Infrastructure/fedora-infrastructure
1
0
Fork 0
Code Issues 70 Pull requests Projects Releases Packages Wiki Activity Actions

FAS is not in its own repo at git.fedorahosted.org/git/fas.git

Browse source
This commit is contained in:
Ricky Zhou (周家杰) 2008-03-19 09:49:40 -04:00
parent 06072e3ac8
commit 0221ae19dc
123 changed files with 0 additions and 18636 deletions
Download patch file Download diff file Expand all files Collapse all files

16
fas/.gitignore vendored
View file

@ -1,16 +0,0 @@
*~
random_seed
pubring.gpg
secring.gpg
trustdb.gpg
fas.log
*.pyc
*.pyo
*.swp
*.mo
fas.egg-info
build
gnupg
locale
ssl

340
fas/COPYING
View file

@ -1,340 +0,0 @@
GNU GENERAL PUBLIC LICENSE
Version 2, June 1991
Copyright (C) 1989, 1991 Free Software Foundation, Inc.
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
Preamble
The licenses for most software are designed to take away your
freedom to share and change it. By contrast, the GNU General Public
License is intended to guarantee your freedom to share and change free
software--to make sure the software is free for all its users. This
General Public License applies to most of the Free Software
Foundation's software and to any other program whose authors commit to
using it. (Some other Free Software Foundation software is covered by
the GNU Library General Public License instead.) You can apply it to
your programs, too.
When we speak of free software, we are referring to freedom, not
price. Our General Public Licenses are designed to make sure that you
have the freedom to distribute copies of free software (and charge for
this service if you wish), that you receive source code or can get it
if you want it, that you can change the software or use pieces of it
in new free programs; and that you know you can do these things.
To protect your rights, we need to make restrictions that forbid
anyone to deny you these rights or to ask you to surrender the rights.
These restrictions translate to certain responsibilities for you if you
distribute copies of the software, or if you modify it.
For example, if you distribute copies of such a program, whether
gratis or for a fee, you must give the recipients all the rights that
you have. You must make sure that they, too, receive or can get the
source code. And you must show them these terms so they know their
rights.
We protect your rights with two steps: (1) copyright the software, and
(2) offer you this license which gives you legal permission to copy,
distribute and/or modify the software.
Also, for each author's protection and ours, we want to make certain
that everyone understands that there is no warranty for this free
software. If the software is modified by someone else and passed on, we
want its recipients to know that what they have is not the original, so
that any problems introduced by others will not reflect on the original
authors' reputations.
Finally, any free program is threatened constantly by software
patents. We wish to avoid the danger that redistributors of a free
program will individually obtain patent licenses, in effect making the
program proprietary. To prevent this, we have made it clear that any
patent must be licensed for everyone's free use or not licensed at all.
The precise terms and conditions for copying, distribution and
modification follow.
GNU GENERAL PUBLIC LICENSE
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
0. This License applies to any program or other work which contains
a notice placed by the copyright holder saying it may be distributed
under the terms of this General Public License. The "Program", below,
refers to any such program or work, and a "work based on the Program"
means either the Program or any derivative work under copyright law:
that is to say, a work containing the Program or a portion of it,
either verbatim or with modifications and/or translated into another
language. (Hereinafter, translation is included without limitation in
the term "modification".) Each licensee is addressed as "you".
Activities other than copying, distribution and modification are not
covered by this License; they are outside its scope. The act of
running the Program is not restricted, and the output from the Program
is covered only if its contents constitute a work based on the
Program (independent of having been made by running the Program).
Whether that is true depends on what the Program does.
1. You may copy and distribute verbatim copies of the Program's
source code as you receive it, in any medium, provided that you
conspicuously and appropriately publish on each copy an appropriate
copyright notice and disclaimer of warranty; keep intact all the
notices that refer to this License and to the absence of any warranty;
and give any other recipients of the Program a copy of this License
along with the Program.
You may charge a fee for the physical act of transferring a copy, and
you may at your option offer warranty protection in exchange for a fee.
2. You may modify your copy or copies of the Program or any portion
of it, thus forming a work based on the Program, and copy and
distribute such modifications or work under the terms of Section 1
above, provided that you also meet all of these conditions:
a) You must cause the modified files to carry prominent notices
stating that you changed the files and the date of any change.
b) You must cause any work that you distribute or publish, that in
whole or in part contains or is derived from the Program or any
part thereof, to be licensed as a whole at no charge to all third
parties under the terms of this License.
c) If the modified program normally reads commands interactively
when run, you must cause it, when started running for such
interactive use in the most ordinary way, to print or display an
announcement including an appropriate copyright notice and a
notice that there is no warranty (or else, saying that you provide
a warranty) and that users may redistribute the program under
these conditions, and telling the user how to view a copy of this
License. (Exception: if the Program itself is interactive but
does not normally print such an announcement, your work based on
the Program is not required to print an announcement.)
These requirements apply to the modified work as a whole. If
identifiable sections of that work are not derived from the Program,
and can be reasonably considered independent and separate works in
themselves, then this License, and its terms, do not apply to those
sections when you distribute them as separate works. But when you
distribute the same sections as part of a whole which is a work based
on the Program, the distribution of the whole must be on the terms of
this License, whose permissions for other licensees extend to the
entire whole, and thus to each and every part regardless of who wrote it.
Thus, it is not the intent of this section to claim rights or contest
your rights to work written entirely by you; rather, the intent is to
exercise the right to control the distribution of derivative or
collective works based on the Program.
In addition, mere aggregation of another work not based on the Program
with the Program (or with a work based on the Program) on a volume of
a storage or distribution medium does not bring the other work under
the scope of this License.
3. You may copy and distribute the Program (or a work based on it,
under Section 2) in object code or executable form under the terms of
Sections 1 and 2 above provided that you also do one of the following:
a) Accompany it with the complete corresponding machine-readable
source code, which must be distributed under the terms of Sections
1 and 2 above on a medium customarily used for software interchange; or,
b) Accompany it with a written offer, valid for at least three
years, to give any third party, for a charge no more than your
cost of physically performing source distribution, a complete
machine-readable copy of the corresponding source code, to be
distributed under the terms of Sections 1 and 2 above on a medium
customarily used for software interchange; or,
c) Accompany it with the information you received as to the offer
to distribute corresponding source code. (This alternative is
allowed only for noncommercial distribution and only if you
received the program in object code or executable form with such
an offer, in accord with Subsection b above.)
The source code for a work means the preferred form of the work for
making modifications to it. For an executable work, complete source
code means all the source code for all modules it contains, plus any
associated interface definition files, plus the scripts used to
control compilation and installation of the executable. However, as a
special exception, the source code distributed need not include
anything that is normally distributed (in either source or binary
form) with the major components (compiler, kernel, and so on) of the
operating system on which the executable runs, unless that component
itself accompanies the executable.
If distribution of executable or object code is made by offering
access to copy from a designated place, then offering equivalent
access to copy the source code from the same place counts as
distribution of the source code, even though third parties are not
compelled to copy the source along with the object code.
4. You may not copy, modify, sublicense, or distribute the Program
except as expressly provided under this License. Any attempt
otherwise to copy, modify, sublicense or distribute the Program is
void, and will automatically terminate your rights under this License.
However, parties who have received copies, or rights, from you under
this License will not have their licenses terminated so long as such
parties remain in full compliance.
5. You are not required to accept this License, since you have not
signed it. However, nothing else grants you permission to modify or
distribute the Program or its derivative works. These actions are
prohibited by law if you do not accept this License. Therefore, by
modifying or distributing the Program (or any work based on the
Program), you indicate your acceptance of this License to do so, and
all its terms and conditions for copying, distributing or modifying
the Program or works based on it.
6. Each time you redistribute the Program (or any work based on the
Program), the recipient automatically receives a license from the
original licensor to copy, distribute or modify the Program subject to
these terms and conditions. You may not impose any further
restrictions on the recipients' exercise of the rights granted herein.
You are not responsible for enforcing compliance by third parties to
this License.
7. If, as a consequence of a court judgment or allegation of patent
infringement or for any other reason (not limited to patent issues),
conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License. If you cannot
distribute so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you
may not distribute the Program at all. For example, if a patent
license would not permit royalty-free redistribution of the Program by
all those who receive copies directly or indirectly through you, then
the only way you could satisfy both it and this License would be to
refrain entirely from distribution of the Program.
If any portion of this section is held invalid or unenforceable under
any particular circumstance, the balance of the section is intended to
apply and the section as a whole is intended to apply in other
circumstances.
It is not the purpose of this section to induce you to infringe any
patents or other property right claims or to contest validity of any
such claims; this section has the sole purpose of protecting the
integrity of the free software distribution system, which is
implemented by public license practices. Many people have made
generous contributions to the wide range of software distributed
through that system in reliance on consistent application of that
system; it is up to the author/donor to decide if he or she is willing
to distribute software through any other system and a licensee cannot
impose that choice.
This section is intended to make thoroughly clear what is believed to
be a consequence of the rest of this License.
8. If the distribution and/or use of the Program is restricted in
certain countries either by patents or by copyrighted interfaces, the
original copyright holder who places the Program under this License
may add an explicit geographical distribution limitation excluding
those countries, so that distribution is permitted only in or among
countries not thus excluded. In such case, this License incorporates
the limitation as if written in the body of this License.
9. The Free Software Foundation may publish revised and/or new versions
of the General Public License from time to time. Such new versions will
be similar in spirit to the present version, but may differ in detail to
address new problems or concerns.
Each version is given a distinguishing version number. If the Program
specifies a version number of this License which applies to it and "any
later version", you have the option of following the terms and conditions
either of that version or of any later version published by the Free
Software Foundation. If the Program does not specify a version number of
this License, you may choose any version ever published by the Free Software
Foundation.
10. If you wish to incorporate parts of the Program into other free
programs whose distribution conditions are different, write to the author
to ask for permission. For software which is copyrighted by the Free
Software Foundation, write to the Free Software Foundation; we sometimes
make exceptions for this. Our decision will be guided by the two goals
of preserving the free status of all derivatives of our free software and
of promoting the sharing and reuse of software generally.
NO WARRANTY
11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN
OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS
TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE
PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
REPAIR OR CORRECTION.
12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.
END OF TERMS AND CONDITIONS
How to Apply These Terms to Your New Programs
If you develop a new program, and you want it to be of the greatest
possible use to the public, the best way to achieve this is to make it
free software which everyone can redistribute and change under these terms.
To do so, attach the following notices to the program. It is safest
to attach them to the start of each source file to most effectively
convey the exclusion of warranty; and each file should have at least
the "copyright" line and a pointer to where the full notice is found.
<one line to give the program's name and a brief idea of what it does.>
Copyright (C) <year> <name of author>
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
Also add information on how to contact you by electronic and paper mail.
If the program is interactive, make it output a short notice like this
when it starts in an interactive mode:
Gnomovision version 69, Copyright (C) year name of author
Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
This is free software, and you are welcome to redistribute it
under certain conditions; type `show c' for details.
The hypothetical commands `show w' and `show c' should show the appropriate
parts of the General Public License. Of course, the commands you use may
be called something other than `show w' and `show c'; they could even be
mouse-clicks or menu items--whatever suits your program.
You should also get your employer (if you work as a programmer) or your
school, if any, to sign a "copyright disclaimer" for the program, if
necessary. Here is a sample; alter the names:
Yoyodyne, Inc., hereby disclaims all copyright interest in the program
`Gnomovision' (which makes passes at compilers) written by James Hacker.
<signature of Ty Coon>, 1 April 1989
Ty Coon, President of Vice
This General Public License does not permit incorporating your program into
proprietary programs. If your program is a subroutine library, you may
consider it more useful to permit linking proprietary applications with the
library. If this is what you want to do, use the GNU Library General
Public License instead of this License.

28
fas/MANIFEST.in
View file

@ -1,28 +0,0 @@
include fas2.sql
include README COPYING TODO
include *.cfg *.conf
include convert.py start-fas
include client/*.conf
include fas/config/*
include fas/static/*
include fas/static/css/*
include fas/static/images/*
include fas/static/images/balloons/*
include fas/static/js/*
include fas/static/theme/*
include fas/static/theme/fas/*
include fas/static/theme/fas/css/*
include fas/static/theme/fas/images/*
include fas/templates/cla/*.html
include fas/templates/cla/*.txt
include fas/templates/group/*.html
include fas/templates/group/*.txt
include fas/templates/openid/*.html
include fas/templates/openid/*.txt
include fas/templates/user/*.html
include fas/templates/user/*.txt
include fas/templates/*.html
include fas/templates/*.txt
include po/LINGUAS
include po/*.po
include po/*.pot

145
fas/README
View file

@ -1,145 +0,0 @@
=====================
Fedora Account System
=====================
:Authors: Ricky Zhou
Mike McGrath
Toshio Kuratomi
:Contact: fedora-infrastructure-list@redhat.com
:Date: Friday, 29 February, 2008
:Version: 0.1
The Fedora Account System holds information on Fedora Contributors to give
them access to the wonderful things that Fedora has.
.. contents::
This is a TurboGears_ project. It can be started by running the start-fas.py
script.
.. _TurboGears: http://www.turbogears.org
-------------
Prerequisites
-------------
Before you can get started, make sure to have the following packages installed
(example being from Fedora 8 with a local postgres database server)::
yum install git-core postgresql-plpython postgresql-server postgresql-python \
python-TurboMail TurboGears pygpgme python-sqlalchemy python-genshi \
python-psycopg2 pytz python-babel babel
# Note: on RHEL5 you need postgresql-pl instead of postgresql-plpython
At present, the database needs to be a postgres database since we use triggers
to manage some of the data (like syncing accounts with bugzilla).
If you are unfamiliar with postgres and this is your first time installing it,
you will want to generate the database and allow users to connect. First as
root run::
/etc/init.d/postgresql initdb
Then make sure the bottom of /var/lib/pgsql/data/pg_hba.conf looks like::
# TYPE DATABASE USER CIDR-ADDRESS METHOD
# "local" is for Unix domain socket connections only
local all all ident sameuser
# IPv4 local connections:
#host all all 127.0.0.1/32 ident sameuser
# IPv6 local connections:
#host all all ::1/128 ident sameuser
host all all 0.0.0.0 0.0.0.0 md5
Then just start the postgres database:
/etc/init.d/postgresql start
-------
Hacking
-------
If you want to hack on the Account System you need to checkout the module.
It's presently part of the fedora-infrastructure git repo::
git clone git://git.fedorahosted.org/git/fedora-infrastructure
cd fedora-infrastructure/fas
Once you are inside you're fresh checkout, you need to regenerate some files
that are created by the build script, setup.py::
python setup.py egg_info && python setup.py build
This will create the fas.egg-info directory which has metadata about the
program. It allows things like the identity provider to work.
Do any configuration necessary and start up the postgres server. Then make the
plpython language available on new databases, create a postgres user to manage
the data and import the schema::
sudo -u postgres createlang plpythonu template1
sudo -u postgres createuser --encrypted --pwprompt fedora
sudo -u postgres psql < fas2.sql
The last thing to do is configure the application to use your settings.
You'll need to edit dev.cfg and change the following lines::
mail.on = False # Set to True if you want to test notification sending
mail.server = 'localhost' # Your mail server
sqlalchemy.dburi = "postgres://fedora:pass@localhost/fas2" # Fill in the
# password you gave in the createuser step and the db host if it's not
# localhost.
server.socket_port=8080 # Change if you don't want to run on port 8080
base_url_filter.base_url = "http://localhost:8080/fas" # Change the port if
# you changed server.socket_port above.
You may also need to change some of the directories and settings in
fas/config/app.cfg.
You should then be able to start the server and test things out::
./start-fas.py
# browse to http://localhost:8080/fas/
The default administrative user is "admin" with password "admin"
Another handy command for trying short snippets of code is tg-admin shell.
Make sure you're in the top level directory that start-fas.py and dev.cfg is
in, then run::
tg-admin shell
--------------------
Enabling Local Users
--------------------
* THIS IS EXPERIMENTAL *
To allow local users to log in to your system, first enable fas via the
client in fas/client/fasClient.py
./fasClient -e
To disable run
./fasClient -d
To sync with your local install run:
./fasClient -i
To test, look and see if your groups or users show up with getent. For
example:
getent passwd
getent group
------------
Localization
------------
To generate the POT file (located in the po/ subdirectory), run the
following from the top level directory:
pybabel extract -F pybabel.conf -o po/fas.pot .
Message merging should be done manually using msgmerge at this point.
python setup.py build
compiles the PO files and places them where TurboGears will look for
them. To enable a language to be available to users, it must be added
to po/LINGUAS.

14
fas/TODO
View file

@ -1,14 +0,0 @@
Things to Fix in FAS2 before declaring it done:
* fasClient.py: Proper logging
Nice-to-have things:
* fas/group.py: Easy searching within groups (and sponsor/admin interface)
* fas/aliases.py: An easy interface to manage mail aliases
* setup.py:
- Fix installing in all scenarios: bdist_egg, install, and
install --install-data='/usr/share/fas'
- Install fas.cfg
- Install start-fas to the correct directory

66
fas/client/fas.conf
View file

@ -1,66 +0,0 @@
[global]
; url - Location to fas server
url = http://localhost:8088/accounts/
; temp - Location to generate files while user creation process is happening
temp = /var/db
; login - username to contact fas
login = admin
; password - password for login name
password = admin
; prefix - Install db files, etc, to a prefix (like a chroot for example)
prefix = /
[host]
; Group hierarchy is 1) groups, 2) restricted_groups 3) ssh_restricted_groups
; so if someone is in all 3, the client behaves the same as if they were just
; in 'groups'
; groups that should have a shell account on this system.
groups = sysadmin-main
; groups that should have a restricted account on this system.
; restricted accounts use the restricted_shell value in [users]
restricted_groups =
; ssh_restricted_groups: groups that should be restricted by ssh key. You will
; need to disable password based logins in order for this value to have any
; security meaning. Group types can be placed here as well, for example
; @hg,@git,@svn
ssh_restricted_groups =
; aliases_template: Gets prepended to the aliases file when it is generated by
; fasClient
aliases_template = /tmp/template.txt
[users]
; default shell given to people in [host] groups
shell = /bin/bash
; home - the location for fas user home dirs
home = /home/fedora
; home_backup_dir - Location home dirs should get moved to when a user is
; deleted this location should be tmpwatched
home_backup_dir = /tmp/fedora
; ssh_restricted_app - This is the path to the restricted shell script. It
; will not work automatically for most people though through alterations it
; is a powerfull way to restrict access to a machine. An alternative example
; could be given to people who should only have cvs access on the machine.
; setting this value to "/usr/bin/cvs server" would do this.
ssh_restricted_app = "/usr/bin/cvs server"
; restricted_shell - The shell given to users in the ssh_restricted_groups
restricted_shell = /sbin/nologin
; ssh_restricted_shell - The shell given to users in the ssh_restricted_groups
ssh_restricted_shell = /bin/bash
; ssh_key_options - Options to be appended to people ssh keys. Users in the
; ssh_restricted_groups will have the keys they uploaded altered when they are
; installed on this machine, appended with the options below.
ssh_key_options = no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty

