@ -145,7 +140,6 @@ def signup(): User.role.name: Role.get_unverified_role(), User.password.name: form.password.data, User.api_key.name: User.random_password(), - User.session_token.name: session_token, }) send_confirmation_mail(user) return redirect(url_for( @@ -202,9 +196,6 @@ def change_password(): return render_template('changepassword.html', form=form) user.password = form.password.data - user.session_token = generate_session_token( - user.username, form.password.data, - ) user.save() logout_user() send_change_password_mail(user) @@ -264,9 +255,6 @@ def recover_password_check(user: User, token: str): 'recoverpassword.html', form=form, id=user.id, token=token, ) user.password = form.password.data - user.session_token = generate_session_token( - user.username, form.password.data, - ) user.save() return redirect(url_for( 'login', login_message=( diff --git a/lms/models/users.py b/lms/models/users.py index 9542c0e8..6f060396 100644 --- a/lms/models/users.py +++ b/lms/models/users.py @@ -33,7 +33,3 @@ def auth(username: str, password: str) -> User: def generate_user_token(user: User) -> str: return SERIALIZER.dumps(user.mail_address, salt=retrieve_salt(user)) - - -def generate_session_token(username: str, password: str) -> str: - return SERIALIZER.dumps([username, password]) diff --git a/tests/conftest.py b/tests/conftest.py index 6877da8d..213c7937 100644 --- a/tests/conftest.py +++ b/tests/conftest.py @@ -19,7 +19,6 @@ from lms.lmstests.sandbox import celery_app as sandbox_app from lms.lmsweb import limiter, routes, webapp from lms.models import notifications -from lms.models.users import generate_session_token @pytest.fixture(autouse=True, scope='session') @@ -126,7 +125,6 @@ def create_user( ) -> User: username = f'{role_name}-{index}' password = 'fake pass' - session_token = generate_session_token(username, password) return User.create( # NOQA: S106 username=username, fullname=f'A{role_name}', @@ -134,7 +132,6 @@ def create_user( password=password, api_key='fake key', role=Role.by_name(role_name), - session_token=session_token, ) @@ -184,7 +181,6 @@ def admin_user(): admin_role = Role.get(Role.name == RoleOptions.ADMINISTRATOR.value) username = 'Yam' password = 'fake pass' - session_token = generate_session_token(username, password) return User.create( # NOQA: B106, S106 username=username, fullname='Buya', @@ -192,7 +188,6 @@ def admin_user(): password=password, api_key='fake key', role=admin_role, - session_token=session_token, ) From fa76fdf37d5a47163954ad42132927e09951cccd Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Sat, 18 Sep 2021 18:18:28 +0300 Subject: [PATCH 38/51] Added a test and changed get_or_none to get --- lms/lmsweb/views.py | 4 +--- tests/test_users.py | 8 ++++++++ 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/lms/lmsweb/views.py b/lms/lmsweb/views.py index f3fdd915..791dcf7e 100644 --- a/lms/lmsweb/views.py +++ b/lms/lmsweb/views.py @@ -187,9 +187,7 @@ def confirm_email(user_id: int, token: str): @webapp.route('/change-password', methods=['GET', 'POST']) @login_required def change_password(): - user = User.get_or_none(User.id == current_user.id) - if user is None: - return fail(404, 'User not found.') + user = User.get(User.id == current_user.id) form = ChangePasswordForm(user) if not form.validate_on_submit(): diff --git a/tests/test_users.py b/tests/test_users.py index fe2008ae..cbb3d3ac 100644 --- a/tests/test_users.py +++ b/tests/test_users.py @@ -125,6 +125,14 @@ def test_forgot_my_password(client: FlaskClient, captured_templates): assert template.name == "login.html" token = generate_user_token(user) + unknown_id_recover_response = client.post( + f'/recover-password/{user.id + 1}/{token}', data={ + 'password': 'different pass', + 'confirm': 'different pass', + }, follow_redirects=True, + ) + assert unknown_id_recover_response.status_code == 404 + client.post(f'/recover-password/{user.id}/{token}', data={ 'password': 'wrong pass', 'confirm': 'different pass', From ee88dddcd433caca41d150fc583f8368b48511b6 Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Sun, 19 Sep 2021 10:19:22 +0300 Subject: [PATCH 39/51] fix: check test send mail --- tests/conftest.py | 6 +++- tests/test_registration.py | 63 ++++++++++++++++++++------------------ tests/test_users.py | 2 ++ 3 files changed, 40 insertions(+), 31 deletions(-) diff --git a/tests/conftest.py b/tests/conftest.py index 213c7937..b41669b6 100644 --- a/tests/conftest.py +++ b/tests/conftest.py @@ -70,7 +70,7 @@ def webapp_configurations(): limiter.enabled = False -@pytest.fixture(autouse=True, scope='session') +@pytest.fixture(autouse=True, scope='class') def disable_mail_sending(): webapp.config['TESTING'] = True @@ -92,6 +92,10 @@ def enable_users_comments(): webapp.config['USERS_COMMENTS'] = True +def enable_mail_sending(): + webapp.config['TESTING'] = False + + def disable_registration(): webapp.config['REGISTRATION_OPEN'] = False diff --git a/tests/test_registration.py b/tests/test_registration.py index c0469d77..0cba4b67 100644 --- a/tests/test_registration.py +++ b/tests/test_registration.py @@ -2,13 +2,15 @@ from unittest.mock import Mock, patch from flask.testing import FlaskClient +import pytest -from lms.lmsweb.config import CONFIRMATION_TIME +from lms.lmsweb.config import CONFIRMATION_TIME, MAIL_DEFAULT_SENDER from lms.lmsdb.models import User from lms.models.users import generate_user_token from tests import conftest +@pytest.mark.usefixtures('disable_mail_sending') class TestRegistration: @staticmethod def test_invalid_username( @@ -52,35 +54,6 @@ def test_invalid_email( fail_login_response = client.get('/exercises') assert fail_login_response.status_code == 302 - @staticmethod - def test_successful_registration(client: FlaskClient, captured_templates): - client.post('/signup', data={ - 'email': 'some_user123@mail.com', - 'username': 'some_user', - 'fullname': 'some_name', - 'password': 'some_password', - 'confirm': 'some_password', - }, follow_redirects=True) - template, _ = captured_templates[-1] - assert template.name == 'login.html' - - client.post('/login', data={ - 'username': 'some_user', - 'password': 'some_password', - }, follow_redirects=True) - fail_login_response = client.get('/exercises') - assert fail_login_response.status_code == 302 - - user = User.get_or_none(User.username == 'some_user') - token = generate_user_token(user) - client.get(f'/confirm-email/{user.id}/{token}', follow_redirects=True) - client.post('/login', data={ - 'username': 'some_user', - 'password': 'some_password', - }, follow_redirects=True) - success_login_response = client.get('/exercises') - assert success_login_response.status_code == 200 - @staticmethod def test_bad_token_or_id(client: FlaskClient): client.post('/signup', data={ @@ -159,6 +132,36 @@ def test_expired_token(client: FlaskClient): success_login_response = client.get('/exercises') assert success_login_response.status_code == 200 + @staticmethod + def test_successful_registration(client: FlaskClient, captured_templates): + conftest.enable_mail_sending() + client.post('/signup', data={ + 'email': MAIL_DEFAULT_SENDER, + 'username': 'some_user', + 'fullname': 'some_name', + 'password': 'some_password', + 'confirm': 'some_password', + }, follow_redirects=True) + template, _ = captured_templates[-1] + assert template.name == 'login.html' + + client.post('/login', data={ + 'username': 'some_user', + 'password': 'some_password', + }, follow_redirects=True) + fail_login_response = client.get('/exercises') + assert fail_login_response.status_code == 302 + + user = User.get_or_none(User.username == 'some_user') + token = generate_user_token(user) + client.get(f'/confirm-email/{user.id}/{token}', follow_redirects=True) + client.post('/login', data={ + 'username': 'some_user', + 'password': 'some_password', + }, follow_redirects=True) + success_login_response = client.get('/exercises') + assert success_login_response.status_code == 200 + @staticmethod def test_registartion_closed(client: FlaskClient, captured_templates): conftest.disable_registration() diff --git a/tests/test_users.py b/tests/test_users.py index cbb3d3ac..bb4dc2fc 100644 --- a/tests/test_users.py +++ b/tests/test_users.py @@ -2,6 +2,7 @@ from unittest.mock import Mock, patch from flask.testing import FlaskClient +import pytest from lms.lmsdb.models import User from lms.lmsweb.config import CONFIRMATION_TIME, MAX_INVALID_PASSWORD_TRIES @@ -9,6 +10,7 @@ from tests import conftest +@pytest.mark.usefixtures('disable_mail_sending') class TestUser: def test_password_hashed_on_create( self, From 3a005f4f8ee5347654e565af28fe42c9989ed621 Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Sun, 19 Sep 2021 10:50:20 +0300 Subject: [PATCH 40/51] Added skipif for sending mail test and split a test function --- tests/test_registration.py | 5 +++++ tests/test_users.py | 8 ++++++-- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/tests/test_registration.py b/tests/test_registration.py index 0cba4b67..2fc79906 100644 --- a/tests/test_registration.py +++ b/tests/test_registration.py @@ -4,6 +4,7 @@ from flask.testing import FlaskClient import pytest +from lms.lmsweb import config_file from lms.lmsweb.config import CONFIRMATION_TIME, MAIL_DEFAULT_SENDER from lms.lmsdb.models import User from lms.models.users import generate_user_token @@ -133,6 +134,10 @@ def test_expired_token(client: FlaskClient): assert success_login_response.status_code == 200 @staticmethod + @pytest.mark.skipif( + condition=not config_file.is_file(), + reason='should run with configuration file and correct mail info', + ) def test_successful_registration(client: FlaskClient, captured_templates): conftest.enable_mail_sending() client.post('/signup', data={ diff --git a/tests/test_users.py b/tests/test_users.py index bb4dc2fc..9bdd1f12 100644 --- a/tests/test_users.py +++ b/tests/test_users.py @@ -112,14 +112,18 @@ def test_valid_change_password(captured_templates): assert check_logout_response.status_code == 302 @staticmethod - def test_forgot_my_password(client: FlaskClient, captured_templates): - user = conftest.create_student_user(index=1) + def test_forgot_my_password_invalid_mail( + client: FlaskClient, captured_templates, + ): client.post('/reset-password', data={ 'email': 'fake-mail@mail.com', }, follow_redirects=True) template, _ = captured_templates[-1] assert template.name == "resetpassword.html" + @staticmethod + def test_forgot_my_password(client: FlaskClient, captured_templates): + user = conftest.create_student_user(index=1) client.post('/reset-password', data={ 'email': user.mail_address, }, follow_redirects=True) From e3e633d793500383c75262d83318669b905f52fd Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Sun, 19 Sep 2021 11:07:16 +0300 Subject: [PATCH 41/51] Changed skipif condition and split a test --- tests/test_registration.py | 8 ++++++-- tests/test_users.py | 14 +++++++++++++- 2 files changed, 19 insertions(+), 3 deletions(-) diff --git a/tests/test_registration.py b/tests/test_registration.py index 2fc79906..66c9889e 100644 --- a/tests/test_registration.py +++ b/tests/test_registration.py @@ -1,10 +1,10 @@ +import sys import time from unittest.mock import Mock, patch from flask.testing import FlaskClient import pytest -from lms.lmsweb import config_file from lms.lmsweb.config import CONFIRMATION_TIME, MAIL_DEFAULT_SENDER from lms.lmsdb.models import User from lms.models.users import generate_user_token @@ -135,7 +135,11 @@ def test_expired_token(client: FlaskClient): @staticmethod @pytest.mark.skipif( - condition=not config_file.is_file(), + condition=( + sys.platform != 'darwin' + and sys.platform != 'linux' + and sys.platform != 'win32' + ), reason='should run with configuration file and correct mail info', ) def test_successful_registration(client: FlaskClient, captured_templates): diff --git a/tests/test_users.py b/tests/test_users.py index 9bdd1f12..a34b9e62 100644 --- a/tests/test_users.py +++ b/tests/test_users.py @@ -122,7 +122,9 @@ def test_forgot_my_password_invalid_mail( assert template.name == "resetpassword.html" @staticmethod - def test_forgot_my_password(client: FlaskClient, captured_templates): + def test_forgot_my_password_invalid_recover( + client: FlaskClient, captured_templates, + ): user = conftest.create_student_user(index=1) client.post('/reset-password', data={ 'email': user.mail_address, @@ -146,6 +148,16 @@ def test_forgot_my_password(client: FlaskClient, captured_templates): template, _ = captured_templates[-1] assert template.name == "recoverpassword.html" + @staticmethod + def test_forgot_my_password(client: FlaskClient, captured_templates): + user = conftest.create_student_user(index=1) + client.post('/reset-password', data={ + 'email': user.mail_address, + }, follow_redirects=True) + template, _ = captured_templates[-1] + assert template.name == "login.html" + + token = generate_user_token(user) client.post(f'/recover-password/{user.id}/{token}', data={ 'password': 'new pass', 'confirm': 'new pass', From 85c91c790738e461031d89fe7b466db51d290d40 Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Sun, 19 Sep 2021 11:28:12 +0300 Subject: [PATCH 42/51] fix: test mails --- lms/utils/mail.py | 21 +++------------------ tests/conftest.py | 6 ++---- tests/test_registration.py | 9 --------- 3 files changed, 5 insertions(+), 31 deletions(-) diff --git a/lms/utils/mail.py b/lms/utils/mail.py index 1c59909a..19a88461 100644 --- a/lms/utils/mail.py +++ b/lms/utils/mail.py @@ -1,5 +1,3 @@ -from functools import wraps - from flask import url_for from flask_babel import gettext as _ # type: ignore from flask_mail import Message # type: ignore @@ -9,17 +7,6 @@ from lms.models.users import generate_user_token -def send_message(func): - @wraps(func) - def wrapper(*args, **kwargs): - msg = func(*args, **kwargs) - if not webapp.config.get('TESTING'): - webmail.send(msg) - - return wrapper - - -@send_message def send_confirmation_mail(user: User) -> Message: token = generate_user_token(user) subject = _('מייל אימות - %(site_name)s', site_name=config.SITE_NAME) @@ -31,10 +18,9 @@ def send_confirmation_mail(user: User) -> Message: 'שלום %(fullname)s,\nלינק האימות שלך למערכת הוא: %(link)s', fullname=user.fullname, link=link, ) - return msg + webmail.send(msg) -@send_message def send_reset_password_mail(user: User) -> Message: token = generate_user_token(user) subject = _('מייל איפוס סיסמה - %(site_name)s', site_name=config.SITE_NAME) @@ -46,10 +32,9 @@ def send_reset_password_mail(user: User) -> Message: 'שלום %(fullname)s,\nלינק לצורך איפוס הסיסמה שלך הוא: %(link)s', fullname=user.fullname, link=link, ) - return msg + webmail.send(msg) -@send_message def send_change_password_mail(user: User) -> Message: subject = _('שינוי סיסמה - %(site_name)s', site_name=config.SITE_NAME) msg = Message(subject, recipients=[user.mail_address]) @@ -60,4 +45,4 @@ def send_change_password_mail(user: User) -> Message: fullname=user.fullname, site_name=config.SITE_NAME, site_mail=config.MAIL_DEFAULT_SENDER, ) - return msg + webmail.send(msg) diff --git a/tests/conftest.py b/tests/conftest.py index b41669b6..987e51c7 100644 --- a/tests/conftest.py +++ b/tests/conftest.py @@ -7,6 +7,7 @@ from flask import template_rendered from flask.testing import FlaskClient +from flask_mail import Mail from peewee import SqliteDatabase import pytest @@ -73,6 +74,7 @@ def webapp_configurations(): @pytest.fixture(autouse=True, scope='class') def disable_mail_sending(): webapp.config['TESTING'] = True + webmail = Mail(webapp) @pytest.fixture(autouse=True, scope='session') @@ -92,10 +94,6 @@ def enable_users_comments(): webapp.config['USERS_COMMENTS'] = True -def enable_mail_sending(): - webapp.config['TESTING'] = False - - def disable_registration(): webapp.config['REGISTRATION_OPEN'] = False diff --git a/tests/test_registration.py b/tests/test_registration.py index 66c9889e..71e10c9c 100644 --- a/tests/test_registration.py +++ b/tests/test_registration.py @@ -134,16 +134,7 @@ def test_expired_token(client: FlaskClient): assert success_login_response.status_code == 200 @staticmethod - @pytest.mark.skipif( - condition=( - sys.platform != 'darwin' - and sys.platform != 'linux' - and sys.platform != 'win32' - ), - reason='should run with configuration file and correct mail info', - ) def test_successful_registration(client: FlaskClient, captured_templates): - conftest.enable_mail_sending() client.post('/signup', data={ 'email': MAIL_DEFAULT_SENDER, 'username': 'some_user', From 97827c192834abc3b554473bd9f1dfe733afbbd0 Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Sun, 19 Sep 2021 11:30:35 +0300 Subject: [PATCH 43/51] Removed unused import --- lms/utils/mail.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lms/utils/mail.py b/lms/utils/mail.py index 19a88461..c1dddf0d 100644 --- a/lms/utils/mail.py +++ b/lms/utils/mail.py @@ -3,7 +3,7 @@ from flask_mail import Message # type: ignore from lms.lmsdb.models import User -from lms.lmsweb import config, webapp, webmail +from lms.lmsweb import config, webmail from lms.models.users import generate_user_token From e1651c77405d72645651feb137bb51a04f9ccff5 Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Sun, 19 Sep 2021 11:33:24 +0300 Subject: [PATCH 44/51] Changed fixture to be session instead of class scope --- tests/conftest.py | 2 +- tests/test_registration.py | 1 - tests/test_users.py | 1 - 3 files changed, 1 insertion(+), 3 deletions(-) diff --git a/tests/conftest.py b/tests/conftest.py index 987e51c7..e960cc29 100644 --- a/tests/conftest.py +++ b/tests/conftest.py @@ -71,7 +71,7 @@ def webapp_configurations(): limiter.enabled = False -@pytest.fixture(autouse=True, scope='class') +@pytest.fixture(autouse=True, scope='session') def disable_mail_sending(): webapp.config['TESTING'] = True webmail = Mail(webapp) diff --git a/tests/test_registration.py b/tests/test_registration.py index 71e10c9c..4b17cea8 100644 --- a/tests/test_registration.py +++ b/tests/test_registration.py @@ -11,7 +11,6 @@ from tests import conftest -@pytest.mark.usefixtures('disable_mail_sending') class TestRegistration: @staticmethod def test_invalid_username( diff --git a/tests/test_users.py b/tests/test_users.py index a34b9e62..07e224d1 100644 --- a/tests/test_users.py +++ b/tests/test_users.py @@ -10,7 +10,6 @@ from tests import conftest -@pytest.mark.usefixtures('disable_mail_sending') class TestUser: def test_password_hashed_on_create( self, From 418437d003a1ba30c653a8a677a2eba0f10e2f92 Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Mon, 20 Sep 2021 17:45:31 +0300 Subject: [PATCH 45/51] changed some code style and changed uuidfield --- lms/lmsdb/models.py | 4 ++-- lms/static/my.css | 17 ++++++++--------- lms/templates/changepassword.html | 4 ++-- lms/templates/recoverpassword.html | 6 +++--- lms/templates/resetpassword.html | 6 +++--- 5 files changed, 18 insertions(+), 19 deletions(-) diff --git a/lms/lmsdb/models.py b/lms/lmsdb/models.py index 397e74f6..f4304886 100644 --- a/lms/lmsdb/models.py +++ b/lms/lmsdb/models.py @@ -14,7 +14,7 @@ from flask_login import UserMixin, current_user # type: ignore from peewee import ( # type: ignore BooleanField, Case, CharField, Check, DateTimeField, ForeignKeyField, - IntegerField, JOIN, ManyToManyField, TextField, fn, + IntegerField, JOIN, ManyToManyField, TextField, UUIDField, fn, ) from playhouse.signals import Model, post_save, pre_save # type: ignore from werkzeug.security import ( @@ -139,7 +139,7 @@ class User(UserMixin, BaseModel): password = CharField() role = ForeignKeyField(Role, backref='users') api_key = CharField() - uuid = CharField(default=uuid4, unique=True) + uuid = UUIDField(default=uuid4, unique=True) def get_id(self): return str(self.uuid) diff --git a/lms/static/my.css b/lms/static/my.css index 499351b6..fdb92f1d 100644 --- a/lms/static/my.css +++ b/lms/static/my.css @@ -48,8 +48,9 @@ a { #login-container, #signup-container, -#changepassword-container, -#resetpassword-container { +#change-password-container, +#reset-password-container, +#recover-password-container { height: 100%; align-items: center; display: flex; @@ -58,8 +59,9 @@ a { #login, #signup, -#changepassword, -#resetpassword { +#change-password, +#reset-password, +#recover-password { margin: auto; max-width: 420px; padding: 15px; @@ -68,7 +70,8 @@ a { #login-logo, #signup-logo, -#resetpassword-logo { +#reset-password-logo, +#recover-password-logo { margin-bottom: 1rem; } @@ -740,10 +743,6 @@ code .grader-add .fa { text-align: center; } -/* #change-password-user { - text-align: center; -} /* - #archive-row { text-align: center; } diff --git a/lms/templates/changepassword.html b/lms/templates/changepassword.html index 6e32eb91..e4734f47 100644 --- a/lms/templates/changepassword.html +++ b/lms/templates/changepassword.html @@ -3,8 +3,8 @@ {% block page_content %}
