Changeset 1709

Show
Ignore:
Timestamp:
12/17/06 20:17:10 (2 years ago)
Author:
mgood
Message:

AccountManagerPlugin:

require users to enter current password in order to change their password or delete their accounts (fixes #682)

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • accountmanagerplugin/0.10/acct_mgr/templates/account.cs

    r1549 r1709  
    2323 <?cs /if ?> 
    2424 
     25 <h2>Change Password</h2> 
     26 <?cs if account.save_error ?> 
     27 <div class="system-message"> 
     28  <h2>Error</h2> 
     29  <p><?cs var:account.save_error ?></p> 
     30 </div> 
     31 <?cs /if ?> 
     32 
    2533 <form method="post" action=""> 
     34  <input type="hidden" name="action" value="change_password" /> 
    2635  <div> 
    27    <input type="hidden" name="action" value="change_password" /> 
     36   <label for="old_password">Old Password:</label> 
     37   <input type="password" id="old_password" name="old_password" 
     38          class="textwidget" size="20" /> 
     39  </div> 
     40  <div> 
    2841   <label for="password">New Password:</label> 
    2942   <input type="password" id="password" name="password" class="textwidget" 
    …… 
    3952 
    4053 <?cs if:delete_enabled ?> 
     54 <hr /> 
     55 
     56 <h2>Delete Account</h2> 
     57 <?cs if account.delete_error ?> 
     58 <div class="system-message"> 
     59  <h2>Error</h2> 
     60  <p><?cs var:account.delete_error ?></p> 
     61 </div> 
     62 <?cs /if ?> 
     63 
    4164 <form method="post" action="" 
    4265       onsubmit="return confirm('Are you sure you want to delete your account?');"> 
    4366  <input type="hidden" name="action" value="delete" /> 
     67  <div> 
     68   <label for="password">Password:</label> 
     69   <input type="password" id="password" name="password" class="textwidget" 
     70          size="20" /> 
     71  </div> 
    4472  <input type="submit" value="Delete account" /> 
    4573 </form> 

  • accountmanagerplugin/0.10/acct_mgr/web_ui.py

    r1549 r1709  
    202202    def _do_change_password(self, req): 
    203203        user = req.authname 
     204        mgr = AccountManager(self.env) 
     205        old_password = req.args.get('old_password') 
     206        if not old_password: 
     207            req.hdf['account.save_error'] = 'Old Password cannot be empty.' 
     208            return 
     209        if not mgr.check_password(user, old_password): 
     210            req.hdf['account.save_error'] = 'Old Password is incorrect.' 
     211            return 
     212 
    204213        password = req.args.get('password') 
    205214        if not password: 
    206             req.hdf['account.error'] = 'Password cannot be empty.' 
     215            req.hdf['account.save_error'] = 'Password cannot be empty.' 
    207216            return 
    208217 
    209218        if password != req.args.get('password_confirm'): 
    210             req.hdf['account.error'] = 'The passwords must match.' 
    211             return 
    212  
    213         AccountManager(self.env).set_password(user, password) 
     219            req.hdf['account.save_error'] = 'The passwords must match.' 
     220            return 
     221 
     222        mgr.set_password(user, password) 
    214223        req.hdf['account.message'] = 'Password successfully updated.' 
    215224 
    216225    def _do_delete(self, req): 
    217226        user = req.authname 
    218         AccountManager(self.env).delete_user(user) 
     227        mgr = AccountManager(self.env) 
     228        password = req.args.get('password') 
     229        if not password: 
     230            req.hdf['account.delete_error'] = 'Password cannot be empty.' 
     231            return 
     232        if not mgr.check_password(user, password): 
     233            req.hdf['account.delete_error'] = 'Password is incorrect.' 
     234            return 
     235 
     236        mgr.delete_user(user) 
    219237        req.redirect(self.env.href.logout()) 
    220238 

  • accountmanagerplugin/trunk/acct_mgr/templates/prefs_account.html

    r1560 r1709  
    1111  <div py:match="div[@id='tabcontent'][1]" py:attrs="select('@*')"> 
    1212    ${select('*')} 
    13     <form method="post" action="" py:if="account.delete_enabled" 
     13    <py:if test="account.delete_enabled"> 
     14    <hr/> 
     15    <h2>Delete Account</h2> 
     16 
     17    <div class="system-message" py:if="account.delete_error"> 
     18      <h2>Error</h2> 
     19      <p>$account.delete_error</p> 
     20    </div> 
     21 
     22    <form method="post" action="" 
    1423          onsubmit="return confirm('Are you sure you want to delete your account?');"> 
     24      <div class="field"> 
     25        <label>Password: 
     26          <input type="password" name="password" class="textwidget" 
     27                 size="20" /> 
     28        </label> 
     29      </div> 
    1530      <div class="buttons"> 
    1631        <input type="hidden" name="action" value="delete" /> 
    …… 
    1833      </div> 
    1934    </form> 
     35    </py:if> 
    2036  </div> 
    2137  
    …… 
    3147 
    3248    <p py:if="account.message">$account.message</p> 
     49    <h2>Change Password</h2> 
    3350 
     51    <div class="system-message" py:if="account.save_error"> 
     52      <h2>Error</h2> 
     53      <p>$account.save_error</p> 
     54    </div> 
     55 
     56    <div class="field"> 
     57      <label>Old Password: 
     58        <input type="password" name="old_password" class="textwidget" 
     59               size="20" /> 
     60      </label> 
     61    </div> 
    3462    <div class="field"> 
    3563      <label>New Password: 

  • accountmanagerplugin/trunk/acct_mgr/web_ui.py

    r1560 r1709  
    205205    def _do_change_password(self, req): 
    206206        user = req.authname 
     207        mgr = AccountManager(self.env) 
     208 
     209        old_password = req.args.get('old_password') 
     210        if not old_password: 
     211            return {'save_error': 'Old Password cannot be empty.'} 
     212        if not mgr.check_password(user, old_password): 
     213            return {'save_error': 'Old Password is incorrect.'} 
     214 
    207215        password = req.args.get('password') 
    208216        if not password: 
    209             return {'error': 'Password cannot be empty.'} 
     217            return {'save_error': 'Password cannot be empty.'} 
    210218 
    211219        if password != req.args.get('password_confirm'): 
    212             return {'error': 'The passwords must match.'} 
    213  
    214         AccountManager(self.env).set_password(user, password) 
     220            return {'save_error': 'The passwords must match.'} 
     221 
     222        mgr.set_password(user, password) 
    215223        return {'message': 'Password successfully updated.'} 
    216224 
    217225    def _do_delete(self, req): 
    218226        user = req.authname 
    219         AccountManager(self.env).delete_user(user) 
     227        mgr = AccountManager(self.env) 
     228 
     229        password = req.args.get('password') 
     230        if not password: 
     231            return {'delete_error': 'Password cannot be empty.'} 
     232        if not mgr.check_password(user, password): 
     233            return {'delete_error': 'Password is incorrect.'} 
     234 
     235        mgr.delete_user(user) 
    220236        req.redirect(self.env.href.logout()) 
    221237