577
fas/client/fasClient
View file

@ -1,577 +0,0 @@
#!/usr/bin/python
# -*- coding: utf-8 -*-
#
# Copyright © 2007-2008 Red Hat, Inc. All rights reserved.
#
# This copyrighted material is made available to anyone wishing to use, modify,
# copy, or redistribute it subject to the terms and conditions of the GNU
# General Public License v.2. This program is distributed in the hope that it
# will be useful, but WITHOUT ANY WARRANTY expressed or implied, including the
# implied warranties of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
# See the GNU General Public License for more details. You should have
# received a copy of the GNU General Public License along with this program;
# if not, write to the Free Software Foundation, Inc., 51 Franklin Street,
# Fifth Floor, Boston, MA 02110-1301, USA. Any Red Hat trademarks that are
# incorporated in the source code or documentation are not subject to the GNU
# General Public License and may only be used or replicated with the express
# permission of Red Hat, Inc.
#
# Red Hat Author(s): Mike McGrath <mmcgrath@redhat.com>
#
# TODO: put tmp files in a 700 tmp dir
import sys
import logging
import syslog
import os
import tempfile
import codecs
import datetime
import time
from urllib2 import URLError
from fedora.tg.client import BaseClient, AuthError, ServerError
from optparse import OptionParser
from shutil import move, rmtree, copytree
from rhpl.translate import _
import ConfigParser
parser = OptionParser()
parser.add_option('-i', '--install',
dest = 'install',
default = False,
action = 'store_true',
help = _('Download and sync most recent content'))
parser.add_option('-c', '--config',
dest = 'CONFIG_FILE',
default = '/etc/fas.conf',
metavar = 'CONFIG_FILE',
help = _('Specify config file (default "%default")'))
parser.add_option('--nogroup',
dest = 'no_group',
default = False,
action = 'store_true',
help = _('Do not sync group information'))
parser.add_option('--nopasswd',
dest = 'no_passwd',
default = False,
action = 'store_true',
help = _('Do not sync passwd information'))
parser.add_option('--noshadow',
dest = 'no_shadow',
default = False,
action = 'store_true',
help = _('Do not sync shadow information'))
parser.add_option('--nohome',
dest = 'no_home_dirs',
default = False,
action = 'store_true',
help = _('Do not create home dirs'))
parser.add_option('--nossh',
dest = 'no_ssh_keys',
default = False,
action = 'store_true',
help = _('Do not create ssh keys'))
parser.add_option('-s', '--server',
dest = 'FAS_URL',
default = None,
metavar = 'FAS_URL',
help = _('Specify URL of fas server.'))
parser.add_option('-p', '--prefix',
dest = 'prefix',
default = None,
metavar = 'prefix',
help = _('Specify install prefix. Useful for testing'))
parser.add_option('-e', '--enable',
dest = 'enable',
default = False,
action = 'store_true',
help = _('Enable FAS synced shell accounts'))
parser.add_option('-d', '--disable',
dest = 'disable',
default = False,
action = 'store_true',
help = _('Disable FAS synced shell accounts'))
parser.add_option('-a', '--aliases',
dest = 'aliases',
default = False,
action = 'store_true',
help = _('Sync mail aliases'))
(opts, args) = parser.parse_args()
log = logging.getLogger('fas')
try:
config = ConfigParser.ConfigParser()
if os.path.exists(opts.CONFIG_FILE):
config.read(opts.CONFIG_FILE)
elif os.path.exists('fas.conf'):
config.read('fas.conf')
print >> sys.stderr, "Could not open %s, defaulting to ./fas.conf" % opts.CONFIG_FILE
else:
print >> sys.stderr, "Could not open %s." % opts.CONFIG_FILE
sys.exit(5)
except ConfigParser.MissingSectionHeaderError, e:
print >> sys.stderr, "Config file does not have proper formatting - %s" % e
sys.exit(6)
FAS_URL = config.get('global', 'url').strip('"')
if opts.prefix:
prefix = opts.prefix
else:
prefix = config.get('global', 'prefix').strip('"')
def _chown(arg, dir_name, files):
os.chown(dir_name, arg[0], arg[1])
for file in files:
os.chown(os.path.join(dir_name, file), arg[0], arg[1])
class MakeShellAccounts(BaseClient):
temp = None
groups = None
people = None
memberships = None
emails = None
group_mapping = {}
valid_groups = {}
usernames = {}
def mk_tempdir(self):
self.temp = tempfile.mkdtemp('-tmp', 'fas-', os.path.join(prefix + config.get('global', 'temp').strip('"')))
def rm_tempdir(self):
rmtree(self.temp)
def valid_groups(self):
''' Create a dict of valid groups, including that of group_type '''
if not self.groups:
self.group_list()
valid_groups = {'groups':[], 'restricted_groups':[], 'ssh_restricted_groups': []}
for restriction in valid_groups:
for group in config.get('host', restriction).strip('"').split(','):
if group == '':
continue
if group == '@all':
for grp in self.groups:
if not grp['name'].startswith('cla'):
valid_groups[restriction].append(grp['name'])
elif group.startswith('@'):
for grp in self.groups:
if grp['group_type'] == group[1:]:
valid_groups[restriction].append(grp['name'])
else:
valid_groups[restriction].append(group)
self.valid_groups = valid_groups
def valid_group(self, name, restriction=None):
''' Determine if group is valid on the system '''
if restriction:
return name in self.valid_groups[restriction]
else:
for restrict_key in self.valid_groups:
if name in self.valid_groups[restrict_key]:
return True
return False
def valid_user(self, username):
''' Is the user valid on this system '''
if not self.valid_groups:
self.valid_groups()
if not self.group_mapping:
self.get_group_mapping()
try:
for restriction in self.valid_groups:
for group in self.valid_groups[restriction]:
if username in self.group_mapping[group]:
return True
except KeyError:
return False
return False
def ssh_key(self, person):
''' determine what ssh key a user should have '''
for group in self.valid_groups['groups']:
try:
if person['username'] in self.group_mapping[group]:
return person['ssh_key']
except KeyError:
print >> sys.stderr, '%s could not be found in fas but was in your config under "groups"!' % group
continue
for group in self.valid_groups['restricted_groups']:
try:
if person['username'] in self.group_mapping[group]:
return person['ssh_key']
except KeyError:
print >> sys.stderr, '%s could not be found in fas but was in your config under "restricted_groups"!' % group
continue
for group in self.valid_groups['ssh_restricted_groups']:
try:
if person['username'] in self.group_mapping[group]:
command = config.get('users', 'ssh_restricted_app').strip('"')
options = config.get('users', 'ssh_key_options').strip('"')
key = 'command="%s",%s %s' % (command, options, person['ssh_key'])
return key
except TypeError:
print >> sys.stderr, '%s could not be found in fas but was in your config under "ssh_restricted_groups"!' % group
continue
return 'INVALID\n'
def shell(self, username):
''' Determine what shell username should have '''
for group in self.valid_groups['groups']:
try:
if username in self.group_mapping[group]:
return config.get('users', 'shell').strip('"')
except KeyError:
print >> sys.stderr, '%s could not be found in fas but was in your config under "groups"!' % group
continue
for group in self.valid_groups['restricted_groups']:
try:
if username in self.group_mapping[group]:
return config.get('users', 'restricted_shell').strip('"')
except KeyError:
print >> sys.stderr, '%s could not be found in fas but was in your config under "restricted_groups"!' % group
continue
for group in self.valid_groups['ssh_restricted_groups']:
try:
if username in self.group_mapping[group]:
return config.get('users', 'ssh_restricted_shell').strip('"')
except KeyError:
print >> sys.stderr, '%s could not be found in fas but was in your config under "ssh_restricted_groups"!' % group
continue
print >> sys.stderr, 'Could not determine shell for %s. Defaulting to /sbin/nologin' % username
return '/sbin/nologin'
def install_aliases_txt(self):
move(self.temp + '/aliases', prefix + '/etc/aliases')
def passwd_text(self, people=None):
i = 0
passwd_file = codecs.open(self.temp + '/passwd.txt', mode='w', encoding='utf-8')
shadow_file = codecs.open(self.temp + '/shadow.txt', mode='w', encoding='utf-8')
os.chmod(self.temp + '/shadow.txt', 00400)
if not self.people:
self.people_list()
for person in self.people:
username = person['username']
if self.valid_user(username):
uid = person['id']
human_name = person['human_name']
password = person['password']
home_dir = "%s/%s" % (config.get('users', 'home').strip('"'), username)
shell = self.shell(username)
passwd_file.write("=%s %s:x:%i:%i:%s:%s:%s\n" % (uid, username, uid, uid, human_name, home_dir, shell))
passwd_file.write("0%i %s:x:%i:%i:%s:%s:%s\n" % (i, username, uid, uid, human_name, home_dir, shell))
passwd_file.write(".%s %s:x:%i:%i:%s:%s:%s\n" % (username, username, uid, uid, human_name, home_dir, shell))
shadow_file.write("=%i %s:%s:99999:0:99999:7:::\n" % (uid, username, password))
shadow_file.write("0%i %s:%s:99999:0:99999:7:::\n" % (i, username, password))
shadow_file.write(".%s %s:%s:99999:0:99999:7:::\n" % (username, username, password))
i = i + 1
passwd_file.close()
shadow_file.close()
def valid_user_group(self, person_id):
''' Determine if person is valid on this machine as defined in the
config file. I worry that this is going to be horribly inefficient
with large numbers of users and groups.'''
for member in self.memberships:
for group in self.memberships[member]:
if group['person_id'] == person_id:
return True
return False
def get_usernames(self):
usernames = {}
if not self.people:
self.people_list()
for person in self.people:
uid = person['id']
if self.valid_user_group(uid):
username = person['username']
usernames[uid] = username
self.usernames = usernames
def get_group_mapping(self):
if not self.usernames:
self.get_usernames()
for group in self.groups:
gid = group['id']
name = group['name']
try:
''' Shoot me now I know this isn't right '''
members = []
for member in self.memberships[name]:
members.append(self.usernames[member['person_id']])
memberships = ','.join(members)
self.group_mapping[name] = members
except KeyError:
''' No users exist in the group '''
pass
def groups_text(self, groups=None, people=None):
i = 0
file = open(self.temp + '/group.txt', 'w')
if not self.groups:
self.group_list()
if not self.people:
self.people_list()
if not self.usernames:
self.get_usernames()
if not self.group_mapping:
self.get_group_mapping()
''' First create all of our users/groups combo '''
for person in self.people:
uid = person['id']
try:
if self.valid_user(self.usernames[uid]):
username = person['username']
file.write("=%i %s:x:%i:\n" % (uid, username, uid))
file.write("0%i %s:x:%i:\n" % (i, username, uid))
file.write(".%s %s:x:%i:\n" % (username, username, uid))
i = i + 1
except KeyError:
continue
for group in self.groups:
gid = group['id']
name = group['name']
try:
''' Shoot me now I know this isn't right '''
members = []
for member in self.memberships[name]:
members.append(self.usernames[member['person_id']])
memberships = ','.join(members)
self.group_mapping[name] = members
except KeyError:
''' No users exist in the group '''
pass
file.write("=%i %s:x:%i:%s\n" % (gid, name, gid, memberships))
file.write("0%i %s:x:%i:%s\n" % (i, name, gid, memberships))
file.write(".%s %s:x:%i:%s\n" % (name, name, gid, memberships))
i = i + 1
file.close()
def group_list(self, search='*'):
params = {'search' : search}
request = self.send_request('group/list', auth=True, input=params)
self.groups = request['groups']
memberships = {}
for group in self.groups:
memberships[group['name']] = []
try:
for member in request['memberships'][u'%s' % group['id']]:
memberships[group['name']].append(member)
except KeyError:
pass
self.memberships = memberships
self.valid_groups()
return self.groups
def people_list(self, search='*'):
params = {'search' : search}
self.people = self.send_request('user/list', auth=True, input=params)['people']
def email_list(self, search='*'):
params = {'search' : search}
self.emails = self.send_request('user/email_list', auth=True, input=params)['emails']
return self.emails
def make_group_db(self):
self.groups_text()
os.system('makedb -o %s/group.db %s/group.txt' % (self.temp, self.temp))
def make_passwd_db(self):
self.passwd_text()
os.system('makedb -o %s/passwd.db %s/passwd.txt' % (self.temp, self.temp))
os.system('makedb -o %s/shadow.db %s/shadow.txt' % (self.temp, self.temp))
os.chmod(self.temp + '/shadow.db', 00400)
def install_passwd_db(self):
try:
move(self.temp + '/passwd.db', os.path.join(prefix + '/var/db/passwd.db'))
except IOError, e:
print "ERROR: Could not write passwd db - %s" % e
def install_shadow_db(self):
try:
move(self.temp + '/shadow.db', os.path.join(prefix + '/var/db/shadow.db'))
except IOError, e:
print "ERROR: Could not write shadow db - %s" % e
def install_group_db(self):
try:
move(self.temp + '/group.db', os.path.join(prefix + '/var/db/group.db'))
except IOError, e:
print "ERROR: Could not write group db - %s" % e
def create_homedirs(self):
''' Create homedirs and home base dir if they do not exist '''
home_base = os.path.join(prefix + config.get('users', 'home').strip('"'))
if not os.path.exists(home_base):
os.makedirs(home_base, mode=0755)
for person in self.people:
home_dir = os.path.join(home_base, person['username'])
if not os.path.exists(home_dir) and self.valid_user(person['username']):
syslog.syslog('Creating homedir for %s' % person['username'])
copytree('/etc/skel/', home_dir)
os.path.walk(home_dir, _chown, [person['id'], person['id']])
def remove_stale_homedirs(self):
''' Remove homedirs of users that no longer have access '''
home_base = os.path.join(prefix + config.get('users', 'home').strip('"'))
try:
home_backup_dir = config.get('users', 'home_backup_dir').strip('"')
except ConfigParser.NoOptionError:
home_backup_dir = '/var/tmp/'
users = os.listdir(home_base)
for user in users:
if not self.valid_user(user):
if not os.path.exists(home_backup_dir):
os.makedirs(home_backup_dir)
syslog.syslog('Backed up %s to %s' % (user, home_backup_dir))
target = '%s-%s' % (user, time.mktime(datetime.datetime.now().timetuple()))
move(os.path.join(home_base, user), os.path.join(prefix + home_backup_dir, target))
def create_ssh_keys(self):
''' Create ssh keys '''
home_base = prefix + config.get('users', 'home').strip('"')
for person in self.people:
username = person['username']
if self.valid_user(username):
ssh_dir = os.path.join(home_base, username, '.ssh')
if person['ssh_key']:
key = self.ssh_key(person)
if not os.path.exists(ssh_dir):
os.makedirs(ssh_dir, mode=0700)
f = codecs.open(os.path.join(ssh_dir, 'authorized_keys'), mode='w', encoding='utf-8')
f.write(key + '\n')
f.close()
os.chmod(os.path.join(ssh_dir, 'authorized_keys'), 0600)
os.path.walk(ssh_dir, _chown, [person['id'], person['id']])
def make_aliases_txt(self):
''' update your mail aliases file '''
if not self.groups:
groups = self.group_list()
if not self.usernames:
self.get_usernames()
self.emails = self.email_list()
email_file = codecs.open(self.temp + '/aliases', mode='w', encoding='utf-8')
email_template = codecs.open(config.get('host', 'aliases_template').strip('"'))
email_file.write("# Generated by fasClient\n")
for line in email_template.readlines():
email_file.write(line)
sorted = self.emails.keys()
sorted.sort()
for person in sorted:
email_file.write("%s: %s\n" % (person, self.emails[person]))
for group in self.groups:
name = group['name']
members = {}
members['member'] = []
for membership in self.memberships[name]:
role_type = membership['role_type']
person = self.usernames[membership['person_id']]
if role_type == 'user':
''' Legacy support '''
members['member'].append(person)
continue
members['member'].append(person)
try:
members[role_type].append(person)
except KeyError:
members[role_type] = [person]
for role in members:
email_file.write("%s-%ss: %s\n" % (name, role, ','.join(members[role])))
email_file.close()
def enable():
temp = tempfile.mkdtemp('-tmp', 'fas-', config.get('global', 'temp').strip('"'))
old = open('/etc/sysconfig/authconfig', 'r')
new = open(temp + '/authconfig', 'w')
for line in old:
if line.startswith("USEDB"):
new.write("USEDB=yes\n")
else:
new.write(line)
new.close()
old.close()
try:
move(temp + '/authconfig', '/etc/sysconfig/authconfig')
except IOError, e:
print "ERROR: Could not write /etc/sysconfig/authconfig - %s" % e
sys.exit(5)
os.system('/usr/sbin/authconfig --updateall')
rmtree(temp)
def disable():
temp = tempfile.mkdtemp('-tmp', 'fas-', config.get('global', 'temp').strip('"'))
old = open('/etc/sysconfig/authconfig', 'r')
new = open(temp + '/authconfig', 'w')
for line in old:
if line.startswith("USEDB"):
new.write("USEDB=no\n")
else:
new.write(line)
old.close()
new.close()
try:
move(temp + '/authconfig', '/etc/sysconfig/authconfig')
except IOError, e:
print "ERROR: Could not write /etc/sysconfig/authconfig - %s" % e
sys.exit(5)
os.system('/usr/sbin/authconfig --updateall')
rmtree(temp)
if __name__ == '__main__':
if opts.enable:
enable()
if opts.disable:
disable()
if opts.install:
try:
fas = MakeShellAccounts(FAS_URL, config.get('global', 'login').strip('"'), config.get('global', 'password').strip('"'), False)
except AuthError, e:
print >> sys.stderr, e
sys.exit(1)
except URLError, e:
print >> sys.stderr, 'Could not connect to %s - %s' % (FAS_URL, e.reason[1])
sys.exit(9)
fas.mk_tempdir()
fas.make_group_db()
fas.make_passwd_db()
if not opts.no_group:
fas.install_group_db()
if not opts.no_passwd:
fas.install_passwd_db()
if not opts.no_shadow:
fas.install_shadow_db()
if not opts.no_home_dirs:
fas.create_homedirs()
fas.remove_stale_homedirs()
if not opts.no_ssh_keys:
fas.create_ssh_keys()
fas.rm_tempdir()
if opts.aliases:
try:
fas = MakeShellAccounts(FAS_URL, config.get('global', 'login').strip('"'), config.get('global', 'password').strip('"'), False)
except AuthError, e:
print >> sys.stderr, e
sys.exit(1)
fas.mk_tempdir()
fas.make_aliases_txt()
fas.install_aliases_txt()
if not (opts.install or opts.enable or opts.disable or opts.aliases):
parser.print_help()

67
fas/client/restricted-shell
View file

@ -1,67 +0,0 @@
#!/usr/bin/python -tt
# This script allows people to run the commands listed in 'commands' and
# 'commands' only. Be careful though, by adding /bin/bash you've effectively
# disabled this script. Also, via some voodoo you can restrict what flags
# get passed or even completely alter what would normally happen if a command
# were envoked (see scp section below)
# TODO: better documentation needed for how this file works
import sys, os
commands = {
"git-receive-pack": "/usr/bin/git-receive-pack",
"git-upload-pack": "/usr/bin/git-upload-pack",
"bzr": "/usr/bin/run-bzr",
"hg": "/usr/bin/run-hg",
"mtn": "/usr/bin/run-mtn",
"svnserve": "/usr/bin/run-svnserve",
"scp": "/usr/bin/scp",
}
if __name__ == '__main__':
orig_cmd = os.environ.get('SSH_ORIGINAL_COMMAND')
if not orig_cmd:
print "Need a command"
sys.exit(1)
allargs = orig_cmd.split()
try:
basecmd = os.path.basename(allargs[0])
cmd = commands[basecmd]
except:
sys.stderr.write("Invalid command %s\n" % orig_cmd)
sys.exit(2)
if basecmd in ('git-receive-pack', 'git-upload-pack'):
# git repositories need to be parsed specially
thearg = ' '.join(allargs[1:])
if thearg[0] == "'" and thearg[-1] == "'":
thearg = thearg.replace("'","")
thearg = thearg.replace("\\'", "")
if thearg[:len('/git/')] != '/git/' or not os.path.isdir(thearg):
print "Invalid repository %s" % thearg
sys.exit(3)
allargs = [thearg]
elif basecmd in ('scp'):
thearg = ' '.join(allargs[1:])
firstLetter = allargs[2][0]
secondLetter = allargs[2][1]
uploadTarget = "/srv/web/releases/%s/%s/%s/" % (firstLetter, secondLetter, allargs[2])
if thearg.find('/') != -1:
print "scp yourfile-1.2.tar.gz scm.fedorahosted.org:$YOURPROJECT # No trailing /"
sys.exit(4)
elif not os.path.isdir(uploadTarget):
print "http://fedorahosted.org/releases/%s/%s/%s does not exist!" % (firstLetter, secondLetter, allargs[2])
sys.exit(5)
else:
newargs = []
newargs.append(allargs[0])
newargs.append(allargs[1])
newargs.append(uploadTarget)
os.execv(cmd, [cmd] + newargs[1:])
sys.exit(1)
else:
allargs = allargs[1:]
os.execv(cmd, [cmd] + allargs)
sys.exit(1)

134
fas/convert.py
View file

@ -1,134 +0,0 @@
#!/usr/bin/python
import pgdb
from turbogears.view import engines
import turbogears.view
import turbogears.util as tg_util
from turbogears import view, database, errorhandling, config
from itertools import izip
from inspect import isclass
from turbogears import update_config, start_server
import cherrypy
cherrypy.lowercase_api = True
from os.path import *
import sys
import time
import crypt
import random
if len(sys.argv) > 1:
update_config(configfile=sys.argv[1],
modulename="fas.config")
elif exists(join(dirname(__file__), "setup.py")):
update_config(configfile="dev.cfg",modulename="fas.config")
else:
update_config(configfile="prod.cfg",modulename="fas.config")
from sqlalchemy import *
from sqlalchemy.exceptions import *
from fas.model import *
def generate_salt(length=8):
chars = './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'
salt = ''
for i in xrange(length):
salt += random.choice(chars)
return salt
db = pgdb.connect(dsn='localhost', user='fedora', password='test', database='fedorausers')
c = db.cursor()
c.execute('select id, username, email, human_name, gpg_keyid, ssh_key, password, comments, postal_address, telephone, affiliation, creation, approval_status, internal_comments, ircnick from person order by id;')
print "Converting People Table"
for person in c.fetchall():
(id, username, email, human_name, gpg_keyid, ssh_key, password, comments, postal_address, telephone, affiliation, creation, approval_status, internal_comments, ircnick) = person
print "\t%i - %s" % (id, username)
p = People()
p.id = id
p.username = username
p.human_name = human_name
p.gpg_keyid = gpg_keyid
p.ssh_key = ssh_key
p.password = crypt.crypt(password, "$1$%s" % generate_salt(8))
p.comments = comments
p.postal_address = postal_address
p.telephone = telephone
p.creation = creation
p.internal_comments = internal_comments
p.ircnick = ircnick
p.status = 'active'
p.email = email
try:
session.flush()
except IntegrityError, e:
print "\tERROR - Could not create %s - %s" % (username, e)
session.close()
continue
c.execute('select id, name, owner_id, group_type, needs_sponsor, user_can_remove, prerequisite_id, joinmsg from project_group;')
bool_dict = {0 : False, 1 : True}
print "Creating Groups..."
admin = People.by_username('admin')
admin_id = admin.id
for group in c.fetchall():
(id, name, owner_id, group_type, needs_sponsor, user_can_remove, prerequisite_id, joinmsg) = group
print "%i - %s" % (id, name)
try:
group = Groups()
group.id = id
group.name = name
group.display_name = name
if owner_id == 100001:
''' Update to new admin id '''
owner_id = admin_id
group.owner_id = owner_id
group.group_type = group_type
group.needs_sponsor = bool(bool_dict[needs_sponsor])
group.user_can_remove = bool(bool_dict[user_can_remove])
# if prerequisite_id:
# prerequisite = Groups.by_id(prerequisite_id)
# group.prerequisite = prerequisite
group.joinmsg = joinmsg
# Log here
session.flush()
except IntegrityError, e:
print "\tERROR - The group: '%s' (%i) could not be created - %s" % (name, id, e)
except FlushError, e:
print "\tERROR - The group: '%s' (%i) could not be created - %s" % (name, id, e)
except InvalidRequestError, e:
print "\tERROR - The group: '%s' (%i) could not be created - %s" % (name, id, e)
session.close()
c.execute('select person_id, project_group_id, role_type, role_domain, role_status, internal_comments, sponsor_id, creation, approval from role order by person_id;')
print "Creating Role Maps..."
for role in c.fetchall():
(person_id, project_group_id, role_type, role_domain, role_status, internal_comments, sponsor_id, creation, approval) = role
print "%s - %s" % (person_id, project_group_id)
try:
role = PersonRoles()
if len(role_status) > 10:
role_status = 'approved'
if role_status == 'declined':
''' No longer exists '''
continue
role.role_status = role_status
role.role_type = role_type
role.member = People.by_id(person_id)
role.group = Groups.by_id(project_group_id)
session.flush()
except ProgrammingError, e:
print "\tERROR - The role %s -> %s could not be created - %s" % (person_id, project_group_id, e)
session.close()
except IntegrityError, e:
if e.message.find('dupilcate key'):
print "\tERROR - The role %s -> %s already exists! Skipping" % (person_id, project_group_id)
session.close()
continue
print "\tERROR - The role %s -> %s could not be created - %s" % (person_id, project_group_id, e)
session.close()

131
fas/fas.cfg
View file

@ -1,131 +0,0 @@
[global]
theme = 'fas'
# TODO: better namespacing (maybe a [fas] section)
admingroup = 'accounts'
accounts_email = "nobody@fedoraproject.org"
#accounts_email = "accounts@fedoraproject.org"
legal_cla_email = "nobody@fedoraproject.org"
#legal_cla_email = "legal-cla-archive@fedoraproject.org"
email_host = "fedoraproject.org" # as in, web-members@email_host
gpgexec = "/usr/bin/gpg"
gpghome = "/home/ricky/work/fedora/fedora-infrastructure/fas/gnupg"
gpg_fingerprint = "C199 1E25 D00A D200 2D2E 54D1 BF7F 1647 C54E 8410"
gpg_passphrase = "m00!s@ysth3c0w"
gpg_keyserver = "hkp://subkeys.pgp.net"
cla_done_group = "cla_done"
cla_fedora_group = "cla_fedora"
privileged_view_groups = "(^fas-.*)"
username_blacklist = "(.*-members)|(.*-sponsors)|(.*-administrators)|(root)|(webmaster)"
openidstore = "/var/tmp/fas/openid"
openssl_digest = "md5"
openssl_expire = 31536000 # 60*60*24*365 = 1 year
openssl_ca_file = "/srv/fedora-infrastructure/fas/ssl/ca-Upload"
openssl_c = "US"
openssl_st = "North Carolina"
openssl_l = "Raleigh"
openssl_o = "Fedora Project"
openssl_ou = "Upload Files"
# Groups that automatically grant membership to other groups
# Format: 'group1:a,b,c|group2:d,e,f'
auto_approve_groups = 'cvsextras:fedorabugs|cla_fedora:cla_done|cla_redhat:cla_done|cla_dell:cla_done|cla_ibm:cla_done'
# This is where all of your settings go for your development environment # Settings that are the same for both development and production
# (such as template engine, encodings, etc.) all go in
# fas/config/app.cfg
mail.on = True
mail.server = 'localhost'
#mail.testmode = True
mail.debug = False
mail.encoding = 'utf-8'
# DATABASE
# pick the form for your database
# sqlobject.dburi="postgres://username@hostname/databasename"
# sqlobject.dburi="mysql://username:password@hostname:port/databasename"
# sqlobject.dburi="sqlite:///file_name_and_path"
# If you have sqlite, here's a simple default to get you started
# in development
sqlalchemy.dburi="postgres://fedora:test@localhost/fas2"
#sqlalchemy.echo=True
# if you are using a database or table type without transactions
# (MySQL default, for example), you should turn off transactions
# by prepending notrans_ on the uri
# sqlobject.dburi="notrans_mysql://username:password@hostname:port/databasename"
# for Windows users, sqlite URIs look like:
# sqlobject.dburi="sqlite:///drive_letter:/path/to/file"
# SERVER
# Some server parameters that you may want to tweak
server.socket_port=8088
# Enable the debug output at the end on pages.
# log_debug_info_filter.on = False
server.environment="development"
autoreload.package="fas"
# session_filter.on = True
# Set to True if you'd like to abort execution if a controller gets an
# unexpected parameter. False by default
tg.strict_parameters = True
server.webpath='/accounts'
base_url_filter.on = True
base_url_filter.use_x_forwarded_host = True
base_url_filter.base_url = "http://localhost:8088/accounts"
# Make the session cookie only return to the host over an SSL link
# Disabled for testing.
#visit.cookie.secure = True
# LOGGING
# Logging configuration generally follows the style of the standard
# Python logging module configuration. Note that when specifying
# log format messages, you need to use *() for formatting variables.
# Deployment independent log configuration is in fas/config/log.cfg
[logging]
[[loggers]]
[[[fas]]]
level='DEBUG'
qualname='fas'
handlers=['debug_out']
[[[allinfo]]]
level='INFO'
handlers=['debug_out']
[[[access]]]
level='INFO'
qualname='turbogears.access'
handlers=['access_out']
propagate=0
[[[identity]]]
level='INFO'
qualname='turbogears.identity'
handlers=['access_out']
propagate=0
[[[database]]]
# Set to INFO to make SQLAlchemy display SQL commands
level='ERROR'
qualname='sqlalchemy.engine'
handlers=['debug_out']
propagate=0

115
fas/fas.spec
View file

@ -1,115 +0,0 @@
%{!?python_sitelib: %define python_sitelib %(%{__python} -c "from distutils.sysconfig import get_python_lib; print get_python_lib()")}
Name: fas
Version: 0.8.1
Release: 1%{?dist}
Summary: Fedora Account System
Group: Development/Languages
License: GPLv2
URL: https://fedorahosted.org/fas2/
Source0: https://fedorahosted.org/releases/f/e/fedora-infrastructure/%{name}-%{version}.tar.gz
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
BuildArch: noarch
BuildRequires: python-devel
BuildRequires: python-setuptools-devel
BuildRequires: TurboGears
BuildRequires: gettext
Requires: TurboGears >= 1.0.4
Requires: python-sqlalchemy >= 0.4
Requires: python-TurboMail
Requires: python-fedora-infrastructure >= 0.2.99.2
Requires: babel
Requires: pygpgme
Requires: python-babel
Requires: python-genshi
Requires: pytz
%description
The Fedora Account System is a web application that manages the accounts of
Fedora Project Contributors. It's built in TurboGears and comes with a json
API for querying against remotely.
The python-fedora-infrastructure package has a TurboGears identity provider
that works with the Account System.
%package clients
Summary: Clients for the Fedora Account System
Group: Applications/System
Requires: python-fedora
Requires: rhpl
%description clients
Additional scripts that work as clients to the accounts system.
%prep
%setup -q
%build
%{__python} setup.py build --install-data='%{_datadir}'
%install
%{__rm} -rf %{buildroot}
%{__python} setup.py install -O1 --skip-build --install-data='%{_datadir}' --root %{buildroot}
%{__mkdir_p} %{buildroot}%{_sbindir}
%{__mkdir_p} %{buildroot}%{_sysconfdir}
%{__mv} %{buildroot}%{_bindir}/start-fas %{buildroot}%{_sbindir}
# Unreadable by others because it's going to contain a database password.
%{__install} -m 640 fas.cfg %{buildroot}%{_sysconfdir}
%{__install} -m 600 client/fas.conf %{buildroot}%{_sysconfdir}
%find_lang %{name}
%clean
%{__rm} -rf %{buildroot}
%pre
/usr/sbin/useradd -c 'Fedora Acocunt System user' -s /sbin/nologin \
-r -M -d %{_datadir}fas fas &> /dev/null || :
%files -f %{name}.lang
%defattr(-,root,root,-)
%doc README TODO COPYING fas2.sql
%{python_sitelib}/*
%{_datadir}/fas/
%{_sbindir}/start-fas
%attr(-,root,fas) %config(noreplace) %{_sysconfdir}/fas.cfg
%files clients
%{_bindir}/*
%config(noreplace) %{_sysconfdir}/fas.conf
%changelog
* Tue Mar 14 2008 Mike McGrath <mmcgrath@redhat.com> - 0.8.1-1
- Upstream released a new version
* Tue Mar 14 2008 Mike McGrath <mmcgrath@redhat.com> - 0.8-1
- Upstream released a new version
* Tue Mar 13 2008 Mike McGrath <mmcgrath@redhat.com> - 0.7.1-1
- Upstream released new version
* Tue Mar 13 2008 Mike McGrath <mmcgrath@redhat.com> - 0.7-1
- Upstream released new version
* Tue Mar 13 2008 Mike McGrath <mmcgrath@redhat.com> - 0.6-1
- Upstream released a new version
* Tue Mar 11 2008 Mike McGrath <mmcgrath@redhat.com> - 0.5-1
- Upstream released a new version
* Tue Mar 11 2008 Mike McGrath <mmcgrath@redhat.com> - 0.4-1
- added fas.conf will fix later.
* Mon Mar 10 2008 Mike McGrath <mmcgrath@redhat.com> - 0.3-1
- Upstream released a new version.
* Mon Mar 10 2008 Mike McGrath <mmcgrath@redhat.com> - 0.2-1
- Added fas user/group
* Mon Mar 10 2008 Toshio Kuratomi <tkuratom@redhat.com> - 0.1-1
- Initial Build.