    -
    -
    +
    +

    {{ _('שינוי סיסמה') }}

    {{ _('הזינו סיסמה ישנה וסיסמה חדשה לצורך שינוי הסיסמה:') }} diff --git a/lms/templates/recoverpassword.html b/lms/templates/recoverpassword.html index 10caf141..791c6b0b 100644 --- a/lms/templates/recoverpassword.html +++ b/lms/templates/recoverpassword.html @@ -3,9 +3,9 @@ {% block page_content %}

    -
    -
    - +
    +
    +

    {{ _('איפוס סיסמה') }}

    {{ _('הזינו סיסמה לצורך שינוי הסיסמה:') }} diff --git a/lms/templates/resetpassword.html b/lms/templates/resetpassword.html index fc5024ba..98464480 100644 --- a/lms/templates/resetpassword.html +++ b/lms/templates/resetpassword.html @@ -3,9 +3,9 @@ {% block page_content %}

    -
    -
    - +
    +
    +

    {{ _('איפוס סיסמה') }}

    {{ _('הזינו אימייל לצורך שליחת קישור לאיפוס הסיסמה:') }} From fa56e55baf0ad603310bc50bf3d201924cb76404 Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Tue, 21 Sep 2021 09:25:22 +0300 Subject: [PATCH 46/51] Add migration --- lms/lmsdb/bootstrap.py | 16 ++++++++++++++++ lms/lmsdb/models.py | 4 +--- 2 files changed, 17 insertions(+), 3 deletions(-) diff --git a/lms/lmsdb/bootstrap.py b/lms/lmsdb/bootstrap.py index 0bc54d0c..03140e5b 100644 --- a/lms/lmsdb/bootstrap.py +++ b/lms/lmsdb/bootstrap.py @@ -1,4 +1,5 @@ from typing import Any, Callable, Optional, Tuple, Type +from uuid import uuid4 from peewee import ( Entity, Expression, Field, Model, OP, OperationalError, ProgrammingError, @@ -231,12 +232,26 @@ def _add_api_keys_to_users_table(table: Model, _column: Field) -> None: user.save() +def _add_uuid_to_users_table(table: Model, _colum: Field) -> None: + log.info('Adding UUIDs for all users, might take some extra time...') + with db_config.database.transaction(): + for user in table: + user.uuid = uuid4() + user.save() + + def _api_keys_migration() -> bool: User = models.User _add_not_null_column(User, User.api_key, _add_api_keys_to_users_table) return True +def _uuid_migration() -> bool: + User = models.User + _add_not_null_column(User, User.uuid, _add_uuid_to_users_table) + return True + + def main(): with models.database.connection_context(): models.database.create_tables(models.ALL_MODELS, safe=True) @@ -247,6 +262,7 @@ def main(): models.create_demo_users() _api_keys_migration() + _uuid_migration() text_fixer.fix_texts() import_tests.load_tests_from_path('/app_dir/notebooks-tests') diff --git a/lms/lmsdb/models.py b/lms/lmsdb/models.py index f4304886..eee18c6a 100644 --- a/lms/lmsdb/models.py +++ b/lms/lmsdb/models.py @@ -928,9 +928,7 @@ def create_demo_users(): user = dict(zip(fields, entity)) password = User.random_password() api_key = User.random_password(stronger=True) - User.create( - **user, password=password, api_key=api_key, - ) + User.create(**user, password=password, api_key=api_key) print(f"User: {user['username']}, Password: {password}") # noqa: T001 From e7e80435360c1c7604c001bea38738dfb5f36d79 Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Tue, 21 Sep 2021 10:03:21 +0300 Subject: [PATCH 47/51] feat: add migration --- lms/lmsdb/bootstrap.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/lms/lmsdb/bootstrap.py b/lms/lmsdb/bootstrap.py index 03140e5b..981d520f 100644 --- a/lms/lmsdb/bootstrap.py +++ b/lms/lmsdb/bootstrap.py @@ -254,6 +254,10 @@ def _uuid_migration() -> bool: def main(): with models.database.connection_context(): + if models.database.table_exists(models.User.__name__.lower()): + _api_keys_migration() + _uuid_migration() + models.database.create_tables(models.ALL_MODELS, safe=True) if models.Role.select().count() == 0: @@ -261,8 +265,6 @@ def main(): if models.User.select().count() == 0: models.create_demo_users() - _api_keys_migration() - _uuid_migration() text_fixer.fix_texts() import_tests.load_tests_from_path('/app_dir/notebooks-tests') From 33da2423723894fa61694b8dfc5107a9406bb18e Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Tue, 21 Sep 2021 10:10:45 +0300 Subject: [PATCH 48/51] fix: bool expression --- lms/lmsdb/bootstrap.py | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/lms/lmsdb/bootstrap.py b/lms/lmsdb/bootstrap.py index 981d520f..7688c890 100644 --- a/lms/lmsdb/bootstrap.py +++ b/lms/lmsdb/bootstrap.py @@ -89,9 +89,7 @@ def get_details(table: Model, column: Field) -> Tuple[bool, str, str]: column_name = column.column_name cols = {col.name for col in db_config.database.get_columns(table_name)} - if column_name in cols: - return True, table_name, column_name - return False, table_name, column_name + return column_name in cols, table_name, column_name def _add_not_null_column( @@ -219,9 +217,7 @@ def _drop_constraint_if_needed(table: Type[Model], column_name: str) -> bool: def has_column_named(table: Model, column_name: str) -> bool: db = db_config.database columns = {col.name for col in db.get_columns(table.__name__.lower())} - if column_name not in columns: - return False - return True + return column_name in columns def _add_api_keys_to_users_table(table: Model, _column: Field) -> None: From 1ca610293dd5589618e88dc9f28b24c057c50d68 Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Wed, 22 Sep 2021 10:06:12 +0300 Subject: [PATCH 49/51] Changed html name files --- lms/lmsdb/bootstrap.py | 2 +- .../translations/en/LC_MESSAGES/messages.po | 28 +++++++++---------- lms/lmsweb/views.py | 6 ++-- ...angepassword.html => change-password.html} | 1 - ...verpassword.html => recover-password.html} | 1 - ...resetpassword.html => reset-password.html} | 0 tests/test_users.py | 8 +++--- 7 files changed, 22 insertions(+), 24 deletions(-) rename lms/templates/{changepassword.html => change-password.html} (90%) rename lms/templates/{recoverpassword.html => recover-password.html} (90%) rename lms/templates/{resetpassword.html => reset-password.html} (100%) diff --git a/lms/lmsdb/bootstrap.py b/lms/lmsdb/bootstrap.py index 7688c890..28f52a78 100644 --- a/lms/lmsdb/bootstrap.py +++ b/lms/lmsdb/bootstrap.py @@ -228,7 +228,7 @@ def _add_api_keys_to_users_table(table: Model, _column: Field) -> None: user.save() -def _add_uuid_to_users_table(table: Model, _colum: Field) -> None: +def _add_uuid_to_users_table(table: Model, _column: Field) -> None: log.info('Adding UUIDs for all users, might take some extra time...') with db_config.database.transaction(): for user in table: diff --git a/lms/lmsweb/translations/en/LC_MESSAGES/messages.po b/lms/lmsweb/translations/en/LC_MESSAGES/messages.po index 8e6aaa7e..81b6ee74 100644 --- a/lms/lmsweb/translations/en/LC_MESSAGES/messages.po +++ b/lms/lmsweb/translations/en/LC_MESSAGES/messages.po @@ -135,7 +135,7 @@ msgid "עליך לאשר את מייל האימות" msgstr "You have to confirm your registration with the link sent to your email" #: templates/banned.html:8 templates/login.html:7 -#: templates/recoverpassword.html:8 templates/resetpassword.html:8 +#: templates/recover-password.html:8 templates/reset-password.html:8 #: templates/signup.html:8 msgid "תמונת הפרופיל של קורס פייתון" msgstr "Profile picture of the Python Course" @@ -152,31 +152,31 @@ msgstr "For more details please contact the management team." msgid "מערכת הגשת תרגילים לקורס פייתון" msgstr "Exercise submission system for the Python Course" -#: templates/changepassword.html:8 +#: templates/change-password.html:8 #, fuzzy msgid "שינוי סיסמה" msgstr "Change Password" -#: templates/changepassword.html:10 +#: templates/change-password.html:10 #, fuzzy msgid "הזינו סיסמה ישנה וסיסמה חדשה לצורך שינוי הסיסמה:" msgstr "Insert current password and new password for changing it:" -#: templates/changepassword.html:13 +#: templates/change-password.html:13 msgid "סיסמה נוכחית" msgstr "Current password" -#: templates/changepassword.html:14 templates/recoverpassword.html:14 +#: templates/change-password.html:14 templates/recover-password.html:14 #, fuzzy msgid "סיסמה חדשה" msgstr "Password" -#: templates/changepassword.html:15 templates/recoverpassword.html:15 +#: templates/change-password.html:15 templates/recover-password.html:15 #, fuzzy msgid "אימות סיסמה חדשה" msgstr "Password Confirmation" -#: templates/changepassword.html:18 templates/user.html:19 +#: templates/change-password.html:18 templates/user.html:19 #, fuzzy msgid "שנה סיסמה" msgstr "Change Password" @@ -273,35 +273,35 @@ msgstr "Check Exercises" msgid "התנתקות" msgstr "Logout" -#: templates/recoverpassword.html:9 templates/resetpassword.html:9 +#: templates/recover-password.html:9 templates/reset-password.html:9 #, fuzzy msgid "איפוס סיסמה" msgstr "Reset Password" -#: templates/recoverpassword.html:11 +#: templates/recover-password.html:11 #, fuzzy msgid "הזינו סיסמה לצורך שינוי הסיסמה:" msgstr "Insert password for changing it:" -#: templates/recoverpassword.html:18 +#: templates/recover-password.html:18 #, fuzzy msgid "אפס סיסמה" msgstr "Reset Password" -#: templates/resetpassword.html:11 +#: templates/reset-password.html:11 #, fuzzy msgid "הזינו אימייל לצורך שליחת קישור לאיפוס הסיסמה:" msgstr "Insert your email for getting link to reset it:" -#: templates/resetpassword.html:14 templates/signup.html:15 +#: templates/reset-password.html:14 templates/signup.html:15 msgid "כתובת אימייל" msgstr "Email Address" -#: templates/resetpassword.html:15 +#: templates/reset-password.html:15 msgid "שלח מייל איפוס סיסמה" msgstr "Send Reset Password Link" -#: templates/resetpassword.html:18 templates/signup.html:25 +#: templates/reset-password.html:18 templates/signup.html:25 msgid "חזרה לדף ההתחברות" msgstr "Back to login page" diff --git a/lms/lmsweb/views.py b/lms/lmsweb/views.py index 791dcf7e..54213be7 100644 --- a/lms/lmsweb/views.py +++ b/lms/lmsweb/views.py @@ -191,7 +191,7 @@ def change_password(): form = ChangePasswordForm(user) if not form.validate_on_submit(): - return render_template('changepassword.html', form=form) + return render_template('change-password.html', form=form) user.password = form.password.data user.save() @@ -209,7 +209,7 @@ def change_password(): def reset_password(): form = ResetPassForm() if not form.validate_on_submit(): - return render_template('resetpassword.html', form=form) + return render_template('reset-password.html', form=form) user = User.get(User.mail_address == form.email.data) @@ -250,7 +250,7 @@ def recover_password_check(user: User, token: str): form = RecoverPassForm() if not form.validate_on_submit(): return render_template( - 'recoverpassword.html', form=form, id=user.id, token=token, + 'recover-password.html', form=form, id=user.id, token=token, ) user.password = form.password.data user.save() diff --git a/lms/templates/changepassword.html b/lms/templates/change-password.html similarity index 90% rename from lms/templates/changepassword.html rename to lms/templates/change-password.html index e4734f47..61c5ef71 100644 --- a/lms/templates/changepassword.html +++ b/lms/templates/change-password.html @@ -14,7 +14,6 @@

    {{ _('שינוי סיסמה') {{ render_field(form.password, cls="form-control form-control-lg", placeholder=_('סיסמה חדשה')) }} {{ render_field(form.confirm, cls="form-control form-control-lg", placeholder=_('אימות סיסמה חדשה')) }} -

    diff --git a/lms/templates/recoverpassword.html b/lms/templates/recover-password.html similarity index 90% rename from lms/templates/recoverpassword.html rename to lms/templates/recover-password.html index 791c6b0b..a805977c 100644 --- a/lms/templates/recoverpassword.html +++ b/lms/templates/recover-password.html @@ -14,7 +14,6 @@

    {{ _('איפוס סיסמה') {{ render_field(form.password, cls="form-control form-control-lg", placeholder=_('סיסמה חדשה')) }} {{ render_field(form.confirm, cls="form-control form-control-lg", placeholder=_('אימות סיסמה חדשה')) }} -

    diff --git a/lms/templates/resetpassword.html b/lms/templates/reset-password.html similarity index 100% rename from lms/templates/resetpassword.html rename to lms/templates/reset-password.html diff --git a/tests/test_users.py b/tests/test_users.py index 07e224d1..cee37e6c 100644 --- a/tests/test_users.py +++ b/tests/test_users.py @@ -86,7 +86,7 @@ def test_invalid_change_password(captured_templates): 'confirm': 'some_password', }, follow_redirects=True) template, _ = captured_templates[-1] - assert template.name == "changepassword.html" + assert template.name == "change-password.html" client.post('/change-password', data={ 'current_password': 'fake pass', @@ -94,7 +94,7 @@ def test_invalid_change_password(captured_templates): 'confirm': 'some_password', }, follow_redirects=True) template, _ = captured_templates[-1] - assert template.name == "changepassword.html" + assert template.name == "change-password.html" @staticmethod def test_valid_change_password(captured_templates): @@ -118,7 +118,7 @@ def test_forgot_my_password_invalid_mail( 'email': 'fake-mail@mail.com', }, follow_redirects=True) template, _ = captured_templates[-1] - assert template.name == "resetpassword.html" + assert template.name == "reset-password.html" @staticmethod def test_forgot_my_password_invalid_recover( @@ -145,7 +145,7 @@ def test_forgot_my_password_invalid_recover( 'confirm': 'different pass', }, follow_redirects=True) template, _ = captured_templates[-1] - assert template.name == "recoverpassword.html" + assert template.name == "recover-password.html" @staticmethod def test_forgot_my_password(client: FlaskClient, captured_templates): From 2ffbeedb2c75bfa792e2213ccea468a25836a51b Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Sat, 25 Sep 2021 09:55:49 +0300 Subject: [PATCH 50/51] Removed unused imports and moved out to conftest some client.post's --- tests/conftest.py | 53 ++++++++++++++++++- tests/test_login.py | 23 +++----- tests/test_registration.py | 106 +++++++++++++------------------------ tests/test_users.py | 103 +++++++++++------------------------ 4 files changed, 127 insertions(+), 158 deletions(-) diff --git a/tests/conftest.py b/tests/conftest.py index e960cc29..9ae1d4b6 100644 --- a/tests/conftest.py +++ b/tests/conftest.py @@ -10,6 +10,7 @@ from flask_mail import Mail from peewee import SqliteDatabase import pytest +from werkzeug.test import TestResponse from lms.lmsdb.models import ( ALL_MODELS, Comment, CommentText, Exercise, Note, Notification, Role, @@ -121,9 +122,57 @@ def logout_user(client: FlaskClient) -> None: client.get('/logout', follow_redirects=True) +def signup_client_user( + client: FlaskClient, email: str, username: str, fullname: str, + password: str, confirm_password: str, +) -> TestResponse: + return client.post('/signup', data={ + 'email': email, + 'username': username, + 'fullname': fullname, + 'password': password, + 'confirm': confirm_password, + }, follow_redirects=True) + + +def login_client_user( + client: FlaskClient, username: str, password: str, +) -> TestResponse: + return client.post('/login', data={ + 'username': username, + 'password': password, + }, follow_redirects=True) + + +def change_client_password( + client: FlaskClient, current_password: str, + new_password: str, confirm_password: str, +) -> TestResponse: + return client.post('/change-password', data={ + 'current_password': current_password, + 'password': new_password, + 'confirm': confirm_password, + }, follow_redirects=True) + + +def reset_client_password(client: FlaskClient, email: str) -> TestResponse: + return client.post('/reset-password', data={ + 'email': email, + }, follow_redirects=True) + + +def recover_client_password( + client: FlaskClient, user_id: int, token: str, + password: str, confirm_password: str, +) -> TestResponse: + return client.post(f'/recover-password/{user_id}/{token}', data={ + 'password': password, + 'confirm': confirm_password, + }, follow_redirects=True) + + def create_user( - role_name: str = RoleOptions.STUDENT.value, - index: int = 1, + role_name: str = RoleOptions.STUDENT.value, index: int = 1, ) -> User: username = f'{role_name}-{index}' password = 'fake pass' diff --git a/tests/test_login.py b/tests/test_login.py index 5a6f8e91..7eb612d9 100644 --- a/tests/test_login.py +++ b/tests/test_login.py @@ -1,24 +1,19 @@ from flask.testing import FlaskClient from lms.lmsdb.models import User +from tests import conftest class TestLogin: @staticmethod def test_login_password_fail(client: FlaskClient, student_user: User): - client.post('/login', data={ - 'username': student_user.username, - 'password': 'wrong_pass', - }, follow_redirects=True) + conftest.login_client_user(client, student_user.username, 'wrong_pass') fail_login_response = client.get('/exercises') assert fail_login_response.status_code == 302 @staticmethod def test_login_username_fail(client: FlaskClient): - client.post('/login', data={ - 'username': 'wrong_user', - 'password': 'fake pass', - }, follow_redirects=True) + conftest.login_client_user(client, 'wrong user', 'fake pass') fail_login_response = client.get('/exercises') assert fail_login_response.status_code == 302 @@ -26,10 +21,9 @@ def test_login_username_fail(client: FlaskClient): def test_login_unverified_user( client: FlaskClient, unverified_user: User, captured_templates, ): - client.post('/login', data={ - 'username': unverified_user.username, - 'password': 'fake pass', - }, follow_redirects=True) + conftest.login_client_user( + client, unverified_user.username, 'fake pass', + ) template, _ = captured_templates[-1] assert template.name == 'login.html' @@ -38,9 +32,6 @@ def test_login_unverified_user( @staticmethod def test_login_success(client: FlaskClient, student_user: User): - client.post('/login', data={ - 'username': student_user.username, - 'password': 'fake pass', - }, follow_redirects=True) + conftest.login_client_user(client, student_user.username, 'fake pass') success_login_response = client.get('/exercises') assert success_login_response.status_code == 200 diff --git a/tests/test_registration.py b/tests/test_registration.py index 4b17cea8..f4f26dac 100644 --- a/tests/test_registration.py +++ b/tests/test_registration.py @@ -1,11 +1,9 @@ -import sys import time from unittest.mock import Mock, patch from flask.testing import FlaskClient -import pytest -from lms.lmsweb.config import CONFIRMATION_TIME, MAIL_DEFAULT_SENDER +from lms.lmsweb.config import CONFIRMATION_TIME from lms.lmsdb.models import User from lms.models.users import generate_user_token from tests import conftest @@ -16,20 +14,16 @@ class TestRegistration: def test_invalid_username( client: FlaskClient, student_user: User, captured_templates, ): - client.post('/signup', data={ - 'email': 'some_name@mail.com', - 'username': student_user.username, - 'fullname': 'some_name', - 'password': 'some_password', - 'confirm': 'some_password', - }, follow_redirects=True) + conftest.signup_client_user( + client, 'some_name@mail.com', student_user.username, + 'some_name', 'some_password', 'some_password', + ) template, _ = captured_templates[-1] assert template.name == "signup.html" - client.post('/login', data={ - 'username': student_user.username, - 'password': 'some_password', - }, follow_redirects=True) + conftest.login_client_user( + client, student_user.username, 'some_password', + ) fail_login_response = client.get('/exercises') assert fail_login_response.status_code == 302 @@ -37,6 +31,10 @@ def test_invalid_username( def test_invalid_email( client: FlaskClient, student_user: User, captured_templates, ): + conftest.signup_client_user( + client, student_user.mail_address, 'some_user', + 'some_name', 'some_password', 'some_password', + ) client.post('/signup', data={ 'email': student_user.mail_address, 'username': 'some_user', @@ -47,22 +45,16 @@ def test_invalid_email( template, _ = captured_templates[-1] assert template.name == 'signup.html' - client.post('/login', data={ - 'username': 'some_user', - 'password': 'some_password', - }, follow_redirects=True) + conftest.login_client_user(client, 'some_user', 'some_password') fail_login_response = client.get('/exercises') assert fail_login_response.status_code == 302 @staticmethod def test_bad_token_or_id(client: FlaskClient): - client.post('/signup', data={ - 'email': 'some_user123@mail.com', - 'username': 'some_user', - 'fullname': 'some_name', - 'password': 'some_password', - 'confirm': 'some_password', - }, follow_redirects=True) + conftest.signup_client_user( + client, 'some_user123@mail.com', 'some_user', + 'some_name', 'some_password', 'some_password', + ) user = User.get_or_none(User.username == 'some_user') bad_token = "fake-token43@$@" fail_confirm_response = client.get( @@ -78,13 +70,10 @@ def test_bad_token_or_id(client: FlaskClient): @staticmethod def test_use_token_twice(client: FlaskClient): - client.post('/signup', data={ - 'email': 'some_user123@mail.com', - 'username': 'some_user', - 'fullname': 'some_name', - 'password': 'some_password', - 'confirm': 'some_password', - }, follow_redirects=True) + conftest.signup_client_user( + client, 'some_user123@mail.com', 'some_user', + 'some_name', 'some_password', 'some_password', + ) user = User.get_or_none(User.username == 'some_user') token = generate_user_token(user) success_token_response = client.get( @@ -99,13 +88,10 @@ def test_use_token_twice(client: FlaskClient): @staticmethod def test_expired_token(client: FlaskClient): - client.post('/signup', data={ - 'email': 'some_user123@mail.com', - 'username': 'some_user', - 'fullname': 'some_name', - 'password': 'some_password', - 'confirm': 'some_password', - }, follow_redirects=True) + conftest.signup_client_user( + client, 'some_user123@mail.com', 'some_user', + 'some_name', 'some_password', 'some_password', + ) user = User.get_or_none(User.username == 'some_user') token = generate_user_token(user) @@ -114,10 +100,7 @@ def test_expired_token(client: FlaskClient): client.get( f'/confirm-email/{user.id}/{token}', follow_redirects=True, ) - client.post('/login', data={ - 'username': 'some_user', - 'password': 'some_password', - }, follow_redirects=True) + conftest.login_client_user(client, 'some_user', 'some_password') fail_login_response = client.get('/exercises') assert fail_login_response.status_code == 302 @@ -125,52 +108,37 @@ def test_expired_token(client: FlaskClient): client.get( f'/confirm-email/{user.id}/{token}', follow_redirects=True, ) - client.post('/login', data={ - 'username': 'some_user', - 'password': 'some_password', - }, follow_redirects=True) + conftest.login_client_user(client, 'some_user', 'some_password') success_login_response = client.get('/exercises') assert success_login_response.status_code == 200 @staticmethod def test_successful_registration(client: FlaskClient, captured_templates): - client.post('/signup', data={ - 'email': MAIL_DEFAULT_SENDER, - 'username': 'some_user', - 'fullname': 'some_name', - 'password': 'some_password', - 'confirm': 'some_password', - }, follow_redirects=True) + conftest.signup_client_user( + client, 'some_user123@mail.com', 'some_user', + 'some_name', 'some_password', 'some_password', + ) template, _ = captured_templates[-1] assert template.name == 'login.html' - client.post('/login', data={ - 'username': 'some_user', - 'password': 'some_password', - }, follow_redirects=True) + conftest.login_client_user(client, 'some_user', 'some_password') fail_login_response = client.get('/exercises') assert fail_login_response.status_code == 302 user = User.get_or_none(User.username == 'some_user') token = generate_user_token(user) client.get(f'/confirm-email/{user.id}/{token}', follow_redirects=True) - client.post('/login', data={ - 'username': 'some_user', - 'password': 'some_password', - }, follow_redirects=True) + conftest.login_client_user(client, 'some_user', 'some_password') success_login_response = client.get('/exercises') assert success_login_response.status_code == 200 @staticmethod def test_registartion_closed(client: FlaskClient, captured_templates): conftest.disable_registration() - client.post('/signup', data={ - 'email': 'some_user123@mail.com', - 'username': 'some_user', - 'fullname': 'some_name', - 'password': 'some_password', - 'confirm': 'some_password', - }, follow_redirects=True) + conftest.signup_client_user( + client, 'some_user123@mail.com', 'some_user', + 'some_name', 'some_password', 'some_password', + ) user = User.get_or_none(User.username == 'some_user') assert user is None diff --git a/tests/test_users.py b/tests/test_users.py index cee37e6c..ea510e23 100644 --- a/tests/test_users.py +++ b/tests/test_users.py @@ -2,7 +2,6 @@ from unittest.mock import Mock, patch from flask.testing import FlaskClient -import pytest from lms.lmsdb.models import User from lms.lmsweb.config import CONFIRMATION_TIME, MAX_INVALID_PASSWORD_TRIES @@ -69,10 +68,9 @@ def test_logout(student_user: User): @staticmethod def test_banned_user(client: FlaskClient, banned_user: User): - login_response = client.post('/login', data={ - 'username': banned_user.username, - 'password': 'fake pass', - }, follow_redirects=True) + login_response = conftest.login_client_user( + client, banned_user.username, 'fake pass', + ) assert 'banned' in login_response.get_data(as_text=True) @staticmethod @@ -80,19 +78,15 @@ def test_invalid_change_password(captured_templates): student_user = conftest.create_student_user(index=1) client = conftest.get_logged_user(student_user.username) for _ in range(MAX_INVALID_PASSWORD_TRIES): - client.post('/change-password', data={ - 'current_password': 'wrong pass', - 'password': 'some_password', - 'confirm': 'some_password', - }, follow_redirects=True) + conftest.change_client_password( + client, 'wrong pass', 'some_password', 'some_password', + ) template, _ = captured_templates[-1] assert template.name == "change-password.html" - client.post('/change-password', data={ - 'current_password': 'fake pass', - 'password': 'some_password', - 'confirm': 'some_password', - }, follow_redirects=True) + conftest.change_client_password( + client, 'fake pass', 'some_password', 'some_password', + ) template, _ = captured_templates[-1] assert template.name == "change-password.html" @@ -100,11 +94,9 @@ def test_invalid_change_password(captured_templates): def test_valid_change_password(captured_templates): student_user = conftest.create_student_user(index=1) client = conftest.get_logged_user(student_user.username) - client.post('/change-password', data={ - 'current_password': 'fake pass', - 'password': 