30
fas/fas/__init__.py
View file

@ -1,30 +0,0 @@
from fas import release
__version__ = release.VERSION
class FASError(Exception):
'''FAS Error'''
pass
class ApplyError(FASError):
'''Raised when a user could not apply to a group'''
pass
class ApproveError(FASError):
'''Raised when a user could not be approved in a group'''
pass
class SponsorError(FASError):
'''Raised when a user could not be sponsored in a group'''
pass
class UpgradeError(FASError):
'''Raised when a user could not be upgraded in a group'''
pass
class DowngradeError(FASError):
'''Raised when a user could not be downgraded in a group'''
pass
class RemoveError(FASError):
'''Raised when a user could not be removed from a group'''
pass

192
fas/fas/auth.py
View file

@ -1,192 +0,0 @@
from turbogears import config
from fas.model import Groups
from fas.model import PersonRoles
from fas.model import People
from sqlalchemy.exceptions import *
import turbogears
import re
def isAdmin(person):
'''
Returns True if the user is a FAS admin (a member of the admingroup)
'''
admingroup = config.get('admingroup')
try:
if person.group_roles[admingroup].role_status == 'approved':
return True
except KeyError:
return False
return False
def canAdminGroup(person, group, role=None):
'''
Returns True if the user is allowed to act as an admin for a group
'''
if isAdmin(person) or (group.owner == person):
return True
if not role:
try:
role = PersonRoles.query.filter_by(group=group, member=person).one()
except InvalidRequestError:
''' Not in the group '''
return False
if role.role_status == 'approved' and role.role_type == 'administrator':
return True
return False
def canSponsorGroup(person, group):
'''
Returns True if the user is allowed to act as a sponsor for a group
'''
if isAdmin(person) or \
group.owner == person:
return True
try:
role = PersonRoles.query.filter_by(group=group, member=person).one()
except InvalidRequestError:
''' Not in the group '''
return False
if (role.role_status == 'approved' and role.role_type == 'sponsor') \
or canAdminGroup(person, group, role):
return True
return False
def isApproved(person, group):
'''
Returns True if the user is an approved member of a group
'''
try:
if person.group_roles[group.name].role_status == 'approved':
return True
except KeyError:
return False
return False
def CLADone(person):
'''
Returns True if the user has completed the CLA
'''
cla_done_group =config.get('cla_done_group')
try:
if person.group_roles[cla_done_group].role_status == 'approved':
return True
except KeyError:
return False
return False
def canEditUser(person, target):
'''
Returns True if the user has privileges to edit the target user
'''
if person == target:
return True
elif isAdmin(person):
return True
return False
def canCreateGroup(person, group):
'''
Returns True if the user can create groups
'''
# Should groupname restrictions go here?
if isAdmin(person):
return True
return False
def canEditGroup(person, group):
'''
Returns True if the user can edit the group
'''
if canAdminGroup(person, group):
return True
return False
def canViewGroup(person, group):
'''
Returns True if the user can view the group
'''
# If the group matched by privileged_view_groups, then
# only people that can admin the group can view it
privilegedViewGroups = config.get('privileged_view_groups')
if re.compile(privilegedViewGroups).match(group.name):
if not canAdminGroup(person, group):
return False
return True
def canApplyGroup(person, group, applicant):
'''
Returns True if the user can apply applicant to the group
'''
# User must satisfy all dependencies to join.
# This is bypassed for people already in the group and for the
# owner of the group (when they initially make it).
prerequisite = group.prerequisite
# TODO: Make this raise more useful info.
if prerequisite:
if prerequisite not in applicant.approved_memberships:
turbogears.flash(_('%s membership required before application to this group is allowed') % prerequisite.name)
return False
# A user can apply themselves, and group sponsors can apply other people.
if (person == applicant) or \
canSponsorGroup(person, group):
return True
return False
def canSponsorUser(person, group, target):
'''
Returns True if the user can sponsor target in the group
'''
# This is just here in case we want to add more complex checks in the future
if canSponsorGroup(person, group):
return True
return False
def canRemoveUser(person, group, target):
'''
Returns True if the user can remove target from the group
'''
# Only administrators can remove administrators.
if canAdminGroup(target, group) and \
not canAdminGroup(person, group):
return False
# A user can remove themself from a group if user_can_remove is 1
# Otherwise, a sponsor can remove sponsors/users.
elif ((person == target) and (group.user_can_remove == True)) or \
canSponsorGroup(person, group):
return True
return False
def canUpgradeUser(person, group, target):
'''
Returns True if the user can upgrade target in the group
'''
# Group admins can upgrade anybody.
# The controller should handle the case where the target
# is already a group admin.
if canAdminGroup(person, group):
return True
# Sponsors can only upgrade non-sponsors (i.e. normal users)
# TODO: Don't assume that canSponsorGroup means that the user is a sponsor
elif canSponsorGroup(person, group) and \
not canSponsorGroup(target, group):
return True
return False
def canDowngradeUser(person, group, target):
'''
Returns True if the user can downgrade target in the group
'''
# Group admins can downgrade anybody.
if canAdminGroup(person, group):
return True
# Sponsors can only downgrade sponsors.
# The controller should handle the case where the target
# is already a normal user.
elif canSponsorGroup(person, group) and \
not canAdminGroup(person, group):
return True
return False

120
fas/fas/cla.py
View file

@ -1,120 +0,0 @@
import turbogears
from turbogears import controllers, expose, paginate, identity, redirect, widgets, validate, validators, error_handler
from turbogears.database import session
import cherrypy
from datetime import datetime
import re
import turbomail
from genshi.template.plugin import TextTemplateEnginePlugin
from fas.model import People
from fas.model import Log
from fas.auth import *
class CLA(controllers.Controller):
def __init__(self):
'''Create a CLA Controller.'''
@identity.require(turbogears.identity.not_anonymous())
@expose(template="fas.templates.cla.index")
def index(self):
'''Display the CLAs (and accept/do not accept buttons)'''
username = turbogears.identity.current.user_name
person = People.by_username(username)
if not person.telephone or not person.postal_address:
turbogears.flash('Postal Address and telephone number are required to complete the cla, please fill them out')
turbogears.redirect('/user/edit/%s' % username)
cla = CLADone(person)
return dict(cla=cla, person=person, date=datetime.utcnow().ctime())
def jsonRequest(self):
return 'tg_format' in cherrypy.request.params and \
cherrypy.request.params['tg_format'] == 'json'
@expose(template="fas.templates.error")
def error(self, tg_errors=None):
'''Show a friendly error message'''
if not tg_errors:
turbogears.redirect('/')
return dict(tg_errors=tg_errors)
@identity.require(turbogears.identity.not_anonymous())
@error_handler(error)
@expose(template="genshi-text:fas.templates.cla.cla", format="text", content_type='text/plain; charset=utf-8')
def text(self, type=None):
'''View CLA as text'''
username = turbogears.identity.current.user_name
person = People.by_username(username)
return dict(person=person, date=datetime.utcnow().ctime())
@identity.require(turbogears.identity.not_anonymous())
@error_handler(error)
@expose(template="genshi-text:fas.templates.cla.cla", format="text", content_type='text/plain; charset=utf-8')
def download(self, type=None):
'''Download CLA'''
username = turbogears.identity.current.user_name
person = People.by_username(username)
return dict(person=person, date=datetime.utcnow().ctime())
@identity.require(turbogears.identity.not_anonymous())
@error_handler(error)
@expose(template="fas.templates.cla.index")
def send(self, agree=False):
'''Send CLA'''
username = turbogears.identity.current.user_name
person = People.by_username(username)
if CLADone(person):
turbogears.flash(_('You have already completed the CLA.'))
turbogears.redirect('/cla/')
return dict()
if not agree:
turbogears.flash(_("You have not completed the CLA."))
turbogears.redirect('/user/view/%s' % person.username)
if not person.telephone or \
not person.postal_address:
turbogears.flash(_('To complete the CLA, we must have your telephone number and postal address. Please ensure they have been filled out.'))
turbogears.redirect('/user/edit/%s' % username)
groupname = config.get('cla_fedora_group')
group = Groups.by_name(groupname)
try:
# Everything is correct.
person.apply(group, person) # Apply...
session.flush()
person.sponsor(group, person) # Sponsor!
except:
# TODO: If apply succeeds and sponsor fails, the user has
# to remove themselves from the CLA group before they can
# complete the CLA and go through the above try block again.
turbogears.flash(_("You could not be added to the '%s' group.") % group.name)
turbogears.redirect('/cla/')
return dict()
else:
dt = datetime.utcnow()
Log(author_id=person.id, description='Completed CLA', changetime=dt)
message = turbomail.Message(config.get('accounts_email'), config.get('legal_cla_email'), 'Fedora ICLA completed')
message.plain = '''
Fedora user %(username)s has completed an ICLA (below).
Username: %(username)s
Email: %(email)s
Date: %(date)s
=== CLA ===
''' % {'username': person.username,
'human_name': person.human_name,
'email': person.email,
'postal_address': person.postal_address,
'telephone': person.telephone,
'facsimile': person.facsimile,
'date': dt.ctime(),}
# Sigh.. if only there were a nicer way.
plugin = TextTemplateEnginePlugin()
message.plain += plugin.render(template='fas.templates.cla.cla', info=dict(person=person), format='text')
turbomail.enqueue(message)
turbogears.flash(_("You have successfully completed the CLA. You are now in the '%s' group.") % group.name)
turbogears.redirect('/user/view/%s' % person.username)
return dict()

51
fas/fas/commands.py
View file

@ -1,51 +0,0 @@
# -*- coding: utf-8 -*-
"""This module contains functions called from console script entry points."""
import os
import sys
import pkg_resources
pkg_resources.require("TurboGears")
import turbogears
import cherrypy
cherrypy.lowercase_api = True
class ConfigurationError(Exception):
pass
def start():
'''Start the CherryPy application server.'''
setupdir = os.path.dirname(os.path.dirname(__file__))
curdir = os.getcwd()
# First look on the command line for a desired config file,
# if it's not on the command line, then look for 'setup.py'
# in the current directory. If there, load configuration
# from a file called 'dev.cfg'. If it's not there, the project
# is probably installed and we'll look first for a file called
# 'prod.cfg' in the current directory and then for a default
# config file called 'default.cfg' packaged in the egg.
if len(sys.argv) > 1:
configfile = sys.argv[1]
elif os.path.exists(os.path.join(setupdir, 'setup.py')) \
and os.path.exists(os.path.join(setupdir, 'dev.cfg')):
configfile = os.path.join(setupdir, 'dev.cfg')
elif os.path.exists(os.path.join(curdir, 'fas.cfg')):
configfile = os.path.join(curdir, 'fas.cfg')
elif os.path.exists(os.path.join('/etc/fas.cfg')):
configfile = os.path.join('/etc/fas.cfg')
else:
try:
configfile = pkg_resources.resource_filename(
pkg_resources.Requirement.parse("fas"),
"config/default.cfg")
except pkg_resources.DistributionNotFound:
raise ConfigurationError("Could not find default configuration.")
turbogears.update_config(configfile=configfile,
modulename="fas.config")
from fas.controllers import Root
turbogears.start_server(Root())

1
fas/fas/config/.gitignore vendored
View file

@ -1 +0,0 @@
app.cfg

0
fas/fas/config/__init__.py
View file

169
fas/fas/config/app.cfg.in
View file

@ -1,169 +0,0 @@
[global]
# The settings in this file should not vary depending on the deployment
# environment. dev.cfg and prod.cfg are the locations for
# the different deployment settings. Settings in this file will
# be overridden by settings in those other files.
# The commented out values below are the defaults
# Database values
sqlalchemy.convert_unicode=True
# VIEW
# which view (template engine) to use if one is not specified in the
# template name
# tg.defaultview = "kid"
tg.defaultview = "genshi"
# The following kid settings determine the settings used by the kid serializer.
# One of (html|html-strict|xhtml|xhtml-strict|xml|json)
# kid.outputformat="html"
genshi.outputformat = "xhtml"
# When @#%*( TG supports this....
#genshi.outputformat = "html"
#genshi.default_doctype = "html-strict"
# kid.encoding="utf-8"
genshi.encoding="utf-8"
# The sitetemplate is used for overall styling of a site that
# includes multiple TurboGears applications
# tg.sitetemplate="<packagename.templates.templatename>"
# Allow every exposed function to be called as json,
# tg.allow_json = False
# Suppress the inclusion of the shipped MochiKit version, which is rather outdated.
# Attention: setting this to True and listing 'turbogears.mochikit' in 'tg.include_widgets'
# is a contradiction. This option will overrule the default-inclusion to prevent version
# mismatch bugs.
# tg.mochikit_suppress = True
# List of Widgets to include on every page.
# for example ['turbogears.mochikit']
# tg.include_widgets = []
# Set to True if the scheduler should be started
# tg.scheduler = False
# Set to True to allow paginate decorator redirects when page number gets
# out of bound. Useful for getting the real page id in the url
# paginate.redirect_on_out_of_range = True
# Set to True to allow paginate decorator redirects when last page is requested.
# This is useful for getting the real last page id in the url
# paginate.redirect_on_last_page = True
# i18n
session_filter.on = True
i18n.run_template_filter = True
i18n.domain = 'fas'
i18n.locale_dir = '@LOCALEDIR@'
# VISIT TRACKING
# Each visit to your application will be assigned a unique visit ID tracked via
# a cookie sent to the visitor's browser.
# --------------
# Enable Visit tracking
visit.on=True
# Number of minutes a visit may be idle before it expires.
visit.timeout=20
# The name of the cookie to transmit to the visitor's browser.
# visit.cookie.name="tg-visit"
# Domain name to specify when setting the cookie (must begin with . according to
# RFC 2109). The default (None) should work for most cases and will default to
# the machine to which the request was made. NOTE: localhost is NEVER a valid
# value and will NOT WORK.
# visit.cookie.domain=None
# Specific path for the cookie
# visit.cookie.path="/"
# The name of the VisitManager plugin to use for visitor tracking.
visit.manager="sqlalchemy"
#visit.manager="sqlobject"
# Database class to use for visit tracking
visit.saprovider.model = "fas.model.Visit"
identity.saprovider.model.visit = "fas.model.VisitIdentity"
#visit.saprovider.model = "fedora.accounts.tgfas.visit_identity_table"
#visit.soprovider.model = "fas.model.Visit"
#identity.saprovider.model.visit="fedora.accounts.tgfas.VisitIdentity"
#identity.saprovider.model=
#sqlalchemy.dburi='sqlite://'
# IDENTITY
# General configuration of the TurboGears Identity management module
# --------
# Switch to turn on or off the Identity management module
identity.on=True
# [REQUIRED] URL to which CherryPy will internally redirect when an access
# control check fails. If Identity management is turned on, a value for this
# option must be specified.
identity.failure_url="/login"
identity.provider='safas3'
# identity.provider='sqlobject'
# The names of the fields on the login form containing the visitor's user ID
# and password. In addition, the submit button is specified simply so its
# existence may be stripped out prior to passing the form data to the target
# controller.
# identity.form.user_name="user_name"
# identity.form.password="password"
# identity.form.submit="login"
# What sources should the identity provider consider when determining the
# identity associated with a request? Comma separated list of identity sources.
# Valid sources: form, visit, http_auth
# identity.source="form,http_auth,visit"
# SqlAlchemyIdentityProvider
# Configuration options for the default IdentityProvider
# -------------------------
# The classes you wish to use for your Identity model. Remember to not use reserved
# SQL keywords for class names (at least unless you specify a different table
# name using sqlmeta).
identity.saprovider.model.user="fas.model.People"
identity.saprovider.model.group="fas.model.Groups"
#identity.saprovider.model.permission="fas.model.Visit"
# The password encryption algorithm used when comparing passwords against what's
# stored in the database. Valid values are 'md5' or 'sha1'. If you do not
# specify an encryption algorithm, passwords are expected to be clear text.
# The SqlAlchemyProvider *will* encrypt passwords supplied as part of your login
# form. If you set the password through the password property, like:
# my_user.password = 'secret'
# the password will be encrypted in the database, provided identity is up and
# running, or you have loaded the configuration specifying what encryption to
# use (in situations where identity may not yet be running, like tests).
# identity.saprovider.encryption_algorithm=None
# compress the data sends to the web browser
# [/]
# gzip_filter.on = TrueNote: in the SVG XML, change the 'interviewee-name' text to be the name of whichever in
# gzip_filter.mime_types = ["application/x-javascript", "text/javascript", "text/html", "text/css", "text/plain"]
[/robots.txt]
static_filter.on = True
static_filter.dir = "@DATADIR@/static/robots.txt"
[/static]
static_filter.on = True
static_filter.dir = "@DATADIR@/static"
[/favicon.ico]
static_filter.on = True
static_filter.file = "@DATADIR@/static/images/favicon.ico"

29
fas/fas/config/log.cfg
View file

@ -1,29 +0,0 @@
# LOGGING
# Logging is often deployment specific, but some handlers and
# formatters can be defined here.
[logging]
[[formatters]]
[[[message_only]]]
format='*(message)s'
[[[full_content]]]
format='*(asctime)s *(name)s *(levelname)s *(message)s'
[[handlers]]
[[[debug_out]]]
class='StreamHandler'
level='DEBUG'
args='(sys.stdout,)'
formatter='full_content'
[[[access_out]]]
class='StreamHandler'
level='INFO'
args='(sys.stdout,)'
formatter='message_only'
[[[error_out]]]
class='StreamHandler'
level='ERROR'
args='(sys.stdout,)'

150
fas/fas/controllers.py
View file

@ -1,150 +0,0 @@
from turbogears import controllers, expose, config
from model import *
from turbogears import identity, redirect, widgets, validate, validators, error_handler
from cherrypy import request, response
from turbogears import exception_handler
import turbogears
import cherrypy
import time
from fas.user import User
from fas.group import Group
from fas.cla import CLA
from fas.json_request import JsonRequest
from fas.help import Help
from fas.auth import *
from fas.util import available_languages
#from fas.openid_fas import OpenID
import os
import sys
reload(sys)
sys.setdefaultencoding('utf-8')
def get_locale(locale=None):
if locale:
return locale
try:
return turbogears.identity.current.user.locale
except AttributeError:
return turbogears.i18n.utils._get_locale()
config.update({'i18n.get_locale': get_locale})
def add_custom_stdvars(vars):
return vars.update({'gettext': _, "lang": get_locale(), 'available_languages': available_languages()})
turbogears.view.variable_providers.append(add_custom_stdvars)
# from fas import json
# import logging
# log = logging.getLogger("fas.controllers")
#TODO: Appropriate flash icons for errors, etc.
# mmcgrath wonders if it will be handy to expose an encrypted mailer with fas over json for our apps
class Root(controllers.RootController):
user = User()
group = Group()
cla = CLA()
json = JsonRequest()
help = Help()
#openid = OpenID()
# TODO: Find a better place for this.
os.environ['GNUPGHOME'] = config.get('gpghome')
@expose(template="fas.templates.welcome", allow_json=True)
def index(self):
if turbogears.identity.not_anonymous():
if 'tg_format' in request.params \
and request.params['tg_format'] == 'json':
# redirects don't work with JSON calls. This is a bit of a
# hack until we can figure out something better.
return dict()
turbogears.redirect('/home')
return dict(now=time.ctime())
@expose(template="fas.templates.home", allow_json=True)
@identity.require(identity.not_anonymous())
def home(self):
user_name = turbogears.identity.current.user_name
person = People.by_username(user_name)
cla = CLADone(person)
return dict(person=person, cla=cla)
@expose(template="fas.templates.about")
def about(self):
return dict()
@expose(template="fas.templates.login", allow_json=True)
def login(self, forward_url=None, previous_url=None, *args, **kwargs):
'''Page to become authenticated to the Account System.
This shows a small login box to type in your username and password
from the Fedora Account System.
Arguments:
:forward_url: The url to send to once authentication succeeds
:previous_url: The url that sent us to the login page
'''
if forward_url == '.':
forward_url = turbogears.url('/../home')
if not identity.current.anonymous \
and identity.was_login_attempted() \
and not identity.get_identity_errors():
# User is logged in
turbogears.flash(_('Welcome, %s') % People.by_username(turbogears.identity.current.user_name).human_name)
if 'tg_format' in request.params \
and request.params['tg_format'] == 'json':
# When called as a json method, doesn't make any sense to
# redirect to a page. Returning the logged in identity
# is better.
return dict(user = identity.current.user)
if not forward_url:
forward_url = turbogears.url('/')
raise redirect(forward_url)
forward_url=None
previous_url= request.path
if identity.was_login_attempted():
msg=_("The credentials you supplied were not correct or "
"did not grant access to this resource.")
elif identity.get_identity_errors():
msg=_("You must provide your credentials before accessing "
"this resource.")
else:
msg=_("Please log in.")
forward_url= '.'
cherrypy.response.status=403
return dict(message=msg, previous_url=previous_url, logging_in=True,
original_parameters=request.params,
forward_url=forward_url)
@expose(allow_json=True)
def logout(self):
identity.current.logout()
turbogears.flash(_('You have successfully logged out.'))
if 'tg_format' in request.params \
and request.params['tg_format'] == 'json':
# When called as a json method, doesn't make any sense to
# redirect to a page. Returning the logged in identity
# is better.
return dict(status=True)
raise redirect('/')
@expose()
def language(self, locale):
if locale not in available_languages():
turbogears.flash(_('The language \'%s\' is not available.') % locale)
redirect(request.headers.get("Referer", "/"))
return dict()
turbogears.i18n.set_session_locale(locale)
redirect(request.headers.get("Referer", "/"))
return dict()

17
fas/fas/feeds.py
View file

@ -1,17 +0,0 @@
import urllib
from xml.dom import minidom
class Koji:
def __init__(self, userName, url='http://publictest8/koji/recentbuilds?user='):
buildFeed = minidom.parse(urllib.urlopen(url + userName))
try:
self.userLink = buildFeed.getElementsByTagName('link')[0].childNodes[0].data
self.builds = {}
for build in buildFeed.getElementsByTagName('item'):
link = build.getElementsByTagName('link')[0].childNodes[0].data
self.builds[link] = {}
self.builds[link]['title'] = build.getElementsByTagName('title')[0].childNodes[0].data
self.builds[link]['pubDate'] = build.getElementsByTagName('pubDate')[0].childNodes[0].data
except IndexError:
return

544
fas/fas/group.py
View file

@ -1,544 +0,0 @@
import turbogears
from turbogears import controllers, expose, paginate, identity, redirect, widgets, validate, validators, error_handler
from turbogears.database import session
import cherrypy
import sqlalchemy
import fas
from fas.auth import *
from fas.user import KnownUser
import re
import turbomail
class KnownGroup(validators.FancyValidator):
'''Make sure that a group already exists'''
def _to_python(self, value, state):
return value.strip()
def validate_python(self, value, state):
try:
g = Groups.by_name(value)
except InvalidRequestError:
raise validators.Invalid(_("The group '%s' does not exist.") % value, value, state)
class UnknownGroup(validators.FancyValidator):
'''Make sure that a group doesn't already exist'''
def _to_python(self, value, state):
return value.strip()
def validate_python(self, value, state):
try:
g = Groups.by_name(value)
except InvalidRequestError:
pass
else:
raise validators.Invalid(_("The group '%s' already exists.") % value, value, state)
class ValidGroupType(validators.FancyValidator):
'''Make sure that a group type is valid'''
def _to_python(self, value, state):
return value.strip()
def validate_python(self, value, state):
if value not in ('system', 'bugzilla','cvs', 'bzr', 'git', \
'hg', 'mtn', 'svn', 'shell', 'torrent', 'tracker', \
'tracking', 'user'):
raise validators.Invalid(_("Invalid group type.") % value, value, state)
class GroupCreate(validators.Schema):
name = validators.All(
UnknownGroup,
validators.String(max=32, min=3),
validators.Regex(regex='^[a-z0-9\-_]+$'),
)
display_name = validators.NotEmpty
owner = validators.All(
KnownUser,
validators.NotEmpty,
)
prerequisite = KnownGroup
group_type = ValidGroupType
class GroupSave(validators.Schema):
groupname = validators.All(KnownGroup, validators.String(max=32, min=3))
display_name = validators.NotEmpty
owner = KnownUser
prerequisite = KnownGroup
group_type = ValidGroupType
class GroupApply(validators.Schema):
groupname = KnownGroup
targetname = KnownUser
class GroupSponsor(validators.Schema):
groupname = KnownGroup
targetname = KnownUser
class GroupRemove(validators.Schema):
groupname = KnownGroup
targetname = KnownUser
class GroupUpgrade(validators.Schema):
groupname = KnownGroup
targetname = KnownUser
class GroupDowngrade(validators.Schema):
groupname = KnownGroup
targetname = KnownUser
class GroupView(validators.Schema):
groupname = KnownGroup
class GroupEdit(validators.Schema):
groupname = KnownGroup
class GroupInvite(validators.Schema):
groupname = KnownGroup
class GroupSendInvite(validators.Schema):
groupname = KnownGroup
target = validators.Email(not_empty=True, strip=True),
#class findUser(widgets.WidgetsList):
# username = widgets.AutoCompleteField(label=_('Username'), search_controller='search', search_param='username', result_name='people')
# action = widgets.HiddenField(default='apply', validator=validators.String(not_empty=True))
# groupname = widgets.HiddenField(validator=validators.String(not_empty=True))
#
#findUserForm = widgets.ListForm(fields=findUser(), submit_text=_('Invite'))
class Group(controllers.Controller):
def __init__(self):
'''Create a Group Controller.'''
@identity.require(turbogears.identity.not_anonymous())
def index(self):
'''Perhaps show a nice explanatory message about groups here?'''
return dict()
def jsonRequest(self):
return 'tg_format' in cherrypy.request.params and \
cherrypy.request.params['tg_format'] == 'json'
@expose(template="fas.templates.error")
def error(self, tg_errors=None):
'''Show a friendly error message'''
if not tg_errors:
turbogears.redirect('/')
return dict(tg_errors=tg_errors)
@identity.require(turbogears.identity.not_anonymous())
@validate(validators=GroupView())
@error_handler(error)
@expose(template="fas.templates.group.view", allow_json=True)
def view(self, groupname):
'''View group'''
username = turbogears.identity.current.user_name
person = People.by_username(username)
group = Groups.by_name(groupname)
if not canViewGroup(person, group):
turbogears.flash(_("You cannot view '%s'") % group.name)
turbogears.redirect('/group/list')
return dict()
else:
return dict(group=group)
@identity.require(turbogears.identity.not_anonymous())
@expose(template="fas.templates.group.new")
def new(self):
'''Display create group form'''
username = turbogears.identity.current.user_name
person = People.by_username(username)
if not canCreateGroup(person, Groups.by_name(config.get('admingroup'))):
turbogears.flash(_('Only FAS adminstrators can create groups.'))
turbogears.redirect('/')
return dict()
@identity.require(turbogears.identity.not_anonymous())
@validate(validators=GroupCreate())
@error_handler(error)
@expose(template="fas.templates.group.new")
def create(self, name, display_name, owner, group_type, needs_sponsor=0, user_can_remove=1, prerequisite='', joinmsg=''):
'''Create a group'''
groupname = name
person = People.by_username(turbogears.identity.current.user_name)
person_owner = People.by_username(owner)
if not canCreateGroup(person, Groups.by_name(config.get('admingroup'))):
turbogears.flash(_('Only FAS adminstrators can create groups.'))
turbogears.redirect('/')
try:
owner = People.by_username(owner)
group = Groups()
group.name = name
group.display_name = display_name
group.owner_id = person_owner.id
group.group_type = group_type
group.needs_sponsor = bool(needs_sponsor)
group.user_can_remove = bool(user_can_remove)
if prerequisite:
prerequisite = Groups.by_name(prerequisite)
group.prerequisite = prerequisite
group.joinmsg = joinmsg
# Log here
session.flush()
except TypeError:
turbogears.flash(_("The group: '%s' could not be created.") % groupname)
return dict()
else:
try:
owner.apply(group, person) # Apply...
session.flush()
owner.sponsor(group, person)
owner.upgrade(group, person)
owner.upgrade(group, person)
except KeyError:
turbogears.flash(_("The group: '%(group)s' has been created, but '%(user)s' could not be added as a group administrator.") % {'group': group.name, 'user': owner.username})
else:
turbogears.flash(_("The group: '%s' has been created.") % group.name)
turbogears.redirect('/group/view/%s' % group.name)
return dict()
@identity.require(turbogears.identity.not_anonymous())
@validate(validators=GroupEdit())
@error_handler(error)
@expose(template="fas.templates.group.edit")
def edit(self, groupname):
'''Display edit group form'''
username = turbogears.identity.current.user_name
person = People.by_username(username)
group = Groups.by_name(groupname)
if not canAdminGroup(person, group):
turbogears.flash(_("You cannot edit '%s'.") % group.name)
turbogears.redirect('/group/view/%s' % group.name)
return dict(group=group)
@identity.require(turbogears.identity.not_anonymous())
@validate(validators=GroupSave())
@error_handler(error)
@expose(template="fas.templates.group.edit")
def save(self, groupname, display_name, owner, group_type, needs_sponsor=0, user_can_remove=1, prerequisite='', joinmsg=''):
'''Edit a group'''
username = turbogears.identity.current.user_name
person = People.by_username(username)
group = Groups.by_name(groupname)
if not canEditGroup(person, group):
turbogears.flash(_("You cannot edit '%s'.") % group.name)
turbogears.redirect('/group/view/%s' % group.name)
else:
try:
owner = People.by_username(owner)
group.display_name = display_name
group.owner = owner
group.group_type = group_type
group.needs_sponsor = bool(needs_sponsor)
group.user_can_remove = bool(user_can_remove)
if prerequisite:
prerequisite = Groups.by_name(prerequisite)
group.prerequisite = prerequisite
else:
group.prerequisite = None
group.joinmsg = joinmsg
# Log here
session.flush()
except:
turbogears.flash(_('The group details could not be saved.'))
else:
turbogears.flash(_('The group details have been saved.'))
turbogears.redirect('/group/view/%s' % group.name)
return dict(group=group)
@identity.require(turbogears.identity.not_anonymous())
@expose(template="fas.templates.group.list", allow_json=True)
def list(self, search='*'):
username = turbogears.identity.current.user_name
person = People.by_username(username)
memberships = {}
groups = []
re_search = re.sub(r'\*', r'%', search).lower()
results = Groups.query.filter(Groups.name.like(re_search)).order_by('name').all()
if self.jsonRequest():
membersql = sqlalchemy.select([PersonRoles.c.person_id, PersonRoles.c.group_id, PersonRoles.c.role_type], PersonRoles.c.role_status=='approved').order_by(PersonRoles.c.group_id)
members = membersql.execute()
for member in members:
try:
memberships[member[1]].append({'person_id': member[0], 'role_type': member[2]})
except KeyError:
memberships[member[1]]=[{'person_id': member[0], 'role_type': member[2]}]
for group in results:
if canViewGroup(person, group):
groups.append(group)
if not len(groups):
turbogears.flash(_("No Groups found matching '%s'") % search)
return dict(groups=groups, search=search, memberships=memberships)
@identity.require(turbogears.identity.not_anonymous())
@validate(validators=GroupApply())
@error_handler(error)
@expose(template='fas.templates.group.view')
def apply(self, groupname, targetname=None):
'''Apply to a group'''
username = turbogears.identity.current.user_name
person = People.by_username(username)
if not targetname:
target = person
else:
target = People.by_username(targetname)
group = Groups.by_name(groupname)
if not canApplyGroup(person, group, target):
turbogears.flash(_('%(user)s can not apply to %(group)s.') % \
{'user': target.username, 'group': group.name })
turbogears.redirect('/group/view/%s' % group.name)
return dict()
else:
try:
target.apply(group, person)
except fas.ApplyError, e:
turbogears.flash(_('%(user)s could not apply to %(group)s: %(error)s') % \
{'user': target.username, 'group': group.name, 'error': e})
turbogears.redirect('/group/view/%s' % group.name)
else:
# TODO: How do we handle gettext calls for these kinds of emails?
# TODO: CC to right place, put a bit more thought into how to most elegantly do this
# TODO: Maybe that @fedoraproject.org (and even -sponsors) should be configurable somewhere?
message = turbomail.Message(config.get('accounts_email'), '%(group)s-sponsors@%(host)s' % {'group': group.name, 'host': config.get('email_host')}, \
"Fedora '%(group)s' sponsor needed for %(user)s" % {'user': target.username, 'group': group.name})
url = config.get('base_url_filter.base_url') + '/group/edit/%s' % groupname
message.plain = _('''
Fedora user %(user)s, aka %(name)s <%(email)s> has requested
membership for %(applicant)s (%(applicant_name)s) in the %(group)s group and needs a sponsor.
Please go to %(url)s to take action.
''') % {'user': person.username, 'name': person.human_name, 'applicant': target.username, 'applicant_name': target.human_name, 'email': person.email, 'url': url, 'group': group.name}
turbomail.enqueue(message)
turbogears.flash(_('%(user)s has applied to %(group)s!') % \
{'user': target.username, 'group': group.name})
turbogears.redirect('/group/view/%s' % group.name)
return dict()
@identity.require(turbogears.identity.not_anonymous())
@validate(validators=GroupSponsor())
@error_handler(error)
@expose(template='fas.templates.group.view')
def sponsor(self, groupname, targetname):
'''Sponsor user'''
username = turbogears.identity.current.user_name
person = People.by_username(username)
target = People.by_username(targetname)
group = Groups.by_name(groupname)
if not canSponsorUser(person, group, target):
turbogears.flash(_("You cannot sponsor '%s'") % target.username)
turbogears.redirect('/group/view/%s' % group.name)
return dict()
else:
try:
target.sponsor(group, person)
except fas.SponsorError, e:
turbogears.flash(_("%(user)s could not be sponsored in %(group)s: %(error)s") % \
{'user': target.username, 'group': group.name, 'error': e})
turbogears.redirect('/group/view/%s' % group.name)
else:
import turbomail
message = turbomail.Message(config.get('accounts_email'), target.email, "Your Fedora '%s' membership has been sponsored" % group.name)
message.plain = _('''
%(name)s <%(email)s> has sponsored you for membership in the %(group)s
group of the Fedora account system. If applicable, this change should
propagate into the e-mail aliases and CVS repository within an hour.
%(joinmsg)s
''') % {'group': group.name, 'name': person.human_name, 'email': person.email, 'joinmsg': group.joinmsg}
turbomail.enqueue(message)
turbogears.flash(_("'%s' has been sponsored!") % target.human_name)
turbogears.redirect('/group/view/%s' % group.name)
return dict()
@identity.require(turbogears.identity.not_anonymous())
@validate(validators=GroupRemove())
@error_handler(error)
@expose(template='fas.templates.group.view')
def remove(self, groupname, targetname):
'''Remove user from group'''
# TODO: Add confirmation?
username = turbogears.identity.current.user_name
person = People.by_username(username)
target = People.by_username(targetname)
group = Groups.by_name(groupname)
if not canRemoveUser(person, group, target):
turbogears.flash(_("You cannot remove '%(user)s' from '%(group)s'.") % {'user': target.username, 'group': group.name})
turbogears.redirect('/group/view/%s' % group.name)
return dict()
else:
try:
target.remove(group, target)
except fas.RemoveError, e:
turbogears.flash(_("%(user)s could not be removed from %(group)s: %(error)s") % \
{'user': target.username, 'group': group.name, 'error': e})
turbogears.redirect('/group/view/%s' % group.name)
else:
message = turbomail.Message(config.get('accounts_email'), target.email, "Your Fedora '%s' membership has been removed" % group.name)
message.plain = _('''
%(name)s <%(email)s> has removed you from the '%(group)s'
group of the Fedora Accounts System This change is effective
immediately for new operations, and should propagate into the e-mail
aliases within an hour.
''') % {'group': group.name, 'name': person.human_name, 'email': person.email}
turbomail.enqueue(message)
turbogears.flash(_('%(name)s has been removed from %(group)s') % \
{'name': target.username, 'group': group.name})
turbogears.redirect('/group/view/%s' % group.name)
return dict()
@identity.require(turbogears.identity.not_anonymous())
@validate(validators=GroupUpgrade())
@error_handler(error)
@expose(template='fas.templates.group.view')
def upgrade(self, groupname, targetname):
'''Upgrade user in group'''
username = turbogears.identity.current.user_name
person = People.by_username(username)
target = People.by_username(targetname)
group = Groups.by_name(groupname)
if not canUpgradeUser(person, group, target):
turbogears.flash(_("You cannot upgrade '%s'") % target.username)
turbogears.redirect('/group/view/%s' % group.name)
return dict()
else:
try:
target.upgrade(group, person)
except fas.UpgradeError, e:
turbogears.flash(_('%(name)s could not be upgraded in %(group)s: %(error)s') % \
{'name': target.username, 'group': group.name, 'error': e})
turbogears.redirect('/group/view/%s' % group.name)
else:
import turbomail
message = turbomail.Message(config.get('accounts_email'), target.email, "Your Fedora '%s' membership has been upgraded" % group.name)
# Should we make person.upgrade return this?
role = PersonRoles.query.filter_by(group=group, member=target).one()
status = role.role_type
message.plain = _('''
%(name)s <%(email)s> has upgraded you to %(status)s status in the
'%(group)s' group of the Fedora Accounts System This change is
effective immediately for new operations, and should propagate
into the e-mail aliases within an hour.
''') % {'group': group.name, 'name': person.human_name, 'email': person.email, 'status': status}
turbomail.enqueue(message)
turbogears.flash(_('%s has been upgraded!') % target.username)
turbogears.redirect('/group/view/%s' % group.name)
return dict()
@identity.require(turbogears.identity.not_anonymous())
@validate(validators=GroupDowngrade())
@error_handler(error)
@expose(template='fas.templates.group.view')
def downgrade(self, groupname, targetname):
'''Upgrade user in group'''
username = turbogears.identity.current.user_name
person = People.by_username(username)
target = People.by_username(targetname)
group = Groups.by_name(groupname)
if not canDowngradeUser(person, group, target):
turbogears.flash(_("You cannot downgrade '%s'") % target.username)
turbogears.redirect('/group/view/%s' % group.name)
return dict()
else:
try:
target.downgrade(group, person)
except fas.DowngradeError, e:
turbogears.flash(_('%(name)s could not be downgraded in %(group)s: %(error)s') % \
{'name': target.username, 'group': group.name, 'error': e})
turbogears.redirect('/group/view/%s' % group.name)
else:
import turbomail
message = turbomail.Message(config.get('accounts_email'), target.email, "Your Fedora '%s' membership has been downgraded" % group.name)
role = PersonRoles.query.filter_by(group=group, member=target).one()
status = role.role_type
message.plain = _('''
%(name)s <%(email)s> has downgraded you to %(status)s status in the
'%(group)s' group of the Fedora Accounts System This change is
effective immediately for new operations, and should propagate
into the e-mail aliases within an hour.
''') % {'group': group.name, 'name': person.human_name, 'email': person.email, 'status': status}
turbomail.enqueue(message)
turbogears.flash(_('%s has been downgraded!') % target.username)
turbogears.redirect('/group/view/%s' % group.name)
return dict()
@identity.require(turbogears.identity.not_anonymous())
@error_handler(error)
@expose(template="genshi-text:fas.templates.group.dump", format="text", content_type='text/plain; charset=utf-8')
def dump(self, groupname=None):
username = turbogears.identity.current.user_name
person = People.by_username(username)
if not groupname:
# groupname = config.get('cla_done_group')
people = People.query.order_by('username').all()
else:
people = []
groups = Groups.by_name(groupname)
for role in groups.approved_roles:
people.append(role.member)
if not canViewGroup(person, groups):
turbogears.flash(_("You cannot view '%s'") % group.name)
turbogears.redirect('/group/list')
return dict()
return dict(people=people)
@identity.require(identity.not_anonymous())
@validate(validators=GroupInvite())
@error_handler(error)
@expose(template='fas.templates.group.invite')
def invite(self, groupname):
username = turbogears.identity.current.user_name
person = People.by_username(username)
group = Groups.by_name(groupname)
return dict(person=person, group=group)
@identity.require(identity.not_anonymous())
@validate(validators=GroupSendInvite())
@error_handler(error)
@expose(template='fas.templates.group.invite')
def sendinvite(self, groupname, target):
import turbomail
username = turbogears.identity.current.user_name
person = People.by_username(username)
group = Groups.by_name(groupname)
if isApproved(person, group):
message = turbomail.Message(person.email, target, _('Come join The Fedora Project!'))
message.plain = _('''
%(name)s <%(email)s> has invited you to join the Fedora
Project! We are a community of users and developers who produce a
complete operating system from entirely free and open source software
(FOSS). %(name)s thinks that you have knowledge and skills
that make you a great fit for the Fedora community, and that you might
be interested in contributing.
How could you team up with the Fedora community to use and develop your
skills? Check out http://fedoraproject.org/join-fedora for some ideas.
Our community is more than just software developers -- we also have a
place for you whether you're an artist, a web site builder, a writer, or
a people person. You'll grow and learn as you work on a team with other
very smart and talented people.
Fedora and FOSS are changing the world -- come be a part of it!''') % {'name': person.human_name, 'email': person.email}
turbomail.enqueue(message)
turbogears.flash(_('Message sent to: %s') % target)
turbogears.redirect('/group/view/%s' % group.name)
else:
turbogears.flash(_("You are not in the '%s' group.") % group.name)
return dict(target=target, person=person, group=group)

49
fas/fas/help.py
View file

@ -1,49 +0,0 @@
import turbogears
from turbogears import controllers, expose, paginate, identity, redirect, widgets, validate, validators, error_handler
from turbogears.database import session
from fas.auth import *
class Help(controllers.Controller):
help = { 'none' : [_('Error'), _('<p>We could not find that help item</p>')],
'user_ircnick' : [_('IRC Nick (Optional)'), _('<p>IRC Nick is used to identify yourself on irc.freenode.net. Please register your nick on irc.freenode.net first, then fill this in so people can find you online when they need to</p>')],
'user_email' : [_('Email (Required)'), _('<p>This email address should be your prefered email contact and will be used to send various official emails to. This is also where your @fedoraproject.org email will get forwarded</p>')],
'user_human_name' : [_('Full Name (Required)'), _('<p>Your Human Name or "real life" name</p>')],
'user_gpg_keyid' : [_('GPG Key ID'), _('<p>A GPG key is generally used to prove that a message or email came from you or to encrypt information so that only the recipients can read it. This can be used when a password reset is sent to your email.</p>')],
'user_telephone' : [_('Telephone'), _('<p>Required in order to complete the <a href="http://fedoraproject.org/wiki/Legal/Licenses/CLA">CLA</a>. Sometimes during a time of emergency someone from the Fedora Project may need to contact you. For more information see our <a href="http://fedoraproject.org/wiki/Legal/PrivacyPolicy">Privacy Policy</a></p>')],
'user_postal_address': [_('Postal Address'), _('<p>Required in order to complete the <a href="http://fedoraproject.org/wiki/Legal/Licenses/CLA">CLA</a>. This should be a mailing address where you can be contacted. See our <a href="http://fedoraproject.org/wiki/Legal/PrivacyPolicy">Privacy Policy</a> about any concerns.</p>')],
'user_timezone': [_('Timezone (Optional)'), _('<p>Please specify the time zone you are in.</p>')],
'user_comments': [_('Comments (Optional)'), _('<p>Misc comments about yourself.</p>')],
'user_account_status': [_('Account Status'), _('<p>Shows account status, possible values include<ul><li>Valid</li><li>Disabled</li><li>Expired</li></ul></p>')],
'user_cla' : [_('CLA'), _('<p>In order to become a full Fedora contributor you must complete the <a href="http://fedoraproject.org/wiki/Legal/Licenses/CLA">Contributor License Agreement</a>. This license is a legal agreement between you and Red Hat. Full status allows people to contribute content and code and is recommended for anyone interested in getting involved in the Fedora Project.</p>')],
'user_ssh_key' : [_('Public SSH Key'), _('<p>Many resources require public key authentiaction to work. By uploading your public key to us, you can then log in to our servers. Type "man ssh-keygen" for more information on creating your key. Once created you will want to upload ~/.ssh/id_dsa.pub or ~/.ssh/id_rsa.pub</p>')],
'user_locale': [_('Locale'), _('<p>For non-english speaking peoples this allows individuals to select which locale they are in.</p>')],
'group_apply': [_('Apply'), _('<p>Applying for a group is like applying for a job and it can certainly take a while to get in. Many groups have their own rules about how to actually get approved or sponsored. For more information on how the account system works see the <a href="../about">about page</a>.</p>')],
'group_remove': [_('Remove'), _('''<p>Removing a person from a group will cause that user to no longer be in the group. They will need to re-apply to get in. Admins can remove anyone, Sponsors can remove users, users can't remove anyone.</p>''')],
'group_upgrade': [_('Upgrade'), _('''<p>Upgrade a persons status in this group.<ul><li>from user -> to sponsor</li><li>From sponsor -> administrator</li><li>administrators cannot be upgraded beyond administrator</li></ul></p>''')],
'group_downgrade': [_('Downgrade'), _('''<p>Downgrade a persons status in the group.<ul><li>from administrator -> to sponsor</li><li>From sponsor -> user</li><li>users cannot be downgraded below user, you may want to remove them</li></ul></p>''')],
'group_approve': [_('Approve'), _('''<p>A sponsor or administrator can approve users to be in a group. Once the user has applied for the group, go to the group's page and click approve to approve the user.</p>''')],
'group_sponsor': [_('Sponsor'), _('''<p>A sponsor or administrator can sponsor users to be in a gruop. Once the user has applied for the group, go to the group's page and click approve to sponsor the user. Sponsorship of a user implies that you are approving a user and may mentor and answer their questions as they come up.</p>''')],
'group_user_add': [_('Add User'), _('''<p>Manually add a user to a group. Place their username in this field and click 'Add'</p>''')],
'group_name': [_('Group Name'), _('''<p>The name of the group you'd like to create. It should be alphanumeric though '-'s are allowed</p>''')],
'group_display_name': [_('Display Name'), _('''<p>More human readable name of the group</p>''')],
'group_owner': [_('Group Owner'), _('''<p>The name of the owner who will run this group</p>''')],
'group_type': [_('Group Type'), _('''<p>Normally it is safe to leave this blank. Though some values include 'tracking', 'shell', 'cvs', 'git', 'hg', 'svn', and 'mtn'. This value only really matters if the group is to end up getting shell access or commit access somewhere like fedorahosted.</p>''')],
'group_needs_sponsor': [_('Needs Sponsor'), _('''<p>If your group requires sponsorship (recommended), this means that when a user is approved by a sponsor. That relationship is recorded in the account system. If user A sponsors user N, then in viewing the members of this group, people will know to contact user A about user N if something goes wrong. If this box is unchecked, this means that only approval is needed and no relationship is recorded about who did the approving</p>''')],
'group_self_removal': [_('Self Removal'), _('''<p>Should users be able to remove themselves from this group without sponsor / admin intervention? (recommended yes)</p>''')],
'group_prerequisite': [_('Must Belong To'), _('''<p>Before a user can join this group, they must belong to the group listed in this box. <b>This value cannot be removed without administrative intervention, only changed</b>. Recommended values are for the 'cla_done' group.</p>''')],
'group_join_message': [_('Join Message'), _('''<p>This message will go out to users when they join the group. It should be informative and offer tips about what to do next. A description of the group would also be valuable here</p>''')],
'gencert': [_('Client Side Cert'), _('''<p>The client side cert is generally used to grant access to upload packages to Fedora or for other authentication purposes like with koji. If you are not a package maintainer there is no need to worry about the client side cert</p>''')],
}
def __init__(self):
'''Create a JsonRequest Controller.'''
@expose(template="fas.templates.help")
def get_help(self, id='none'):
try:
helpItem = self.help[id]
except KeyError:
return dict(title=_('Error'), helpItem=[_('Error'), _('<p>We could not find that help item</p>')])
return dict(help=helpItem)