'some_password', - 'confirm': 'some_password', - }, follow_redirects=True) + conftest.change_client_password( + client, 'fake pass', 'some_password', 'some_password', + ) template, _ = captured_templates[-1] assert template.name == "login.html" check_logout_response = client.get('/exercises') @@ -114,9 +106,7 @@ def test_valid_change_password(captured_templates): def test_forgot_my_password_invalid_mail( client: FlaskClient, captured_templates, ): - client.post('/reset-password', data={ - 'email': 'fake-mail@mail.com', - }, follow_redirects=True) + conftest.reset_client_password(client, 'fake-mail@mail.com') template, _ = captured_templates[-1] assert template.name == "reset-password.html" @@ -125,93 +115,64 @@ def test_forgot_my_password_invalid_recover( client: FlaskClient, captured_templates, ): user = conftest.create_student_user(index=1) - client.post('/reset-password', data={ - 'email': user.mail_address, - }, follow_redirects=True) + conftest.reset_client_password(client, user.mail_address) template, _ = captured_templates[-1] assert template.name == "login.html" token = generate_user_token(user) - unknown_id_recover_response = client.post( - f'/recover-password/{user.id + 1}/{token}', data={ - 'password': 'different pass', - 'confirm': 'different pass', - }, follow_redirects=True, + unknown_id_recover_response = conftest.recover_client_password( + client, user.id + 1, token, 'different pass', 'different pass', ) assert unknown_id_recover_response.status_code == 404 - client.post(f'/recover-password/{user.id}/{token}', data={ - 'password': 'wrong pass', - 'confirm': 'different pass', - }, follow_redirects=True) + conftest.recover_client_password( + client, user.id, token, 'wrong pass', 'different pass', + ) template, _ = captured_templates[-1] assert template.name == "recover-password.html" @staticmethod def test_forgot_my_password(client: FlaskClient, captured_templates): user = conftest.create_student_user(index=1) - client.post('/reset-password', data={ - 'email': user.mail_address, - }, follow_redirects=True) + conftest.reset_client_password(client, user.mail_address) template, _ = captured_templates[-1] assert template.name == "login.html" token = generate_user_token(user) - client.post(f'/recover-password/{user.id}/{token}', data={ - 'password': 'new pass', - 'confirm': 'new pass', - }, follow_redirects=True) + conftest.recover_client_password( + client, user.id, token, 'new pass', 'new pass', + ) template, _ = captured_templates[-1] assert template.name == "login.html" - second_try_response = client.post( - f'/recover-password/{user.id}/{token}', data={ - 'password': 'new pass1', - 'confirm': 'new pass1', - }, follow_redirects=True, + second_try_response = conftest.recover_client_password( + client, user.id, token, 'new pass1', 'new pass1', ) assert second_try_response.status_code == 404 - client.post('/login', data={ - 'username': user.username, - 'password': 'fake pass', - }, follow_redirects=True) + conftest.login_client_user(client, user.username, 'fake pass') template, _ = captured_templates[-1] assert template.name == 'login.html' - client.post('/login', data={ - 'username': user.username, - 'password': 'new pass', - }, follow_redirects=True) + conftest.login_client_user(client, user.username, 'new pass') template, _ = captured_templates[-1] assert template.name == 'exercises.html' @staticmethod def test_expired_token(client: FlaskClient): user = conftest.create_student_user(index=1) - client.post('/reset-password', data={ - 'email': user.mail_address, - }, follow_redirects=True) + conftest.reset_client_password(client, user.mail_address) token = generate_user_token(user) fake_time = time.time() + CONFIRMATION_TIME + 1 with patch('time.time', Mock(return_value=fake_time)): - client.post( - f'/recover-password/{user.id}/{token}', data={ - 'password': 'new pass1', - 'confirm': 'new pass1', - }, follow_redirects=True, + conftest.recover_client_password( + client, user.id, token, 'new pass1', 'new pass1', ) - client.post('/login', data={ - 'username': user.username, - 'password': 'new pass1', - }, follow_redirects=True) + conftest.login_client_user(client, user.username, 'new pass1') fail_login_response = client.get('/exercises') assert fail_login_response.status_code == 302 - client.post('/login', data={ - 'username': user.username, - 'password': 'fake pass', - }, follow_redirects=True) + conftest.login_client_user(client, user.username, 'fake pass') fail_login_response = client.get('/exercises') assert fail_login_response.status_code == 200 From 7153c46787bef6e76e29f05175f96f7932721a5b Mon Sep 17 00:00:00 2001 From: Or Ronai Date: Sat, 25 Sep 2021 10:20:24 +0300 Subject: [PATCH 51/51] Removed TestResponse objects --- tests/conftest.py | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/tests/conftest.py b/tests/conftest.py index 9ae1d4b6..24b8f472 100644 --- a/tests/conftest.py +++ b/tests/conftest.py @@ -10,7 +10,6 @@ from flask_mail import Mail from peewee import SqliteDatabase import pytest -from werkzeug.test import TestResponse from lms.lmsdb.models import ( ALL_MODELS, Comment, CommentText, Exercise, Note, Notification, Role, @@ -125,7 +124,7 @@ def logout_user(client: FlaskClient) -> None: def signup_client_user( client: FlaskClient, email: str, username: str, fullname: str, password: str, confirm_password: str, -) -> TestResponse: +): return client.post('/signup', data={ 'email': email, 'username': username, @@ -135,9 +134,7 @@ def signup_client_user( }, follow_redirects=True) -def login_client_user( - client: FlaskClient, username: str, password: str, -) -> TestResponse: +def login_client_user(client: FlaskClient, username: str, password: str): return client.post('/login', data={ 'username': username, 'password': password, @@ -147,7 +144,7 @@ def login_client_user( def change_client_password( client: FlaskClient, current_password: str, new_password: str, confirm_password: str, -) -> TestResponse: +): return client.post('/change-password', data={ 'current_password': current_password, 'password': new_password, @@ -155,7 +152,7 @@ def change_client_password( }, follow_redirects=True) -def reset_client_password(client: FlaskClient, email: str) -> TestResponse: +def reset_client_password(client: FlaskClient, email: str): return client.post('/reset-password', data={ 'email': email, }, follow_redirects=True) @@ -164,7 +161,7 @@ def reset_client_password(client: FlaskClient, email: str) -> TestResponse: def recover_client_password( client: FlaskClient, user_id: int, token: str, password: str, confirm_password: str, -) -> TestResponse: +): return client.post(f'/recover-password/{user_id}/{token}', data={ 'password': password, 'confirm': confirm_password,