73
fas/fas/json_request.py
View file

@ -1,73 +0,0 @@
import turbogears
from turbogears import controllers, expose, identity
import sqlalchemy
from fas.model import People
from fas.model import Groups
from fas.model import Log
from fas.auth import *
class JsonRequest(controllers.Controller):
def __init__(self):
"""Create a JsonRequest Controller."""
@identity.require(turbogears.identity.not_anonymous())
@expose("json", allow_json=True)
def index(self):
"""Return a help message"""
return dict(help='This is a JSON interface.')
@identity.require(turbogears.identity.not_anonymous())
@expose("json", allow_json=True)
def person_by_id(self, id):
try:
person = People.by_id(id)
person.jsonProps = {
'People': ('approved_memberships', 'unapproved_memberships')
}
return dict(success=True, person=person)
except InvalidRequestError:
return dict(success=False)
@identity.require(turbogears.identity.not_anonymous())
@expose("json", allow_json=True)
def person_by_username(self, username):
try:
person = People.by_username(username)
person.jsonProps = {
'People': ('approved_memberships', 'unapproved_memberships')
}
return dict(success=True, person=person)
except InvalidRequestError:
return dict(success=False)
@identity.require(turbogears.identity.not_anonymous())
@expose("json", allow_json=True)
def group_by_id(self, id):
try:
group = Groups.by_id(id)
return dict(success=True, group=group)
except InvalidRequestError:
return dict(success=False)
@identity.require(turbogears.identity.not_anonymous())
@expose("json", allow_json=True)
def group_by_name(self, groupname):
try:
group = Groups.by_name(groupname)
return dict(success=True, group=group)
except InvalidRequestError:
return dict(success=False)
@identity.require(turbogears.identity.not_anonymous())
@expose("json", allow_json=True)
def user_id(self):
people = {}
peoplesql = sqlalchemy.select([People.c.id, People.c.username])
persons = peoplesql.execute()
for person in persons:
people[person[0]] = person[1]
return dict(people=people)

470
fas/fas/model.py
View file

@ -1,470 +0,0 @@
# -*- coding: utf-8 -*-
#
# Copyright © 2008 Red Hat, Inc. All rights reserved.
#
# This copyrighted material is made available to anyone wishing to use, modify,
# copy, or redistribute it subject to the terms and conditions of the GNU
# General Public License v.2. This program is distributed in the hope that it
# will be useful, but WITHOUT ANY WARRANTY expressed or implied, including the
# implied warranties of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
# See the GNU General Public License for more details. You should have
# received a copy of the GNU General Public License along with this program;
# if not, write to the Free Software Foundation, Inc., 51 Franklin Street,
# Fifth Floor, Boston, MA 02110-1301, USA. Any Red Hat trademarks that are
# incorporated in the source code or documentation are not subject to the GNU
# General Public License and may only be used or replicated with the express
# permission of Red Hat, Inc.
#
# Author(s): Toshio Kuratomi <tkuratom@redhat.com>
# Ricky Zhou <ricky@fedoraproject.org>
#
'''
Model for the Fedora Account System
'''
from datetime import datetime
import pytz
from turbogears.database import metadata, mapper, get_engine
# import some basic SQLAlchemy classes for declaring the data model
# (see http://www.sqlalchemy.org/docs/04/ormtutorial.html)
from sqlalchemy import Table, Column, ForeignKey
from sqlalchemy.orm import relation
# import some datatypes for table columns from SQLAlchemy
# (see http://www.sqlalchemy.org/docs/04/types.html for more)
from sqlalchemy import String, Unicode, Integer, DateTime
# A few sqlalchemy tricks:
# Allow viewing foreign key relations as a dictionary
from sqlalchemy.orm.collections import column_mapped_collection, attribute_mapped_collection
# Allow us to reference the remote table of a many:many as a simple list
from sqlalchemy.ext.associationproxy import association_proxy
from sqlalchemy import select, and_
from sqlalchemy.exceptions import InvalidRequestError
from turbogears.database import session
from turbogears import identity, config
import turbogears
from fedora.tg.json import SABase
import fas
# Bind us to the database defined in the config file.
get_engine()
#
# Tables Mapped from the DB
#
PeopleTable = Table('people', metadata, autoload=True)
PersonRolesTable = Table('person_roles', metadata, autoload=True)
ConfigsTable = Table('configs', metadata, autoload=True)
GroupsTable = Table('groups', metadata, autoload=True)
GroupRolesTable = Table('group_roles', metadata, autoload=True)
BugzillaQueueTable = Table('bugzilla_queue', metadata, autoload=True)
LogTable = Table('log', metadata, autoload=True)
RequestsTable = Table('requests', metadata, autoload=True)
#
# Selects for filtering roles
#
ApprovedRolesSelect = PersonRolesTable.select(and_(
PeopleTable.c.id==PersonRolesTable.c.person_id,
PersonRolesTable.c.role_status=='approved')).alias('approved')
UnApprovedRolesSelect = PersonRolesTable.select(and_(
PeopleTable.c.id==PersonRolesTable.c.person_id,
PersonRolesTable.c.role_status!='approved')).alias('unapproved')
# The identity schema -- These must follow some conventions that TG
# understands and are shared with other Fedora services via the python-fedora
# module.
visits_table = Table('visit', metadata,
Column('visit_key', String(40), primary_key=True),
Column('created', DateTime, nullable=False, default=datetime.now(pytz.utc)),
Column('expiry', DateTime)
)
visit_identity_table = Table('visit_identity', metadata,
Column('visit_key', String(40), ForeignKey('visit.visit_key'),
primary_key=True),
Column('user_id', Integer, ForeignKey('people.id'), index=True)
)
#
# Mapped Classes
#
class People(SABase):
'''Records for all the contributors to Fedora.'''
@classmethod
def by_id(cls, id):
'''
A class method that can be used to search users
based on their unique id
'''
return cls.query.filter_by(id=id).one()
@classmethod
def by_email_address(cls, email):
'''
A class method that can be used to search users
based on their email addresses since it is unique.
'''
return cls.query.filter_by(email=email).one()
@classmethod
def by_username(cls, username):
'''
A class method that permits to search users
based on their username attribute.
'''
return cls.query.filter_by(username=username).one()
# If we're going to do logging here, we'll have to pass the person that did the applying.
def apply(cls, group, requester):
'''
Apply a person to a group
'''
if group in cls.memberships:
raise fas.ApplyError, _('user is already in this group')
else:
role = PersonRoles()
role.role_status = 'unapproved'
role.role_type = 'user'
role.member = cls
role.group = group
def upgrade(cls, group, requester):
'''
Upgrade a user in a group - requester for logging purposes
'''
if not group in cls.memberships:
raise fas.UpgradeError, _('user is not a member')
else:
role = PersonRoles.query.filter_by(member=cls, group=group).one()
if role.role_type == 'administrator':
raise fas.UpgradeError, _('administrators cannot be upgraded any further')
elif role.role_type == 'sponsor':
role.role_type = 'administrator'
elif role.role_type == 'user':
role.role_type = 'sponsor'
def downgrade(cls, group, requester):
'''
Downgrade a user in a group - requester for logging purposes
'''
if not group in cls.memberships:
raise fas.DowngradeError, _('user is not a member')
else:
role = PersonRoles.query.filter_by(member=cls, group=group).one()
if role.role_type == 'user':
raise fas.DowngradeError, _('users cannot be downgraded any further')
elif role.role_type == 'sponsor':
role.role_type = 'user'
elif role.role_type == 'administrator':
role.role_type = 'sponsor'
def sponsor(cls, group, requester):
# If we want to do logging, this might be the place.
if not group in cls.unapproved_memberships:
raise fas.SponsorError, _('user is not an unapproved member')
role = PersonRoles.query.filter_by(member=cls, group=group).one()
role.role_status = 'approved'
role.sponsor = requester
role.approval = datetime.now(pytz.utc)
cls._handle_auto_add(group, requester)
def _handle_auto_add(cls, group, requester):
"""
Handle automatic group approvals
"""
auto_approve_groups = config.get('auto_approve_groups')
associations = auto_approve_groups.split('|')
approve_group_queue = []
for association in associations:
(groupname, approve_groups) = association.split(':', 1)
if groupname == group.name:
approve_group_queue.extend(approve_groups.split(','))
for groupname in approve_group_queue:
approve_group = Groups.by_name(groupname)
cls._auto_add(approve_group, requester)
def _auto_add(cls, group, requester):
"""
Ensure that a person is approved in a group
"""
try:
role = PersonRoles.query.filter_by(member=cls, group=group).one()
if role.role_status != 'approved':
role.role_status = 'approved'
role.sponsor = requester
role.approval = datetime.now(pytz.utc)
except InvalidRequestError:
role = PersonRoles()
role.role_status = 'approved'
role.role_type = 'user'
role.member = cls
role.group = group
def remove(cls, group, requester):
if not group in cls.memberships:
raise fas.RemoveError, _('user is not a member')
else:
role = PersonRoles.query.filter_by(member=cls, group=group).one()
session.delete(role)
def __repr__(cls):
return "User(%s,%s)" % (cls.username, cls.human_name)
def __json__(self):
'''We want to make sure we keep a tight reign on sensistive information.
Thus we strip out certain information unless a user is an admin or the
current user.
Current access restrictions
===========================
Anonymous users can see:
:id: The id in the account system and on the shell servers
:username: Username in FAS
:human_name: Human name of the person
:comments: Comments that the user leaves about themselves
:creation: Date this account was created
:ircnick: User's nickname on IRC
:last_seen: timestamp the user last logged into anything tied to
the account system
:status: Whether the user is active, inactive, on vacation, etc
:status_change: timestamp that the status was last updated
:locale: User's default locale for Fedora Services
:timezone: User's timezone
:latitude: Used for constructing maps of contributors
:longitude: Used for contructing maps of contributors
Authenticated Users add:
:ssh_key: Public key for connecting to over ssh
:gpg_keyid: gpg key of the user
:affiliation: company or group the user wishes to identify with
:certificate_serial: serial number of the user's Fedora SSL
Certificate
User Themselves add:
:password: hashed password to identify the user
:passwordtoken: used when the user needs to reset a password
:password_changed: last time the user changed the password
:postal_address: user's postal address
:telephone: user's telephone number
:facsimile: user's FAX number
Admins gets access to this final field as well:
:internal_comments: Comments an admin wants to write about a user
Note: There are a few other resources that are not located directly in
the People structure that you are likely to want to pass to consuming
code like email address and groups. Please see the documentation on
SABase.__json__() to find out how to set jsonProps to handle those.
'''
props = super(People, self).__json__()
if not identity.in_group('admin'):
# Only admins can see internal_comments
del props['internal_comments']
del props['emailtoken']
del props['passwordtoken']
if identity.current.anonymous:
# Anonymous users can't see any of these
del props['email']
del props['unverified_email']
del props['ssh_key']
del props['gpg_keyid']
del props['affiliation']
del props['certificate_serial']
del props['password']
del props['password_changed']
del props['postal_address']
del props['telephone']
del props['facsimile']
# TODO: Are we still doing the fas-system thing? I think I saw a systems users somewhere...
elif not identity.current.user.username == self.username and 'fas-system' not in identity.current.groups:
# Only an admin or the user themselves can see these fields
del props['unverified_email']
del props['password']
del props['postal_address']
del props['password_changed']
del props['telephone']
del props['facsimile']
return props
memberships = association_proxy('roles', 'group')
approved_memberships = association_proxy('approved_roles', 'group')
unapproved_memberships = association_proxy('unapproved_roles', 'group')
class PersonRoles(SABase):
'''Record people that are members of groups.'''
def __repr__(cls):
return "PersonRole(%s,%s,%s,%s)" % (cls.member.username, cls.group.name, cls.role_type, cls.role_status)
groupname = association_proxy('group', 'name')
class Configs(SABase):
'''Configs for applications that a Fedora Contributor uses.'''
pass
class Groups(SABase):
'''Group that people can belong to.'''
@classmethod
def by_id(cls, id):
'''
A class method that can be used to search groups
based on their unique id
'''
return cls.query.filter_by(id=id).one()
@classmethod
def by_email_address(cls, email):
'''
A class method that can be used to search groups
based on their email addresses since it is unique.
'''
return cls.query.filter_by(email=email).one()
@classmethod
def by_name(cls, name):
'''
A class method that permits to search groups
based on their name attribute.
'''
return cls.query.filter_by(name=name).one()
def __repr__(cls):
return "Groups(%s,%s)" % (cls.name, cls.display_name)
# People in the group
people = association_proxy('roles', 'member')
# Groups in the group
groups = association_proxy('group_members', 'member')
# Groups that this group belongs to
memberships = association_proxy('group_roles', 'group')
class GroupRoles(SABase):
'''Record groups that are members of other groups.'''
pass
class BugzillaQueue(SABase):
'''Queued up changes that need to be applied to bugzilla.'''
pass
class Log(SABase):
'''Write simple logs of changes to the database.'''
pass
class Requests(SABase):
'''
Requests for certain resources may be restricted based on the user or host.
'''
pass
#
# Classes for mapping arbitrary selectables (This is similar to a view in
# python rather than in the db
#
class ApprovedRoles(PersonRoles):
'''Only display roles that are approved.'''
pass
class UnApprovedRoles(PersonRoles):
'''Only show Roles that are not approved.'''
pass
#
# Classes for the SQLAlchemy Visit Manager
#
class Visit(SABase):
'''Track how many people are visiting the website.
It doesn't currently make sense for us to track this here so we clear this
table of stale records every hour.
'''
@classmethod
def lookup_visit(cls, visit_key):
return cls.query.get(visit_key)
class VisitIdentity(SABase):
'''Associate a user with a visit cookie.
This allows users to log in to app.
'''
pass
#
# set up mappers between tables and classes
#
#
# mappers for filtering roles
#
mapper(ApprovedRoles, ApprovedRolesSelect, properties = {
'group': relation(Groups, backref='approved_roles', lazy = False)
})
mapper(UnApprovedRoles, UnApprovedRolesSelect, properties = {
'group': relation(Groups, backref='unapproved_roles', lazy = False)
})
mapper(People, PeopleTable, properties = {
# This name is kind of confusing. It's to allow person.group_roles['groupname'] in order to make auth.py (hopefully) slightly faster.
'group_roles': relation(PersonRoles,
collection_class = attribute_mapped_collection('groupname'),
primaryjoin = PeopleTable.c.id==PersonRolesTable.c.person_id),
'approved_roles': relation(ApprovedRoles, backref='member',
primaryjoin = PeopleTable.c.id==ApprovedRoles.c.person_id),
'unapproved_roles': relation(UnApprovedRoles, backref='member',
primaryjoin = PeopleTable.c.id==UnApprovedRoles.c.person_id)
})
mapper(PersonRoles, PersonRolesTable, properties = {
'member': relation(People, backref = 'roles', lazy = False,
primaryjoin=PersonRolesTable.c.person_id==PeopleTable.c.id),
'group': relation(Groups, backref='roles', lazy = False,
primaryjoin=PersonRolesTable.c.group_id==GroupsTable.c.id),
'sponsor': relation(People, uselist=False,
primaryjoin = PersonRolesTable.c.sponsor_id==PeopleTable.c.id)
})
mapper(Configs, ConfigsTable, properties = {
'person': relation(People, backref = 'configs')
})
mapper(Groups, GroupsTable, properties = {
'owner': relation(People, uselist=False,
primaryjoin = GroupsTable.c.owner_id==PeopleTable.c.id),
'prerequisite': relation(Groups, uselist=False,
primaryjoin = GroupsTable.c.prerequisite_id==GroupsTable.c.id)
})
# GroupRoles are complex because the group is a member of a group and thus
# is referencing the same table.
mapper(GroupRoles, GroupRolesTable, properties = {
'member': relation(Groups, backref = 'group_roles',
primaryjoin = GroupsTable.c.id==GroupRolesTable.c.member_id),
'group': relation(Groups, backref = 'group_members',
primaryjoin = GroupsTable.c.id==GroupRolesTable.c.group_id),
'sponsor': relation(People, uselist=False,
primaryjoin = GroupRolesTable.c.sponsor_id==PeopleTable.c.id)
})
mapper(BugzillaQueue, BugzillaQueueTable, properties = {
'group': relation(Groups, backref = 'pending'),
'person': relation(People, backref = 'pending'),
### TODO: test to be sure SQLAlchemy only loads the backref on demand
'author': relation(People, backref='changes')
})
mapper(Requests, RequestsTable, properties = {
'person': relation(People, backref='requests')
})
mapper(Log, LogTable)
# TurboGears Identity
mapper(Visit, visits_table)
mapper(VisitIdentity, visit_identity_table,
properties=dict(users=relation(People, backref='visit_identity')))

112
fas/fas/openid_fas.py
View file

@ -1,112 +0,0 @@
import turbogears
from turbogears import controllers, expose, paginate, identity, redirect, widgets, validate, validators, error_handler, config
from cherrypy import session
import cherrypy
from openid.server.server import Server as OpenIDServer
from openid.server.server import BROWSER_REQUEST_MODES
from openid.server.server import OPENID_PREFIX
from openid.store.filestore import FileOpenIDStore
from fas.auth import *
from fas.user import KnownUser
class UserID(validators.Schema):
targetname = KnownUser
class OpenID(controllers.Controller):
def __init__(self):
'''Create a OpenID Controller.'''
store = FileOpenIDStore(config.get('openidstore'))
self.openid_server = OpenIDServer(store)#, turbogears.url('/openid/server'))
@expose()
def index(self):
turbogears.redirect('/openid/about')
return dict()
@expose(template="fas.templates.openid.about")
def about(self):
'''Display an explanatory message about the OpenID service'''
username = turbogears.identity.current.user_name
return dict(username=username)
@expose(template="genshi-text:fas.templates.openid.auth", format="text", content_type='text/plain; charset=utf-8')
def server(self, **query):
'''Perform OpenID auth'''
openid_server = self.openid_server
openid_query = {}
openid_request = None
if not session.has_key('openid_trusted'):
session['openid_trusted'] = []
if query.has_key('url') and query.has_key('trusted') and query['trusted'] == 'allow':
session['openid_trusted'].append(query['url'])
if query.has_key('openid'):
try:
for key in query['openid'].keys():
openid_key = OPENID_PREFIX + key
openid_query[openid_key] = query['openid'][key]
openid_request = openid_server.decodeRequest(openid_query)
session['openid_request'] = openid_request
except KeyError:
turbogears.flash(_('The OpenID request could not be decoded.'))
elif session.has_key('openid_request'):
openid_request = session['openid_request']
if openid_request is None:
turbogears.redirect('/openid/about')
return dict()
else:
openid_response = None
if openid_request.mode in BROWSER_REQUEST_MODES:
username = turbogears.identity.current.user_name;
url = None
if username is not None:
url = config.get('base_url') + turbogears.url('/openid/id/%s' % username)
if openid_request.identity == url:
if openid_request.trust_root in session['openid_trusted']:
openid_response = openid_request.answer(True)
elif openid_request.immediate:
openid_response = openid_request.answer(False, server_url=config.get('base_url') + turbogears.url('/openid/server'))
else:
if query.has_key('url') and not query.has_key('allow'):
openid_response = openid_request.answer(False, server_url=config.get('base_url') + turbogears.url('/openid/server'))
else:
turbogears.redirect('/openid/trusted', url=openid_request.trust_root)
elif openid_request.immediate:
openid_response = openid_request.answer(False, server_url=config.get('base_url') + turbogears.url('/openid/server'))
else:
turbogears.redirect('/openid/login')
return dict()
else:
openid_response = openid_server.handleRequest(openid_request)
web_response = openid_server.encodeResponse(openid_response)
for name, value in web_response.headers.items():
cherrypy.response.headers[name] = value;
cherrypy.response.status = web_response.code
return dict(body=web_response.body)
@identity.require(turbogears.identity.not_anonymous())
@expose(template="fas.templates.openid.trusted")
def trusted(self, url):
'''Ask the user if they trust a site for OpenID authentication'''
return dict(url=url)
@identity.require(turbogears.identity.not_anonymous())
@expose()
def login(self):
'''This exists only to make the user login and then redirect to /openid/server'''
turbogears.redirect('/openid/server')
return dict()
@expose(template="fas.templates.openid.id")
@validate(validators=UserID())
def id(self, username):
'''The "real" OpenID URL'''
person = People.by_username(username)
server = config.get('base_url') + turbogears.url('/openid/server')
return dict(person=person, server=server)

82
fas/fas/openssl_fas.py
View file

@ -1,82 +0,0 @@
# Pretty much all copied from pyOpenSSL's certgen.py example and func's certs.py
from OpenSSL import crypto
TYPE_RSA = crypto.TYPE_RSA
TYPE_DSA = crypto.TYPE_DSA
def retrieve_key_from_file(keyfile):
fo = open(keyfile, 'r')
buf = fo.read()
keypair = crypto.load_privatekey(crypto.FILETYPE_PEM, buf)
return keypair
def retrieve_cert_from_file(certfile):
fo = open(certfile, 'r')
buf = fo.read()
cert = crypto.load_certificate(crypto.FILETYPE_PEM, buf)
return cert
def createKeyPair(type, bits):
"""
Create a public/private key pair.
Arguments: type - Key type, must be one of TYPE_RSA and TYPE_DSA
bits - Number of bits to use in the key
Returns: The public/private key pair in a PKey object
"""
pkey = crypto.PKey()
pkey.generate_key(type, bits)
return pkey
def createCertRequest(pkey, digest="md5", **name):
"""
Create a certificate request.
Arguments: pkey - The key to associate with the request
digest - Digestion method to use for signing, default is md5
**name - The name of the subject of the request, possible
arguments are:
C - Country name
ST - State or province name
L - Locality name
O - Organization name
OU - Organizational unit name
CN - Common name
emailAddress - E-mail address
Returns: The certificate request in an X509Req object
"""
req = crypto.X509Req()
subj = req.get_subject()
for (key,value) in name.items():
setattr(subj, key, value)
req.set_pubkey(pkey)
req.sign(pkey, digest)
return req
def createCertificate(req, (issuerCert, issuerKey), serial, (notBefore, notAfter), digest="md5"):
"""
Generate a certificate given a certificate request.
Arguments: req - Certificate reqeust to use
issuerCert - The certificate of the issuer
issuerKey - The private key of the issuer
serial - Serial number for the certificate
notBefore - Timestamp (relative to now) when the certificate
starts being valid
notAfter - Timestamp (relative to now) when the certificate
stops being valid
digest - Digest method to use for signing, default is md5
Returns: The signed certificate in an X509 object
"""
cert = crypto.X509()
cert.set_serial_number(serial)
cert.gmtime_adj_notBefore(notBefore)
cert.gmtime_adj_notAfter(notAfter)
cert.set_issuer(issuerCert.get_subject())
cert.set_subject(req.get_subject())
cert.set_pubkey(req.get_pubkey())
cert.sign(issuerKey, digest)
return cert

18
fas/fas/release.py
View file

@ -1,18 +0,0 @@
'''
Release information about the Fedora Accounts System
'''
VERSION = '0.8.1'
NAME = 'fas'
DESCRIPTION = 'The Fedora Account System'
LONG_DESCRIPTION = '''
Manage the accounts of contributors to the Fedora Project.
'''
AUTHOR = 'Ricky Zhou, Mike McGrath, and Toshio Kuratomi'
EMAIL = 'fedora-infrastructure-list@fedoraproject.org'
COPYRIGHT = '2007-2008 Red Hat, Inc.'
# if it's open source, you might want to specify these
URL = 'https://admin.fedoraproject.org/accounts/'
DOWNLOAD_URL = 'https://fas2.fedorahosted.org/'
LICENSE = 'GPLv2'

219
fas/fas/safasprovider.py
View file

@ -1,219 +0,0 @@
# -*- coding: utf-8 -*-
#
# Copyright © 2007-2008 Red Hat, Inc. All rights reserved.
#
# This copyrighted material is made available to anyone wishing to use, modify,
# copy, or redistribute it subject to the terms and conditions of the GNU
# General Public License v.2. This program is distributed in the hope that it
# will be useful, but WITHOUT ANY WARRANTY expressed or implied, including the
# implied warranties of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
# See the GNU General Public License for more details. You should have
# received a copy of the GNU General Public License along with this program;
# if not, write to the Free Software Foundation, Inc., 51 Franklin Street,
# Fifth Floor, Boston, MA 02110-1301, USA. Any Red Hat trademarks that are
# incorporated in the source code or documentation are not subject to the GNU
# General Public License and may only be used or replicated with the express
# permission of Red Hat, Inc.
#
# Red Hat Author(s): Toshio Kuratomi <tkuratom@redhat.com>
#
'''
This plugin provides authentication of passwords against the Fedora Account
System.
'''
from sqlalchemy.orm import class_mapper
from turbogears import config, identity
from turbogears.identity.saprovider import SqlAlchemyIdentity, \
SqlAlchemyIdentityProvider
from turbogears.database import session
from turbogears.util import load_class
import gettext
t = gettext.translation('python-fedora', '/usr/share/locale', fallback=True)
_ = t.ugettext
import crypt
import logging
log = logging.getLogger('turbogears.identity.safasprovider')
try:
set, frozenset
except NameError:
from sets import Set as set, ImmutableSet as frozenset
# Global class references --
# these will be set when the provider is initialised.
user_class = None
visit_identity_class = None
class SaFasIdentity(SqlAlchemyIdentity):
def __init__(self, visit_key, user=None):
super(SaFasIdentity, self).__init__(visit_key, user)
def _get_user(self):
try:
return self._user
except AttributeError:
# User hasn't already been set
pass
# Attempt to load the user. After this code executes, there *WILL* be
# a _user attribute, even if the value is None.
### TG: Difference: Can't use the inherited method b/c of global var
visit = visit_identity_class.query.filter_by(visit_key = self.visit_key).first()
if not visit:
self._user = None
return None
self._user = user_class.query.get(visit.user_id)
return self._user
user = property(_get_user)
def _get_user_name(self):
if not self.user:
return None
### TG: Difference: Different name for the field
return self.user.username
user_name = property(_get_user_name)
def _get_groups(self):
try:
return self._groups
except AttributeError:
# Groups haven't been computed yet
pass
if not self.user:
self._groups = frozenset()
else:
### TG: Difference. Our model has a many::many for people:groups
# And an association proxy that links them together
self._groups = frozenset([g.name for g in self.user.approved_memberships])
return self._groups
groups = property(_get_groups)
def logout(self):
'''
Remove the link between this identity and the visit.
'''
if not self.visit_key:
return
try:
### TG: Difference: Can't inherit b/c this uses a global var
visit = visit_identity_class.query.filter_by(visit_key=self.visit_key).first()
session.delete(visit)
# Clear the current identity
anon = SqlAlchemyIdentity(None,None)
identity.set_current_identity(anon)
except:
pass
else:
session.flush()
class SaFasIdentityProvider(SqlAlchemyIdentityProvider):
'''
IdentityProvider that authenticates users against the fedora account system
'''
def __init__(self):
global visit_identity_class
global user_class
user_class_path = config.get("identity.saprovider.model.user", None)
user_class = load_class(user_class_path)
visit_identity_class_path = config.get("identity.saprovider.model.visit", None)
log.info(_("Loading: %(visitmod)s") % \
{'visitmod': visit_identity_class_path})
visit_identity_class = load_class(visit_identity_class_path)
def create_provider_model(self):
'''
Create the database tables if they don't already exist.
'''
class_mapper(user_class).local_table.create(checkfirst=True)
class_mapper(visit_identity_class).local_table.create(checkfirst=True)
def validate_identity(self, user_name, password, visit_key):
'''
Look up the identity represented by user_name and determine whether the
password is correct.
Must return either None if the credentials weren't valid or an object
with the following properties:
user_name: original user name
user: a provider dependant object (TG_User or similar)
groups: a set of group IDs
permissions: a set of permission IDs
'''
user = user_class.query.filter_by(username=user_name).first()
if not user:
log.warning("No such user: %s", user_name)
return None
if not self.validate_password(user, user_name, password):
log.info("Passwords don't match for user: %s", user_name)
return None
log.info("associating user (%s) with visit (%s)", user.username,
visit_key)
# Link the user to the visit
link = visit_identity_class.query.filter_by(visit_key=visit_key).first()
if not link:
link = visit_identity_class()
link.visit_key = visit_key
link.user_id = user.id
else:
link.user_id = user.id
session.flush()
return SaFasIdentity(visit_key, user)
def validate_password(self, user, user_name, password):
'''
Check the supplied user_name and password against existing credentials.
Note: user_name is not used here, but is required by external
password validation schemes that might override this method.
If you use SqlAlchemyIdentityProvider, but want to check the passwords
against an external source (i.e. PAM, LDAP, Windows domain, etc),
subclass SqlAlchemyIdentityProvider, and override this method.
Arguments:
:user: User information. Not used.
:user_name: Given username.
:password: Given, plaintext password.
Returns: True if the password matches the username. Otherwise False.
Can return False for problems within the Account System as well.
'''
return user.password == crypt.crypt(password, user.password)
def load_identity(self, visit_key):
'''Lookup the principal represented by visit_key.
Arguments:
:visit_key: The session key for whom we're looking up an identity.
Must return an object with the following properties:
user_name: original user name
user: a provider dependant object (TG_User or similar)
groups: a set of group IDs
permissions: a set of permission IDs
'''
return SaFasIdentity(visit_key)
def anonymous_identity(self):
'''
Must return an object with the following properties:
user_name: original user name
user: a provider dependant object (TG_User or similar)
groups: a set of group IDs
permissions: a set of permission IDs
'''
return SaFasIdentity(None)
def authenticated_identity(self, user):
'''
Constructs Identity object for user that has no associated visit_key.
'''
return SaFasIdentity(None, user)

BIN
fas/fas/static/images/balloons/balloon-0.png
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 24 KiB

BIN
fas/fas/static/images/balloons/balloon-1.png
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 24 KiB

BIN
fas/fas/static/images/balloons/balloon-2.png
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 35 KiB

BIN
fas/fas/static/images/balloons/balloon-3.png
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 28 KiB

BIN
fas/fas/static/images/balloons/button.png
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 502 B

BIN
fas/fas/static/images/balloons/icon.gif
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 346 B

874
fas/fas/static/js/HelpBalloon.js
View file

@ -1,874 +0,0 @@
//
// Copyright (c) 2008 Beau D. Scott | http://www.beauscott.com
//
// Permission is hereby granted, free of charge, to any person
// obtaining a copy of this software and associated documentation
// files (the "Software"), to deal in the Software without
// restriction, including without limitation the rights to use,
// copy, modify, merge, publish, distribute, sublicense, and/or sell
// copies of the Software, and to permit persons to whom the
// Software is furnished to do so, subject to the following
// conditions:
//
// The above copyright notice and this permission notice shall be
// included in all copies or substantial portions of the Software.
//
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
// OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
// WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
// FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
// OTHER DEALINGS IN THE SOFTWARE.
//
/**
* HelpBalloon.js
* Prototype/Scriptaculous based help balloons / dialog balloons
* @version 1.5
* @requires prototype.js <http://www.prototypejs.org/>
* @requires scriptaculous.js <http://script.aculo.us/>
* @author Beau D. Scott <beau_scott@hotmail.com>
*/
var HelpBalloon = Class.create();
HelpBalloon.prototype = {
/**
* Instantiates the object
* @param {Object} options
* @see HelpBalloonOptions
* @constructor
*/
initialize: function(options)
{
/**
* Display and behavioral options
* @see HelpBalloonOptions
*/
this.options = new HelpBalloonOptions();
Object.extend(this.options, options || {});
/**
* The local store of 'title'. Will change if the balloon is making a remote call
* unless options.title is specified
* @var {String}
* @private
*/
this.title = this.options.title;
/**
* Display elements
* @var {Object}
* @private
*/
this._elements = new HelpBalloonElements();
/**
* The balloons visibility state.
* @var {Boolean}
* @private
*/
this.visible = false;
/**
* Rendering status
* @var {Boolean}
* @private
*/
this.drawn = false;
/**
* X/Y coordinate of icon at time of render
* @var {Array}
* @private
*/
this.renderXY = [0,0];
/**
* Stores the balloon coordinates
* @private
* @var {Object}
*/
this.balloonCoords = null;
/**
* Balloon styling
* @private
* @var {Object}
*/
this.balloonStyle = {
'position': 'absolute',
'border': 'none',
'display': 'none'
}
/**
* Title Bar style
* @var {Object}
* @private
*/
this.titleStyle = {
'color': 'black',
'fontSize': '16px',
'fontWeight': 'bold',
'fontFamily': 'Verdana'
}
/**
* Width,height of the balloons
* @private
* @var {Array}
*/
this.balloonDimensions = [0,0];
/**
* ID for object and Icon, Requires prototype.improvements.js
* @var {String}
*/
this.id = "HelpBalloon_" + Object.genGUID();
//
// Preload the balloon and button images so they're ready
// at render time
//
// 0 1
// X
// 2 3
//
for(var i = 0; i < 4; i++)
{
var balloon = new Element('img', {
src: this.options.balloonPrefix + i + this.options.balloonSuffix
});
this._elements.balloons.push(balloon.src);
}
/**
* @private
*/
this.lastBalloon = balloon;
this._elements.button = new Element('img', {
src: this.options.button
});
//
// Create the anchoring icon, or attach the balloon to the given icon element
// If a string is passed in, assume it's a URL, if it's an object, assume it's
// a DOM member.
//
if(typeof this.options.icon == 'string')
{
this._elements.icon = new Element('img', {
src: this.options.icon,
id: this.id + "_icon"
});
this._elements.icon.setStyle('cursor', 'pointer');
}
else
{
// Not a string given (most likely an object. Do not append the element
// Kind of a hack for now, but I'll fix it in the next version.
this._elements.icon = this.options.icon;
this.options.returnElement = true;
}
this._elements.icon._HelpBalloon = this;
//
// Attach rendering events
//
for(i = 0; i < this.options.useEvent.length; i++)
{
Event.observe(this._elements.icon, this.options.useEvent[i], this.toggle.bindAsEventListener(this));
}
this._elements.container = new Element('div', {
'_HelpBalloon': this
});
//
// If we are not relying on other javascript to attach the anchoring icon
// to the DOM, we'll just do where the script is called from. Default behavior.
//
// If you want to use external JavaScript to attach it to the DOM, attach this._elements.icon
//
if(!this.options.returnElement)
{
document.write('<span id="' + this.id + '"></span>');
var te = $(this.id);
var p = te.parentNode;
p.insertBefore(this._elements.icon, te);
p.removeChild(te);
}
},
/**
* Toggles the help balloon
* @param {Object} e Event
*/
toggle: function(e)
{
if(!e) e = window.event || {type: this.options.useEvent, target: this._elements.icon};
var icon = Event.element(e);
if(e.type == this.options.useEvent && !this.visible && icon == this._elements.icon)
this.show();
else
this.hide();
},
/**
* Triggers the balloon to appear
*/
show: function()
{
if(!this.drawn) this._draw();
this._reposition();
this._hideOtherHelps();
Effect.Appear(this._elements.container, {
duration: this.options.duration,
afterFinish: function(e){
this._elements.container.setStyle('display', 'block');
this._hideLowerElements();
}.bindAsEventListener(this)
});
this.visible = true;
Event.observe(window, 'resize', this._reposition.bindAsEventListener(this));
},
/**
* Hides the balloon
*/
hide: function()
{
this._showLowerElements();
Effect.Fade(this._elements.container, {duration: this.options.duration});
setTimeout(function(){
this._elements.container.setStyle('display', 'none');
}.bind(this), this.options.duration * 1000);
this.visible = false;
Event.stopObserving(window, 'resize', this._reposition.bindAsEventListener(this));
},
/**
* Redraws the balloon based on the current coordinates of the icon.
* @private
*/
_reposition: function()
{
this.balloonCoords = this._getXY(this._elements.icon);
//Horizontal and vertical offsets in relation to the icon's 0,0 position.
// Default is the middle of the object
var ho = this._elements.icon.offsetWidth / 2;
var vo = this._elements.icon.offsetHeight / 2;
var offsets = this.options.anchorPosition.split(/\s+/gi);
for(var i = 0; i < offsets.length; i++)
{
switch(offsets[i].toLowerCase())
{
case 'left':
ho = 0;
break;
case 'right':
ho = this._elements.icon.offsetWidth;
break;
case 'center':
ho = this._elements.icon.offsetWidth / 2;
break;
case 'top':
vo = 0;
break;
case 'middle':
vo = this._elements.icon.offsetHeight / 2;
break;
case 'bottom':
vo = this._elements.icon.offsetHeight;
break;
}
}
this.balloonCoords.y += vo;
this.balloonCoords.x += ho;
//
// Figure out what position to show based on available realestate
// 0 1
// X
// 2 3
// Number indicates position of corner opposite anchor
//
var pos = 1;
var offsetHeight = this.balloonCoords.y - this.balloonDimensions[1];
if(offsetHeight < 0)
pos += 2;
var offsetWidth = this.balloonCoords.x + this.balloonDimensions[0];
var ww = Browser.isMSIE() ? document.body.clientWidth : window.outerWidth;
if(offsetWidth > ww)
pos -- ;
var zx = 0;
var zy = 0;
//
// 0 1
// X
// 2 3
//
switch(pos)
{
case 0:
zx = this.balloonCoords.x - this.balloonDimensions[0];
zy = this.balloonCoords.y - this.balloonDimensions[1];
break;
case 1:
zx = this.balloonCoords.x;
zy = this.balloonCoords.y - this.balloonDimensions[1];
break;
case 2:
zx = this.balloonCoords.x - this.balloonDimensions[0];
zy = this.balloonCoords.y;
break;
case 3:
zx = this.balloonCoords.x;
zy = this.balloonCoords.y;
break;
}
var containerStyle = {
/*'backgroundRepeat': 'no-repeat',
'backgroundColor': 'transparent',
'backgroundPosition': 'top left',*/
'left' : zx + "px",
'top' : zy + "px",
'width' : this.balloonDimensions[0] + 'px',
'height' : this.balloonDimensions[1] + 'px'
}
if(Browser.isMSIE())
{
//
// Fix for IE alpha transparencies
//
if(this._elements.balloons[pos].toLowerCase().indexOf('.png') > -1)
{
Element.setStyle(this._elements.bgContainer, {
'left' : '0px',
'top' : '0px',
'filter' : "progid:DXImageTransform.Microsoft.AlphaImageLoader(src='" + this._elements.balloons[pos] + "', sizingMethod='scale')",
'width' : this.balloonDimensions[0] + 'px',
'height' : this.balloonDimensions[1] + 'px',
'position' : 'absolute'
});
}
else
containerStyle['background'] = 'transparent url(' + this._elements.balloons[pos] + ') top left no-repeat';
}
else
{
containerStyle['background'] = 'transparent url(' + this._elements.balloons[pos] + ') top left no-repeat';
}
Element.setStyle(this._elements.container, containerStyle);
},
/**
* Render's the Balloon
* @private
*/
_draw: function()
{
Element.setStyle(this._elements.container, this.balloonStyle);
if(this.options.dataURL && (!this.drawn || !this.options.cacheRemoteContent))
{
var cont = new Ajax.Request(this.options.dataURL, {asynchronous: false, method: this.options.method});
//
// Expects the following XML format:
// <HelpBalloon>
// <title>My Title</title>
// <content>My content</content>
// </HelpBaloon>
//
var doHTML = false;
if(cont.transport.responseXML)
{
var xml = cont.transport.responseXML.getElementsByTagName('HelpBalloon')[0];
if(xml)
{
if(!this.options.title)
{
xmlTitle = xml.getElementsByTagName('title')[0];
if(xmlTitle) this.title = xmlTitle.firstChild.nodeValue;
}
xmlContent = xml.getElementsByTagName('content')[0];
if(xmlContent) this.options.content = xmlContent.firstChild.nodeValue;
}
else
doHTML = true;
}
else
doHTML = true;
if(doHTML)
{
// Attempt to get the title from a <title/> HTML tag, unless the title option has been set. If so, use that.
if(!this.options.title)
{
var htmlTitle = cont.transport.responseText.match(/\<title\>([^\<]+)\<\/title\>/gi);
if(htmlTitle)
{
htmlTitle = htmlTitle.toString().replace(/\<title\>|\<\/title\>/gi, '');
this.title = htmlTitle;
}
}
this.options.content = cont.transport.responseText;
}
}
this.balloonDimensions[0] = this.lastBalloon.width;
this.balloonDimensions[1] = this.lastBalloon.height;
var contentDimensions = [
this.balloonDimensions[0] - (2 * this.options.contentMargin),
this.balloonDimensions[1] - (2 * this.options.contentMargin)
];
var buttonDimensions = [
this._elements.button.width,
this._elements.button.height
];
//
// Create all the elements on demand if they haven't been created yet
//
if(!this.drawn)
{
this._elements.inner = new Element('div');
this._elements.title = new Element('div');
this._elements.inner.appendChild(this._elements.title);
// PNG fix for IE
if(Browser.isMSIE() && this.options.button.toLowerCase().indexOf('.png') > -1)
{
this._elements.bgContainer = new Element('div');
// Have to create yet-another-child of container to house the background for IE... when it was set in
// the main container, it for some odd reason prevents child components from being clickable.
this._elements.container.appendChild(this._elements.bgContainer);
this._elements.closer = new Element('div');
this._elements.closer.setStyle('filter',
"progid:DXImageTransform.Microsoft.AlphaImageLoader(src='" + this.options.button + "', sizingMethod='scale')");
}
else
{
this._elements.closer = this._elements.button;
}
Event.observe(this._elements.closer, 'click', this.toggle.bindAsEventListener(this));
this._elements.inner.appendChild(this._elements.closer);
this._elements.content = new Element('div');
this._elements.inner.appendChild(this._elements.content);
this._elements.container.appendChild(this._elements.inner);
document.getElementsByTagName('body')[0].appendChild(this._elements.container);
this.drawn = true;
}
// Reset the title element and reappend the title value (could have changed with a new URL)
this._elements.title.innerHTML = '';
this._elements.title.appendChild(document.createTextNode(this.title));
// Reset content value:
this._elements.content.innerHTML = this.options.content;
//
// Reapply styling to components as values might have changed
//
Element.setStyle(this._elements.inner, {
'position': 'absolute',
'top': this.options.contentMargin + 'px',
'left': this.options.contentMargin + 'px',
'width': contentDimensions[0] + 'px',
'height': contentDimensions[1] + 'px'
});
Element.setStyle(this._elements.title, {
'width': (contentDimensions[0] - buttonDimensions[0]) + 'px',
'height': buttonDimensions[1] + 'px',
'position': 'absolute',
'overflow': 'hidden',
'top': '0px',
'left': '0px'
});
Element.setStyle(this._elements.title, this.titleStyle);
Element.setStyle(this._elements.closer, {
'width': buttonDimensions[0] + 'px',
'height': buttonDimensions[1] + 'px',
'cursor': 'pointer',
'position': 'absolute',
'top': '0px',
'right': '0px'
});
Element.setStyle(this._elements.content, {
'width': contentDimensions[0] + 'px',
'height': (contentDimensions[1] - this._elements.button.height) + 'px',
'overflow': 'auto',
'position': 'absolute',
'top': buttonDimensions[1] + 'px',
'left': '0px',
'fontFamily': 'verdana',
'fontSize': '11px',
'fontWeight': 'normal',
'color': 'black'
});
},
/**
* Gets the current position of the obj
* @param {Element} element to get position of
* @return Object of (x, y, x2, y2)
*/
_getXY: function(obj)
{
var pos = Position.cumulativeOffset(obj)
var y = pos[1];
var x = pos[0];
var x2 = x + parseInt(obj.offsetWidth);
var y2 = y + parseInt(obj.offsetHeight);
return {'x':x, 'y':y, 'x2':x2, 'y2':y2};
},
/**
* Determins if the object is a child of the balloon element
* @param {Element} Element to check parentage
* @return {Boolean}
* @private
*/
_isChild: function(obj)
{
var i = 15;
do{
if(obj == this._elements.container)
return true;
obj = obj.parentNode;
}while(obj && i--);
return false
},
/**
* Determines if the balloon is over this_obj object
* @param {Element} Object to look under
* @return {Boolean}
* @private
*/
_isOver: function(this_obj)
{
if(!this.visible) return false;
if(this_obj == this._elements.container || this._isChild(this_obj)) return false;
var this_coords = this._getXY(this_obj);
var that_coords = this._getXY(this._elements.container);
if(
(
(
(this_coords.x >= that_coords.x && this_coords.x <= that_coords.x2)
||
(this_coords.x2 >= that_coords.x && this_coords.x2 <= that_coords.x2)
)
&&
(
(this_coords.y >= that_coords.y && this_coords.y <= that_coords.y2)
||
(this_coords.y2 >= that_coords.y && this_coords.y2 <= that_coords.y2)
)
)
){
return true;
}
else
return false;
},
/**
* Restores visibility of elements under the balloon
* (For IE)
* TODO: suck yourself
* @private
*/
_showLowerElements: function()
{
if(this.options.hideUnderElementsInIE)
{
var elements = this._getWeirdAPIElements();
for(var i = 0; i < elements.length; i++)
{
if(this._isOver(elements[i]))
{
if(elements[i].style.visibility != 'visible' && elements[i].hiddenBy == this)
{
elements[i].style.visibility = 'visible';
elements[i].hiddenBy = null;
}
}
}
}
},
/**
* Hides elements below the balloon
* (For IE)
* @private
*/
_hideLowerElements: function()
{
if(this.options.hideUnderElementsInIE)
{
var elements = this._getWeirdAPIElements();
for(var i = 0; i < elements.length; i++)
{
if(this._isOver(elements[i]))
{
if(elements[i].style.visibility != 'hidden')
{
elements[i].style.visibility = 'hidden';
elements[i].hiddenBy = this;
}
}
}
}
},
/**
* Determines which elements need to be hidden
* (For IE)
* @return {Array} array of elements
*/
_getWeirdAPIElements: function()
{
if(!Browser.isMSIE()) return [];
var objs = ['select', 'input', 'object'];
var elements = [];
for(var i = 0; i < objs.length; i++)
{
var e = document.getElementsByTagName(objs[i]);
for(var j = 0; j < e.length; j++)
{
elements.push(e[j]);
}
}
return elements;
},
/**
* Hides the other visible help balloons
* @param {Event} e
*/
_hideOtherHelps: function(e)
{
if(!e) e = window.event;
var divs = document.getElementsByTagName('div');
for(var i = 0; i < divs.length; i++)
{
if(divs[i]._HelpBalloon && divs[i]._HelpBalloon.visible && (divs[i] != this._elements.container))
divs[i]._HelpBalloon.toggle(e);
}
}
};
/**
* HelpBalloonOptions
* Helper class for defining options for the HelpBalloon object
* @author Beau D. Scott <beau_scott@hotmail.com>
*/
var HelpBalloonOptions = Class.create();
HelpBalloonOptions.prototype = {
/**
* @constructor
*/
initialize: function(){},
/**
* For use with embedding this object into another. If true, the icon is not created
* and not appeneded to the DOM at construction.
* Default is false
* @var {Boolean}
*/
returnElement: false,
/**
* URL to the anchoring icon image file to use. This can also be a direct reference
* to an existing element if you're using that as your anchoring icon.
* @var {Object}
*/
icon: '/accounts/static/images/balloons/icon.gif',
/**
* Alt text of the help icon
* @var {String}
*/
altText: 'Click here for help with this topic.',
/**
* URL to pull the title/content XML
* @var {String}
*/
dataURL: null,
/**
* Static title of the balloon
* @var {String}
*/
title: null,
/**
* Static content of the balloon
* @var {String}
*/
content: null,
/**
* Show/Hide effect duration
* @var {Number}
*/
duration: 0.2,
/**
* The event type to listen for on the icon to show the balloon.
* Default 'click'
* @var {String}
*/
useEvent: ['click'],
/**
* Request method for dynamic content. (get, post)
* Default 'get'
* @var {String}
*/
method: 'get',
/**
* Flag indicating cache the request result. If this is false, every
* time the balloon is shown, it will retrieve the remote url and parse it
* before the balloon appears, updating the content. Otherwise, it will make
* the call once and use the same content with each subsequent showing.
* Default true
* @var {Boolean}
*/
cacheRemoteContent: true,
/**
* Vertical and horizontal margin of the content pane
* @var {Number}
*/
contentMargin: 35,
/**
* X coordinate of the closing button
* @var {Number}
*/
buttonX: 246,
/**
* Y coordinate of the closing button
* @var {Number}
*/
buttonY: 35,
/**
* Clossing button image path
* @var {String}
*/
button: '/accounts/static/images/balloons/button.png',
/**
* Balloon image path prefix. There are 4 button images, numerically named, starting with 0.
* 0, 1
* 2, 3
* (the number indicates the corner opposite the anchor (the pointing direction)
* @var {String}
*/
balloonPrefix: '/accounts/static/images/balloons/balloon-',
/**
* The image filename suffix, including the file extension
* @var {String}
*/
balloonSuffix: '.png',
/**
* Position of the balloon's anchor relative to the icon element.
* Combine one horizontal indicator (left, center, right) and one vertical indicator (top, middle, bottom).
* Default is 'center middle'
* @var {String}
*/
anchorPosition: 'center middle',
/**
* Flag indicating whether to hide the elements under the balloon in IE.
* Setting this to false can cause rendering issues in Internet Explorer
* as some elements appear on top of the balloon if they're not hidden.
* Default is true.
* @var {Boolean}
*/
hideUnderElementsInIE: true
};
/**
* HelpBalloonElements
* Helper class for defining elements for the HelpBalloon object
* @author Beau D. Scott <beau_scott@hotmail.com>
*/
var HelpBalloonElements = Class.create();
HelpBalloonElements.prototype = {
/**
* @constructor
*/
initialize: function(){},
/**
* Containing element of the balloon
* @var {Element}
*/
container: null,
/**
* Inner content container
* @var {Element}
*/
inner: null,
/**
* A reference to the anchoring element/icon
* @var {Element}
*/
icon: null,
/**
* Content container
* @var {Element}
*/
content: null,
/**
* Closing button element
* @var {Element}
*/
button: null,
/**
* The closer object. This can be the same as button, but could
* also be a div with a png loaded as the back ground, browser dependent.
* @var {Element}
*/
closer: null,
/**
* Title container
* @var {Element}
*/
title: null,
/**
* Background container (houses the balloon images
* @var {Element}
*/
bgContainer: null,
/**
* Array of balloon image references
* @var {Array}
*/
balloons: []
};

1122
fas/fas/static/js/effects.js vendored
View file

File diff suppressed because it is too large Load diff

91
fas/fas/static/js/prototype.improvements.js vendored
View file

@ -1,91 +0,0 @@
//
// Copyright (c) 2008 Beau D. Scott | http://www.beauscott.com
//
// Permission is hereby granted, free of charge, to any person
// obtaining a copy of this software and associated documentation
// files (the "Software"), to deal in the Software without
// restriction, including without limitation the rights to use,
// copy, modify, merge, publish, distribute, sublicense, and/or sell
// copies of the Software, and to permit persons to whom the
// Software is furnished to do so, subject to the following
// conditions:
//
// The above copyright notice and this permission notice shall be
// included in all copies or substantial portions of the Software.
//
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
// OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
// WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
// FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
// OTHER DEALINGS IN THE SOFTWARE.
//
/**
* Prototype Improvements v0.1
* Various additions to the prototype.js
*/
Object.extend(Event, {
KEY_SHIFT: 16,
KEY_CONTROL: 17,
KEY_CAPSLOCK: 20,
KEY_SPACE: 32,
keyPressed: function(event)
{
return Browser.isMSIE() ? window.event.keyCode : event.which;
}
});
Browser = {
/**
* Returns the user agent
* @param {bool} useAlert
*/
inspect: function(useAlert)
{
if(useAlert)
alert(navigator.userAgent);
else
return navigator.userAgent;
},
/**
* Returns true if browser is MS Internet Explorer
*/
isMSIE: function()
{
return (navigator.userAgent.toLowerCase().indexOf("msie") > -1) && !this.isOpera();
},
/**
* Returns true if browser is Opera
*/
isOpera: function()
{
return navigator.userAgent.toLowerCase().indexOf("opera") > -1;
},
/**
* Returns true if browzer is Mozilla
*/
isMozilla: function()
{
return (navigator.userAgent.toLowerCase().indexOf("mozilla") > -1) && !this.isOpera() && !this.isMSIE();
}
}
Object.genGUID = function()
{
var len = 8;
if(!isNaN(parseInt(arguments[0]))) len = parseInt(arguments[0]);
var chars = "abcdef0123456789";
var output = "";
while(output.length < len)
{
var rnd = Math.floor(Math.random() * (chars.length - 1));
output += chars.charAt(rnd);
}
return output;
}

4221
fas/fas/static/js/prototype.js vendored
View file

File diff suppressed because it is too large Load diff

58
fas/fas/static/js/scriptaculous.js
View file

@ -1,58 +0,0 @@
// script.aculo.us scriptaculous.js v1.8.1, Thu Jan 03 22:07:12 -0500 2008
// Copyright (c) 2005-2007 Thomas Fuchs (http://script.aculo.us, http://mir.aculo.us)
//
// Permission is hereby granted, free of charge, to any person obtaining
// a copy of this software and associated documentation files (the
// "Software"), to deal in the Software without restriction, including
// without limitation the rights to use, copy, modify, merge, publish,
// distribute, sublicense, and/or sell copies of the Software, and to
// permit persons to whom the Software is furnished to do so, subject to
// the following conditions:
//
// The above copyright notice and this permission notice shall be
// included in all copies or substantial portions of the Software.
//
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
// LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
//
// For details, see the script.aculo.us web site: http://script.aculo.us/
var Scriptaculous = {
Version: '1.8.1',
require: function(libraryName) {
// inserting via DOM fails in Safari 2.0, so brute force approach
document.write('<script type="text/javascript" src="'+libraryName+'"><\/script>');
},
REQUIRED_PROTOTYPE: '1.6.0',
load: function() {
function convertVersionString(versionString){
var r = versionString.split('.');
return parseInt(r[0])*100000 + parseInt(r[1])*1000 + parseInt(r[2]);
}
if((typeof Prototype=='undefined') ||
(typeof Element == 'undefined') ||
(typeof Element.Methods=='undefined') ||
(convertVersionString(Prototype.Version) <
convertVersionString(Scriptaculous.REQUIRED_PROTOTYPE)))
throw("script.aculo.us requires the Prototype JavaScript framework >= " +
Scriptaculous.REQUIRED_PROTOTYPE);
$A(document.getElementsByTagName("script")).findAll( function(s) {
return (s.src && s.src.match(/scriptaculous\.js(\?.*)?$/))
}).each( function(s) {
var path = s.src.replace(/scriptaculous\.js(\?.*)?$/,'');
var includes = s.src.match(/\?.*load=([a-z,]*)/);
(includes ? includes[1] : 'builder,effects,dragdrop,controls,slider,sound').split(',').each(
function(include) { Scriptaculous.require(path+include+'.js') });
});
}
}
Scriptaculous.load();

2
fas/fas/static/robots.txt
View file

@ -1,2 +0,0 @@
User-agent: *
Disallow: /

494
fas/fas/static/theme/fas/css/style.css
View file

@ -1,494 +0,0 @@
*
{
margin: 0;
padding: 0;
}
body
{
font-size: 76%;
background: #FFFFFF;
}
a
{
text-decoration: none;
}
#wrapper
{
font: normal 2ex/1.5 sans-serif;
}
#head
{
overflow: hidden;
margin-top: 35px;
height: 70px;
line-height: 70px;
background: url(../images/head.png) 0 0 repeat-x;
}
#head h1
{
width: 250px;
float: left;
text-indent: -9999px;
overflow: hidden;
background: url(../images/logo.png) 1ex 50% no-repeat;
}
#searchbox
{
width: 36ex;
float: right;
text-align: right;
margin-right: 2ex;
}
#searchbox label
{
display: none;
}
#searchbox input
{
display: inline;
border: 1px solid #CCCCCC;
}
#searchbox #q
{
width: 20ex;
}
#topnav
{
height: 30px;
line-height: 30px;
background: url(../images/topnav.png) 0 0 repeat-x;
font-size: 1.6ex;
}
#topnav ul
{
list-style: none;
text-align: center;
}
#topnav ul li
{
display: inline;
background: url(../images/topnav-separator.png) 0 50% no-repeat;
padding-left: 3px;
}
#topnav ul li.first
{
background: none;
}
#topnav a
{
color: #445566;
margin: 0 2ex;
}
#topnav a:hover
{
color: #000000;
}
#infobar
{
position: absolute;
top: 0;
left: 0;
right: 0;
height: 35px;
line-height: 35px;
background: url(../images/infobar.png) 0 0 repeat-x;
font-size: 1.6ex;
}
#authstatus
{
width: 40ex;
float: left;
color: #FFFFFF;
padding-left: 1.5ex;
}
#authstatus strong
{
color: #DED6A1;
}
#control
{
width: 40ex;
float: right;
margin-right: 1ex;
}
#control ul
{
list-style: none;
text-align: right;
}
#control ul li
{
display: inline;
background: url(../images/control-separator.png) 0 50% no-repeat;
}
#control a
{
color: #DED6A1;
margin: 0 1.5ex;
}
#main
{
background: url(../images/shadow.png) 0 0 repeat-x;
}
#sidebar
{
width: 22ex;
float: left;
background: #335F9D url(../images/sidebar.png) 0 0 repeat-x;
border: 1px solid #112233;
}
#sidebar ul
{
list-style: none;
}
#sidebar li
{
border-top: 1px solid #CCCCCC;
}
#sidebar li.first
{
border-top: none;
}
#sidebar a
{
display: block;
text-align: center;
color: #FFFFFF;
padding: 0.5ex 0;
}
#sidebar a:hover
{
background: #082C59;
}
#language
{
padding: 1ex;
}
#language label
{
color: #FFFFFF;
}
#language input
{
width: 4ex;
}
#content
{
margin-left: 22ex;
padding: 2ex 4ex;
}
#content h2
{
/* header icon */
}
#content h3
{
font-size: 2.2ex;
margin-bottom: 0.25ex;
}
#content a
{
color: #0C6ED0;
}
.userbox
{
}
.userbox dt
{
width: 20ex;
float: left;
text-align: right;
font-weight: bold;
}
.userbox dd
{
margin-left: 24ex;
}
.account
{
padding-left: 30px;
background: url(../images/account.png) 0 68% no-repeat;
}
.approved
{
padding-left: 20px;
background: url(../images/approved.png) 0 68% no-repeat;
}
.unapproved
{
padding-left: 20px;
background: url(../images/unapproved.png) 0 68% no-repeat;
}
.attn
{
padding-left: 20px;
background: url(../images/attn.png) 0 68% no-repeat;
}
.roleslist
{
list-style: none;
margin: 0 2ex;
}
.roleslist li
{
margin-left: 0.5ex;
}
.actions
{
margin-top: 1.5ex;
list-style: none;
}
.actions li
{
/*
* TODO: Add icons
*/
}
#rolespanel
{
list-style: none;
}
#rolespanel li.role
{
border-top: 2px solid #EEEEEE;
margin-top: 1ex;
padding-top: 1ex;
padding-left: 22px;
background: url(../images/arrow.png) 0 1.6ex no-repeat;
}
#rolespanel h4
{
display: inline;
}
#rolespanel dt
{
width: 10ex;
float: left;
text-align: right;
margin-bottom: 1ex;
}
#rolespanel dd
{
margin-left: 12ex;
margin-bottom: 1ex;
}
#rolespanel .tools, #rolespanel .queue
{
list-style: none;
}
#rolespanel .tools li
{
padding-left: 22px;
background: url(../images/tools.png) 0 50% no-repeat;
}
#rolespanel .queue li
{
padding-left: 22px;
background: url(../images/queue.png) 0 50% no-repeat;
}
#rolespanel .queue strong
{
color: #222222;
}
#footer
{
font-size: 1.6ex;
clear: both;
text-align: center;
padding: 15px 0 2.5ex;
background: url(../images/footer-top.png) 0 0 repeat-x;
}
#footer .copy, #footer .disclaimer
{
font-size: 1.5ex;
}
#footlinks
{
padding-top: 3px;
padding-bottom: 18px;
background: #EEEEEE url(../images/footer-bottom.png) 0 100% repeat-x;
list-style: none;
}
#footlinks li
{
display: inline;
border-left: 1px solid #CCCCCC;
padding-left: 1px;
}
#footlinks li.first
{
padding-left: 0;
border-left: none;
}
#footlinks a
{
margin: 0 2ex;
color: #3465A4;
}
.flash
{
background: #DEE6B1 url(../images/success.png) 10px 50% no-repeat;
border: 1px solid #CCBBAA;
padding: 1.5ex 15px 1.5ex 43px;
margin: 1ex 0;
}
.help
{
background: #DEE6B1 url(../images/help.png) 10px 50% no-repeat;
border: 1px solid #CCBBAA;
padding: 1.5ex 15px 1.5ex 65px;
margin: 1ex 0;
}
.letters
{
list-style: none;
}
.letters li
{
display: inline;
margin-right: 1ex;
}
#content table
{
border-collapse: collapse;
}
#content table th, #content table td
{
padding: 0 2ex;
border: 1px solid #CCCCCC;
}
pre
{
font-size: 3ex;
}
form
{
list-style: none;
margin: 1ex 0!important;
}
form .field
{
margin: 0 0 1ex;
text-align: left;
overflow: hidden;
}
form .field label
{
float: left;
clear: left;
width: 16ex;
text-align: right;
padding: 0 2ex 0 0;
}
form .field input, form .field textarea
{
margin: 0;
}
.message p
{
margin: 1ex 0;
font-size: 3ex;
font-family: monospace;
}
#cla
{
border: 1px solid #AAAAAA;
background: #EEEEEE;
padding: 2ex;
}
#cla p
{
margin: 2ex 0;
}
#cla ol {
list-style-type: decimal;
margin-left: 3ex;
}
#cla ol ol
{
list-style: upper-alpha;
}
#cla ol li
{
margin: 2ex 0;
}

BIN
fas/fas/static/theme/fas/images/account.png
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 1.3 KiB

BIN
fas/fas/static/theme/fas/images/approved.png
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 422 B

BIN
fas/fas/static/theme/fas/images/arrow.png
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 548 B

BIN
fas/fas/static/theme/fas/images/attn.png
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 610 B

BIN
fas/fas/static/theme/fas/images/control-separator.png
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 172 B

BIN
fas/fas/static/theme/fas/images/favicon.ico
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 3.6 KiB

BIN
fas/fas/static/theme/fas/images/footer-bottom.png
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 154 B

BIN
fas/fas/static/theme/fas/images/footer-top.png
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 143 B

BIN
fas/fas/static/theme/fas/images/head.png
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 169 B

BIN
fas/fas/static/theme/fas/images/header-icon_account.png
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 1.3 KiB

BIN
fas/fas/static/theme/fas/images/header_inner.png
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 37 KiB

BIN
fas/fas/static/theme/fas/images/help.png
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 3.5 KiB

BIN
fas/fas/static/theme/fas/images/hr.png
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 193 B

BIN
fas/fas/static/theme/fas/images/icon_tool-item.png
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 272 B

BIN
fas/fas/static/theme/fas/images/icon_warning.png
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 573 B

BIN
fas/fas/static/theme/fas/images/info.png
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 2.8 KiB

BIN
fas/fas/static/theme/fas/images/infobar.png
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 194 B

BIN
fas/fas/static/theme/fas/images/logo.png
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 4.9 KiB

BIN
fas/fas/static/theme/fas/images/ok.png
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 25 KiB

BIN
fas/fas/static/theme/fas/images/queue.png
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 175 B

BIN
fas/fas/static/theme/fas/images/shadow.png
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 163 B

BIN
fas/fas/static/theme/fas/images/sidebar.png
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 230 B

BIN
fas/fas/static/theme/fas/images/status_approved.png
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 427 B

BIN
fas/fas/static/theme/fas/images/status_incomplete.png
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 215 B

BIN
fas/fas/static/theme/fas/images/status_rejected.png
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 435 B

BIN
fas/fas/static/theme/fas/images/success.png
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 1.9 KiB

BIN
fas/fas/static/theme/fas/images/tg_under_the_hood.png
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 3.9 KiB

BIN
fas/fas/static/theme/fas/images/tools.png
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 314 B

BIN
fas/fas/static/theme/fas/images/topnav-separator.png
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 209 B

BIN
fas/fas/static/theme/fas/images/topnav.png
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 197 B

BIN
fas/fas/static/theme/fas/images/unapproved.png
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 409 B

BIN
fas/fas/static/theme/fas/images/under_the_hood_blue.png
View file

Binary file not shown.
Side by side

Before

Width:  |  Height:  |  Size: 2.6 KiB

0
fas/fas/templates/__init__.py
View file

17
fas/fas/templates/about.html
View file

@ -1,17 +0,0 @@
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:py="http://genshi.edgewall.org/"
xmlns:xi="http://www.w3.org/2001/XInclude">
<xi:include href="master.html" />
<head>
<title>${_('About FAS')}</title>
</head>
<body>
<h2>${_('FAS - The Open Account System')}</h2>
<p>${_('''FAS is designed around an open architecture. Unlike the traditional account systems where a single admin or group of admins decide who gets to be in what group, FAS is completely designed to be self operating per team. Every group is given at least one administrator who can then approve other people in the group. Also, unlike traditional account systems. FAS allows people to apply for the groups they want to be in. This paridigm is interesting as it allows anyone to find out who is in what groups and contact them. This openness is brought over from the same philosophies that make Open Source popular.''')}</p>
<h2>${_('Etiquette')}</h2>
<p>${_("People shouldn't assume that by applying for a group that they're then in that group. Consider it like applying for another job. It often takes time. For best odds of success, learn about the group you're applying for and get to know someone in the group. Find someone with sponsor or admin access and ask them if they'd have time to mentor you. Plan on spending at least a few days learning about the group, doing a mundain task, participating on the mailing list. Sometimes this process can take weeks depending on the group. It's best to know you will get sponsored before you apply.")}</p>
<h2>${_('Users, Sponsors, Administrators')}</h2>
<p>${_('''Once you're in the group, you're in the group. Sponsorship and Administrators typically have special access in the group in questions. Some groups consider sponsorship level to be of a higher involvement, partial ownership of the group for example. But as far as the account system goes the disctinction is easy. Sponsors can approve new users and make people into sponsors. They cannot, however, downgrade or remove other sponsors. They also cannot change administrators in any way. Administrators can do anything to anyone in the group.''')}</p>
</body>
</html>

0
fas/fas/templates/cla/__init__.py
View file

82
fas/fas/templates/cla/cla.html
View file

@ -1,82 +0,0 @@
<div id="cla" xml:lang="en">
<h3>The Fedora Project
Individual Contributor License Agreement (CLA)
</h3>
<a href="http://fedoraproject.org/wiki/Legal/Licenses/CLA">http://fedoraproject.org/wiki/Legal/Licenses/CLA</a>
<p>
Thank you for your interest in The Fedora Project (the "Project"). In order to clarify the intellectual property license granted with Contributions from any person or entity, Red hat, Inc. ("Red Hat"), as maintainer of the Project, must have a Contributor License Agreement (CLA) on file that has been signed by each Contributor, indicating agreement to the license terms below. This license is for Your protection as a Contributor as well as the protection of the Project and its users; it does not change your rights to use your own Contributions for any other purpose.
</p>
<p>
If you have not already done so, please complete an original signed Agreement. Use black ink, and hand-print or type the items other than the signature. Send the completed Agreement to
</p>
<address>
Fedora Project, c/o Red Hat, Inc.,<br />
Attn: Legal Affairs<br />
1801 Varsity Drive<br />
Raleigh, North Carolina, 27606 U.S.A.
</address>
<p>
If necessary, you may send it by facsimile to the Project at +1-919-754-3704 or e-mail a signed pdf copy of the document to fedora-legal@redhat.com. Please read this document carefully before signing and keep a copy for your records.
</p>
<p>
Full name: ${person.human_name}<br />
E-Mail: ${person.email}<br />
Address: ${person.postal_address}<br />
Telephone: ${person.telephone}
<!-- Facsimile: ${person.facsimile} -->
</p>
<p>
You and the Project hereby accept and agree to the following terms and conditions:
</p>
<ol>
<li>
Contributors and Contributions.
<ol>
<li>
The Project and any individual or legal entity that voluntarily submits to the Project a Contribution are collectively addressed herein as "Contributors". For legal entities, the entity making a Contribution and all other entities that control, are controlled by, or are under common control with that entity are considered to be a single Contributor. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity.
</li>
<li>
A "Contribution" is any original work, including any modification or addition to an existing work, that has been submitted for inclusion in, or documentation of, any of the products owned or managed by the Project, where such work originates from that particular Contributor or from some entity acting on behalf of that Contributor.
</li>
<li>
A Contribution is "submitted" when any form of electronic, verbal, or written communication is sent to the Project, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Project for the purpose of discussing or improving software or documentation of the Project, but excluding communication that is conspicuously marked or otherwise designated in writing by you as "Not a Contribution."
</li>
<li>
Any Contribution submitted by you to the Project shall be under the terms and conditions of this License, without any additional terms or conditions, unless you explicitly state otherwise in the submission.
</li>
</ol>
</li>
<li>
Contributor Grant of License. You hereby grant to Red Hat, Inc., on behalf of the Project, and to recipients of software distributed by the Project:
<ol>
<li>
a perpetual, non-exclusive, worldwide, fully paid-up, royalty free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute your Contribution and such derivative works; and,
</li>
<li>
a perpetual, non-exclusive, worldwide, fully paid-up, royalty free, irrevocable (subject to Section 3) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer your Contribution and derivative works thereof, where such license applies only to those patent claims licensable by you that are necessarily infringed by your Contribution alone or by combination of your Contribution with the work to which you submitted the Contribution. Except for the license granted in this section, you reserve all right, title and interest in and to your Contributions.
</li>
</ol>
</li>
<li>
Reciprocity. As of the date any such litigation is filed, your patent grant shall immediately terminate with respect to any party that institutes patent litigation against you (including a cross-claim or counterclaim in a lawsuit) alleging that your Contribution, or the work to which you have contributed, constitutes direct or contributory patent infringement.
</li>
<li>
You represent that you are legally entitled to grant the above license. If your employer(s) has rights to intellectual property that you create that includes your Contributions, you represent that you have received permission to make Contributions on behalf of that employer, that your employer has waived such rights for your Contributions to the Project, or that your employer has executed a separate Corporate CLA with the Project.
</li>
<li>
You represent that each of your Contributions is your original creation (see section 7 for submissions on behalf of others). You represent that your Contribution submission(s) include complete details of any third-party license or other restriction (including, but not limited to, related copyright, atents and trademarks) of which you are personally aware and which are associated with any part of your Contribution.
</li>
<li>
You are not expected to provide support for your Contributions, except to the extent you desire to provide support. You may provide support for free, for a fee, or not at all. Your Contributions are provided on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE.
</li>
<li>
Should you wish to submit work that is not your original creation, you may submit it to the Project separately from any Contribution, identifying the complete details of its source and of any license or other restriction (including, but not limited to, related patents, trademarks, and license agreements) of which you are personally aware, and conspicuously marking the work as "Submitted on behalf of a third-party: [named here]".
</li>
<li>
You agree to notify the Project of any facts or circumstances of which you become aware that would make these representations inaccurate in any respect.
</li>
<li>
The Project is under no obligations to accept and include every contribution.
</li>
</ol>
</div>

145
fas/fas/templates/cla/cla.txt
View file

@ -1,145 +0,0 @@
The Fedora Project
Individual Contributor License Agreement (CLA)
http://fedoraproject.org/wiki/Legal/Licenses/CLA
Thank you for your interest in The Fedora Project (the
"Project"). In order to clarify the intellectual property license
granted with Contributions from any person or entity, Red hat,
Inc. ("Red Hat"), as maintainer of the Project, must have a
Contributor License Agreement (CLA) on file that has been signed
by each Contributor, indicating agreement to the license terms
below. This license is for Your protection as a Contributor as
well as the protection of the Project and its users; it does not
change your rights to use your own Contributions for any other
purpose.
If you have not already done so, please complete an original signed
Agreement. Use black ink, and hand-print or type the items other than
the signature. Send the completed Agreement to
Fedora Project, c/o Red Hat, Inc.,
Attn: Legal Affairs
1801 Varsity Drive
Raleigh, North Carolina, 27606 U.S.A.
If necessary, you may send it by facsimile to the Project at
+1-919-754-3704 or e-mail a signed pdf copy of the document to
fedora-legal@redhat.com. Please read this document carefully before
signing and keep a copy for your records.
Full name: ${person.human_name} E-Mail: ${person.email}
Address:
${person.postal_address}
Telephone: ${person.telephone}
Facsimile: ${person.facsimile}
You and the Project hereby accept and agree to the following terms and conditions:
1. Contributors and Contributions.
A. The Project and any individual or legal entity that
voluntarily submits to the Project a Contribution are
collectively addressed herein as "Contributors". For legal
entities, the entity making a Contribution and all other
entities that control, are controlled by, or are under common
control with that entity are considered to be a single
Contributor. For the purposes of this definition, "control"
means (i) the power, direct or indirect, to cause the direction
or management of such entity, whether by contract or otherwise,
or (ii) ownership of fifty percent (50%) or more of the
outstanding shares, or (iii) beneficial ownership of such
entity.
B. A "Contribution" is any original work, including any
modification or addition to an existing work, that has been
submitted for inclusion in, or documentation of, any of the
products owned or managed by the Project, where such work
originates from that particular Contributor or from some entity
acting on behalf of that Contributor.
C. A Contribution is "submitted" when any form of electronic,
verbal, or written communication is sent to the Project,
including but not limited to communication on electronic
mailing lists, source code control systems, and issue tracking
systems that are managed by, or on behalf of, the Project for
the purpose of discussing or improving software or
documentation of the Project, but excluding communication that
is conspicuously marked or otherwise designated in writing by
you as "Not a Contribution."
D. Any Contribution submitted by you to the Project shall be
under the terms and conditions of this License, without any
additional terms or conditions, unless you explicitly state
otherwise in the submission.
2. Contributor Grant of License. You hereby grant to Red Hat,
Inc., on behalf of the Project, and to recipients of software
distributed by the Project:
(a) a perpetual, non-exclusive, worldwide, fully paid-up,
royalty free, irrevocable copyright license to reproduce,
prepare derivative works of, publicly display, publicly
perform, sublicense, and distribute your Contribution and such
derivative works; and,
(b) a perpetual, non-exclusive, worldwide, fully paid-up,
royalty free, irrevocable (subject to Section 3) patent license
to make, have made, use, offer to sell, sell, import, and
otherwise transfer your Contribution and derivative works
thereof, where such license applies only to those patent claims
licensable by you that are necessarily infringed by your
Contribution alone or by combination of your Contribution with
the work to which you submitted the Contribution. Except for
the license granted in this section, you reserve all right,
title and interest in and to your Contributions.
3. Reciprocity. As of the date any such litigation is filed, your
patent grant shall immediately terminate with respect to any
party that institutes patent litigation against you (including
a cross-claim or counterclaim in a lawsuit) alleging that your
Contribution, or the work to which you have contributed,
constitutes direct or contributory patent infringement.
4. You represent that you are legally entitled to grant the above
license. If your employer(s) has rights to intellectual
property that you create that includes your Contributions, you
represent that you have received permission to make
Contributions on behalf of that employer, that your employer
has waived such rights for your Contributions to the Project,
or that your employer has executed a separate Corporate CLA
with the Project.
5. You represent that each of your Contributions is your original
creation (see section 7 for submissions on behalf of others).
You represent that your Contribution submission(s) include
complete details of any third-party license or other
restriction (including, but not limited to, related copyright,
atents and trademarks) of which you are personally aware and
which are associated with any part of your Contribution.
6. You are not expected to provide support for your Contributions,
except to the extent you desire to provide support. You may
provide support for free, for a fee, or not at all. Your
Contributions are provided on an "AS IS" BASIS, WITHOUT
WARRANTIES OR CONDITIONS OF ANY KIND, either express or
implied, including, without limitation, any warranties or
conditions of NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR
A PARTICULAR PURPOSE.
7. Should you wish to submit work that is not your original
creation, you may submit it to the Project separately from any
Contribution, identifying the complete details of its source
and of any license or other restriction (including, but not
limited to, related patents, trademarks, and license
agreements) of which you are personally aware, and
conspicuously marking the work as "Submitted on behalf of a
third-party: [named here]".
8. You agree to notify the Project of any facts or circumstances
of which you become aware that would make these representations
inaccurate in any respect.
9. The Project is under no obligations to accept and include every contribution.

26
fas/fas/templates/cla/index.html
View file

@ -1,26 +0,0 @@
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:py="http://genshi.edgewall.org/"
xmlns:xi="http://www.w3.org/2001/XInclude">
<xi:include href="../master.html" />
<head>
<title>${_('Fedora Accounts System')}</title>
</head>
<body>
<h2>${_('Fedora Contributor License Agreement')}</h2>
${Markup(_('&lt;a href="%(url)s"&gt;Text Version&lt;/a&gt;') % {'url': tg.url('/cla/text')})}
<xi:include href="cla.html" />
${Markup(_('&lt;a href="%(url)s"&gt;Text Version&lt;/a&gt;') % {'url': tg.url('/cla/text')})}
<p py:if="cla">
${Markup(_('You have already sucessfully complete the CLA.') % {'url': tg.url('/cla/text')})}
</p>
<py:if test="not cla">
<form action="${tg.url('/cla/send')}" method="post">
<div>
<input type="submit" id="agree" name="agree" value="${_('I agree')}" />
<input type="submit" value="${_('I do not agree')}" />
</div>
</form>
</py:if>
</body>
</html>

25
fas/fas/templates/error.html
View file

@ -1,25 +0,0 @@
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:py="http://genshi.edgewall.org/"
xmlns:xi="http://www.w3.org/2001/XInclude">
<xi:include href="master.html" />
<head>
<title>${_('Fedora Accounts System')}</title>
<style type="text/css">
#content ul
{
list-style: square;
margin: 1ex 3ex;
}
</style>
</head>
<body>
<h2>${_('Error!')}</h2>
<p>${_('The following error(s) have occured with your request:')}</p>
<ul>
<li py:for="field, error in tg_errors.items()">
${field}: ${str(error)}
</li>
</ul>
</body>
</html>

0
fas/fas/templates/group/__init__.py
View file

3
fas/fas/templates/group/dump.txt
View file

@ -1,3 +0,0 @@
#for person in sorted(people)
${person.username},${person.email},${person.human_name},user,0
#end

55
fas/fas/templates/group/edit.html
View file

@ -1,55 +0,0 @@
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:py="http://genshi.edgewall.org/"
xmlns:xi="http://www.w3.org/2001/XInclude">
<xi:include href="../master.html" />
<head>
<title>${_('Edit Group')}</title>
</head>
<body>
<h2>${_('Edit Group: %s') % group.name}</h2>
<form action="${tg.url('/group/save/%s' % group.name)}" method="post">
<div class="field">
<label for="display_name">${_('Display Name:')}</label>
<input type="text" id="display_name" name="display_name" value="${group.display_name}" />
<script type="text/javascript">var group_name = new HelpBalloon({dataURL: '${tg.url('/help/get_help/group_name')}'});</script>
</div>
<div class="field">
<label for="group_type">${_('Group Type:')}</label>
<input type="text" id="group_type" name="group_type" value="${group.group_type}" />
<script type="text/javascript">var group_type = new HelpBalloon({dataURL: '${tg.url('/help/get_help/group_type')}'});</script>
</div>
<div class="field">
<label for="owner">${_('Group Owner:')}</label>
<input type="text" id="owner" name="owner" value="${group.owner.username}" />
<script type="text/javascript">var group_owner = new HelpBalloon({dataURL: '${tg.url('/help/get_help/group_owner')}'});</script>
</div>
<div class="field">
<label for="needs_sponsor">${_('Needs Sponsor:')}</label>
<input py:if="group.needs_sponsor" type="checkbox" id="needs_sponsor" name="needs_sponsor" value="1" checked="checked" />
<input py:if="not group.needs_sponsor" type="checkbox" id="needs_sponsor" name="needs_sponsor" value="1" />
<script type="text/javascript">var group_needs_sponsor = new HelpBalloon({dataURL: '${tg.url('/help/get_help/group_needs_sponsor')}'});</script>
</div>
<div class="field">
<label for="user_can_remove">${_('Self Removal:')}</label>
<input py:if="group.user_can_remove" type="checkbox" id="user_can_remove" name="user_can_remove" value="1" checked="checked" />
<input py:if="not group.user_can_remove" type="checkbox" id="user_can_remove" name="user_can_remove" value="1" />
&nbsp;<script type="text/javascript">var group_self_removal = new HelpBalloon({dataURL: '${tg.url('/help/get_help/group_self_removal')}'});</script>
</div>
<div class="field">
<label for="prerequisite">${_('Group Prerequisite:')}</label>
<input py:if="group.prerequisite" type="text" id="prerequisite" name="prerequisite" value="${group.prerequisite.name}" />
<input py:if="not group.prerequisite" type="text" id="prerequisite" name="prerequisite" />
&nbsp;<script type="text/javascript">var group_prerequisite = new HelpBalloon({dataURL: '${tg.url('/help/get_help/group_prerequisite')}'});</script>
</div>
<div class="field">
<label for="joinmsg">${_('Group Join Message:')}</label>
<textarea id="joinmsg" name="joinmsg">${group.joinmsg}</textarea>
<script type="text/javascript">var group_join_message = new HelpBalloon({dataURL: '${tg.url('/help/get_help/group_join_message')}'});</script>
</div>
<div class="field">
<input type="submit" value="${_('Save!')}" />
</div>
</form>
</body>
</html>

43
fas/fas/templates/group/invite.html
View file

@ -1,43 +0,0 @@
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:py="http://genshi.edgewall.org/"
xmlns:xi="http://www.w3.org/2001/XInclude">
<xi:include href="../master.html" />
<head>
<title>${_('Invite a new community member!')}</title>
</head>
<body>
<h2>${_('Invite a new community member!')}</h2>
<form method="post" action="${tg.url('/group/sendinvite/%s') % group.name}">
<div>
<!--TODO: Make the email translatable -->
${_('To email:')} <input type="text" value="" name="target" /><br />
${_('From:')} ${person.email}<br />
${_('Subject:')} Invitation to join the Fedora Team!<br />
${_('Message:')}
<div class="message">
<p>
${person.human_name} &lt;<a href="mailto: ${person.email}">${person.email}</a>&gt; has invited you to join the Fedora
Project! We are a community of users and developers who produce a
complete operating system from entirely free and open source software
(FOSS). ${person.human_name} thinks that you have knowledge and skills
that make you a great fit for the Fedora community, and that you might
be interested in contributing.
</p>
<p>
How could you team up with the Fedora community to use and develop your
skills? Check out http://fedoraproject.org/join-fedora for some ideas.
Our community is more than just software developers -- we also have a
place for you whether you're an artist, a web site builder, a writer, or
a people person. You'll grow and learn as you work on a team with other
very smart and talented people.
</p>
<p>
Fedora and FOSS are changing the world -- come be a part of it!
</p>
</div>
<input type="submit" value="${_('Send!')}" />
</div>
</form>
</body>
</html>

54
fas/fas/templates/group/list.html
View file

@ -1,54 +0,0 @@
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:py="http://genshi.edgewall.org/"
xmlns:xi="http://www.w3.org/2001/XInclude">
<xi:include href="../master.html" />
<head>
<title>${_('Groups List')}</title>
</head>
<body>
<?python
from fas.model import Groups, People
person = People.by_username(tg.identity.user.username)
?>
<span py:if="Groups.by_name('accounts') in person.approved_memberships">
<h2>Create New Group</h2>
<a href="${tg.url('/group/new')}">Create Group</a>
</span>
<h2>${_('List (%s)') % search}</h2>
<h3>${_('Search Groups')}</h3>
<form method="get" action="${tg.url('/group/list')}">
<p>${_('"*" is a wildcard (Ex: "cvs*")')}</p>
<div>
<input type="text" value="${search}" name="search" size="15 "/>
<input type="submit" value="${_('Search')}" />
</div>
</form>
<h3>${_('Results')}</h3>
<ul class="letters">
<li py:for="letter in 'abcdefghijklmnopqrstuvwxyz'.upper()"><a href="${tg.url('/group/list/%s*' % letter)}">${letter}</a></li>
<li><a href="${tg.url('/group/list/*')}">${_('All')}</a></li>
</ul>
<table py:if="groups">
<thead>
<tr><th>${_('Group')}</th><th>${_('Description')}</th><th>${_('Status')}</th></tr>
</thead>
<tbody>
<tr py:for="group in groups">
<td><a href="${tg.url('/group/view/%s' % group.name)}">${group.name}</a></td>
<td>${ group.display_name }</td>
<td>
<a py:if="group in person.memberships" href="${tg.url('/group/view/%s' % group.name)}">
<span class="approved" py:if="group in person.approved_memberships">${_('Approved')}</span>
<span class="unapproved" py:if="group in person.unapproved_memberships">${_('Unapproved')}</span>
</a>
<a py:if="group not in person.memberships" href="${tg.url('/group/apply/%s/%s' % (group.name, person.username))}"><span>${_('Apply')}</span></a>
<script py:if="group not in person.memberships" type="text/javascript">var hb1 = new HelpBalloon({dataURL: '${tg.url('/help/get_help/group_apply')}'});</script>
</td>
</tr>
</tbody>
</table>
</body>
</html>

57
fas/fas/templates/group/new.html
View file

@ -1,57 +0,0 @@
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:py="http://genshi.edgewall.org/"
xmlns:xi="http://www.w3.org/2001/XInclude">
<xi:include href="../master.html" />
<head>
<title>${_('Create a new FAS Group')}</title>
</head>
<body>
<h2>${_('Create a new FAS Group')}</h2>
<form action="${tg.url('/group/create')}" method="post">
<div class="field">
<label for="name">${_('Group Name:')}</label>
<input type="text" id="name" name="name" />
<script type="text/javascript">var group_name = new HelpBalloon({dataURL: '${tg.url('/help/get_help/group_name')}'});</script>
</div>
<div class="field">
<label for="display_name">${_('Display Name:')}</label>
<input type="text" id="display_name" name="display_name" />
<script type="text/javascript">var group_display_name = new HelpBalloon({dataURL: '${tg.url('/help/get_help/group_display_name')}'});</script>
</div>
<div class="field">
<label for="owner">${_('Group Owner:')}</label>
<input type="text" id="owner" name="owner" />
<script type="text/javascript">var group_owner = new HelpBalloon({dataURL: '${tg.url('/help/get_help/group_owner')}'});</script>
</div>
<div class="field">
<label for="group_type">${_('Group Type:')}</label>
<input type="text" id="group_type" name="group_type" value="tracking" />
<script type="text/javascript">var group_type = new HelpBalloon({dataURL: '${tg.url('/help/get_help/group_type')}'});</script>
</div>
<div class="field">
<label for="needs_sponsor">${_('Needs Sponsor:')}</label>
<input type="checkbox" id="needs_sponsor" name="needs_sponsor" value="1" checked="checked" />&nbsp;
<script type="text/javascript">var group_needs_sponsor = new HelpBalloon({dataURL: '${tg.url('/help/get_help/group_needs_sponsor')}'});</script>
</div>
<div class="field">
<label for="user_can_remove">${_('Self Removal:')}</label>
<input type="checkbox" id="user_can_remove" name="user_can_remove" value="1" checked="checked" />&nbsp;
<script type="text/javascript">var group_self_removal = new HelpBalloon({dataURL: '${tg.url('/help/get_help/group_self_removal')}'});</script>
</div>
<div class="field">
<label for="prerequisite">${_('Must Belong To:')}</label>
<input type="text" id="prerequisite" name="prerequisite" value="cla_done" />
<script type="text/javascript">var group_prerequisite = new HelpBalloon({dataURL: '${tg.url('/help/get_help/group_prerequisite')}'});</script>
</div>
<div class="field">
<label for="joinmsg">${_('Join Message:')}</label>
<textarea id="joinmsg" name="joinmsg"></textarea>
<script type="text/javascript">var group_join_message = new HelpBalloon({dataURL: '${tg.url('/help/get_help/group_join_message')}'});</script>
</div>
<div class="field">
<input type="submit" value="${_('Create!')}" />
</div>
</form>
</body>
</html>

123
fas/fas/templates/group/view.html
View file

@ -1,123 +0,0 @@
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:py="http://genshi.edgewall.org/"
xmlns:xi="http://www.w3.org/2001/XInclude">
<xi:include href="../master.html" />
<head>
<title>${_('View Group')}</title>
</head>
<body>
<?python
from fas import auth
from fas.model import People
import pytz
person = People.by_username(tg.identity.user.username)
timezone = pytz.timezone(person.timezone)
can_admin = auth.canAdminGroup(person, group)
can_sponsor = auth.canSponsorGroup(person, group)
?>
<h2>${group.display_name} (${group.name})</h2>
<h3>
${_('My Status:')}
<span py:if="group in person.memberships and group in person.approved_memberships" class="approved">${_('Approved')}</span>
<span py:if="group in person.memberships and not group in person.approved_memberships" class="unapproved">${_('Unapproved')}</span>
<span py:if="not group in person.memberships">${_('Not a Member')}</span>
</h3>
<form py:if="not group in person.memberships" action="${tg.url('/group/apply/%s/%s' % (group.name, person.username))}">
<div>
<!--<input type="text" name="requestField" value="${_('Please let me join...')}" />-->
<input type="submit" value="${('Apply!')}" />
</div>
</form>
<a py:if="group in person.memberships" href="${tg.url('/group/remove/%s/%s' % (group.name, person.username))}">${_('Remove me')}</a>
<script py:if="group in person.memberships" type="text/javascript">var hb7 = new HelpBalloon({dataURL: '${tg.url('/help/get_help/group_remove')}'});</script>
<h3>Group Details <a py:if="can_admin" href="${tg.url('/group/edit/%s' % group.name)}">${_('(edit)')}</a></h3>
<div class="userbox">
<dl>
<dt>${_('Name:')}</dt><dd>${group.name}&nbsp;</dd>
<dt>${_('Description:')}</dt><dd>${group.display_name}&nbsp;</dd>
<dt>${_('Owner:')}</dt><dd>${group.owner.username}&nbsp;</dd>
<dt>${_('Type:')}</dt><dd>${group.group_type}&nbsp;</dd>
<dt>${_('Needs Sponsor:')}</dt><dd>
<py:if test="group.needs_sponsor">${_('Yes')}</py:if>
<py:if test="not group.needs_sponsor">${_('No')}</py:if>
&nbsp;</dd>
<dt>${_('Self Removal:')}</dt><dd>
<py:if test="group.user_can_remove">${_('Yes')}</py:if>
<py:if test="not group.user_can_remove">${_('No')}</py:if>
&nbsp;</dd>
<dt>${_('Join Message:')}</dt><dd>${group.joinmsg}&nbsp;</dd>
<dt>${_('Prerequisite:')}</dt>
<dd py:if="group.prerequisite">${group.prerequisite.name}&nbsp;</dd>
<dd py:if="not group.prerequisite">&nbsp;</dd>
<dt>${_('Created:')}</dt><dd>${group.creation}&nbsp;</dd>
<py:if test="can_sponsor">
<dt>${_('Add User:')}</dt>
<dd>
<form action="${tg.url('/group/apply/%s' % group.name)}">
<input type='text' size='15' name='targetname'/>
<input type="submit" value="${('Add')}" />
<script type="text/javascript">var group_user_add = new HelpBalloon({dataURL: '${tg.url('/help/get_help/group_user_add')}'});</script>
</form>
</dd>
</py:if>
</dl>
</div>
<!--
TODO: Implement this :)
<h3 py:if='me.fedoraRoleStatus == "approved"'>${_('Invite')}</h3>
<span py:if='me.fedoraRoleStatus == "approved"'>${form(action='modifyGroup', value=value, method='get')}</span>
-->
<h3>${_('Members')}</h3>
<table>
<thead>
<tr>
<th>${_('Username')}</th>
<th>${_('Sponsor')}</th>
<th>${_('Date Added')}</th>
<th>${_('Date Approved')}</th>
<th>${_('Approval')}</th>
<th>${_('Role Type')}</th>
<th py:if="can_sponsor">${_('Action')}</th>
</tr>
</thead>
<tr py:for="role in sorted(group.roles, lambda x,y: cmp(x.member.username, y.member.username))">
<td><a href="${tg.url('/user/view/%s' % role.member.username)}">${role.member.username}</a></td>
<td py:if='role.sponsor'><a href="${tg.url('/user/view/%s' % role.sponsor.username)}">${role.sponsor.username}</a></td>
<td py:if='not role.sponsor'>${_('None')}</td>
<td>${role.creation.astimezone(timezone).strftime('%Y-%m-%d %H:%M:%S %Z')}</td>
<td py:if='role.approval'>${role.approval.astimezone(timezone).strftime('%Y-%m-%d %H:%M:%S %Z')}</td>
<td py:if='not role.approval'>${_('None')}</td>
<td>${role.role_status}</td>
<td>${role.role_type}</td>
<!-- This section includes all action items -->
<td py:if="can_sponsor">
<ul class="actions">
<li py:if="role.role_status == 'unapproved'">
<py:if test="group.needs_sponsor">
<a href="${tg.url('/group/sponsor/%s/%s' % (group.name, role.member.username))}">${_('Sponsor')}</a>
<script type="text/javascript">var hb1 = new HelpBalloon({dataURL: '${tg.url('/help/get_help/group_sponsor')}'});</script>
</py:if>
<py:if test="not group.needs_sponsor">
<a href="${tg.url('/group/sponsor/%s/%s' % (group.name, role.member.username))}">${_('Approve')}</a>
<script type="text/javascript">var hb2 = new HelpBalloon({dataURL: '${tg.url('/help/get_help/group_approve')}'});</script>
</py:if>
</li>
<li>
<a href="${tg.url('/group/remove/%s/%s' % (group.name, role.member.username))}">${_('Remove')}</a>
<script type="text/javascript">var hb3 = new HelpBalloon({dataURL: '${tg.url('/help/get_help/group_remove')}'});</script>
</li>
<li py:if="role.role_type != 'administrator' or auth.canDowngradeUser(person, group, role.member)">
<a href="${tg.url('/group/upgrade/%s/%s' % (group.name, role.member.username))}">${_('Upgrade')}</a>
<script type="text/javascript">var hb4 = new HelpBalloon({dataURL: '${tg.url('/help/get_help/group_upgrade')}'});</script>
</li>
<li py:if="role.role_type != 'user' or auth.canDowngradeUser(person, group, role.member)">
<a href="${tg.url('/group/downgrade/%s/%s' % (group.name, role.member.username))}">${_('Downgrade')}</a>
<script type="text/javascript">var hb5 = new HelpBalloon({dataURL: '${tg.url('/help/get_help/group_downgrade')}'});</script>
</li>
</ul>
</td>
</tr>
</table>
</body>
</html>

12
fas/fas/templates/help.html
View file

@ -1,12 +0,0 @@
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:py="http://genshi.edgewall.org/"
xmlns:xi="http://www.w3.org/2001/XInclude">
<head>
<title>${help[0]}</title>
</head>
<body>
${XML(help[1])}
</body>
</html>

33
fas/fas/templates/home.html
View file

@ -1,33 +0,0 @@
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:py="http://genshi.edgewall.org/"
xmlns:xi="http://www.w3.org/2001/XInclude">
<xi:include href="master.html" />
<head>
<title>${_('Fedora Accounts System')}</title>
</head>
<body>
<?python from fas import auth ?>
<h2>${_('Todo queue:')}</h2>
<py:for each="group in sorted(person.memberships)">
<py:if test="auth.canSponsorGroup(person, group) and group.unapproved_roles">
<dd>
<ul class="queue">
<li py:for="role in group.unapproved_roles[:5]">
${Markup(_('&lt;strong&gt;%(user)s&lt;/strong&gt; requests approval to join &lt;a href="group/view/%(group)s"&gt;%(group)s&lt;/a&gt;.') % {'user': role.member.username, 'group': group.name, 'group': group.name})}
</li>
</ul>
</dd>
</py:if>
</py:for>
<ul class="queue">
<li py:if="not cla" class="unapproved">${Markup(_('CLA not completed. To become a full Fedora Contributor please &lt;a href="%s"&gt;complete the CLA&lt;/a&gt;.') % tg.url('/cla/'))}</li>
<li py:if="not person.ssh_key">${Markup(_('You have not submitted an SSH key, some Fedora resources require an SSH key. Please submit yours by editing &lt;a href="%s"&gt;My Account&lt;/a&gt;') % tg.url('/user/edit'))}</li>
</ul>
<div>
<!-- TODO: Make this entire page more friendly -->
<a href="${tg.url('/user/gencert')}">${_('Download a client-side certificate')}</a>&nbsp;
<script type="text/javascript">var gencert = new HelpBalloon({dataURL: '${tg.url('/help/get_help/gencert')}'});</script>
</div>
</body>
</html>

33
fas/fas/templates/login.html
View file

@ -1,33 +0,0 @@
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:py="http://genshi.edgewall.org/"
xmlns:xi="http://www.w3.org/2001/XInclude">
<xi:include href="master.html" />
<head>
<title>${_('Login to the Fedora Accounts System')}</title>
<style type="text/css">
#content ul
{
list-style: square;
margin: 1ex 3ex;
}
</style>
</head>
<body>
<h2>${_('Login')}</h2>
<p>${message}</p>
<form action="${previous_url}" method="post">
<div class="field"><label for="user_name">${_('User Name:')}</label> <input type="text" id="user_name" name="user_name" /></div>
<div class="field"><label for="password">${_('Password:')}</label> <input type="password" id="password" name="password" /></div>
<div class="field">
<input type="submit" name="login" value="${_('Login')}" />
<input py:if="forward_url" type="hidden" name="forward_url" value="${tg.url(forward_url)}" />
<input py:for="name,value in original_parameters.items()" type="hidden" name="${name}" value="${value}" />
</div>
</form>
<ul>
<li><a href="${tg.url('/user/resetpass')}">${_('Forgot Password?')}</a></li>
<li><a href="${tg.url('/user/new')}">${_('Sign Up')}</a></li>
</ul>
</body>
</html>

106
fas/fas/templates/master.html
View file

@ -1,106 +0,0 @@
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:xi="http://www.w3.org/2001/XInclude"
xmlns:py="http://genshi.edgewall.org/"
py:strip="">
<?python
from turbogears import config
_ = lambda text: tg.gettext(text)
?>
<head py:match="head" py:attrs="select('@*')">
<link href="${tg.url('/static/theme/%s/css/style.css') % config.get('theme')}" rel="stylesheet" type="text/css" />
<link rel="shortcut icon" href="${tg.url('/static/theme/%s/images/favicon.ico' % config.get('theme'))}" type="image/vnd.microsoft.icon" />
<meta py:replace="select('*|text()')" />
<script type="text/javascript" src="${tg.url('/static/js/prototype.js')}"></script>
<script type="text/javascript" src="${tg.url('/static/js/prototype.improvements.js')}"></script>
<script type="text/javascript" src="${tg.url('/static/js/scriptaculous.js?load=effects')}"></script>
<script type="text/javascript" src="${tg.url('/static/js/HelpBalloon.js')}"></script>
</head>
<body py:match="body" py:attrs="select('@*')">
<div id="wrapper">
<div id="head">
<h1><a href="http://fedoraproject.org/">${_('Fedora')}</a></h1>
<!-- TODO: Make this do something useful, talk about interface :)
<div id="searchbox">
<form action="" method="get">
<label for="q">${_('Search:')}</label>
<input type="text" name="q" id="q" />
<input type="submit" value="${_('Search')}" />
</form>
</div>
-->
</div>
<div id="topnav">
<ul>
<li class="first"><a href="http://fedoraproject.org/">${_('Learn about Fedora')}</a></li>
<li><a href="http://fedoraproject.org/get-fedora.html">${_('Download Fedora')}</a></li>
<li><a href="http://fedoraproject.org/wiki/">${_('Projects')}</a></li>
<li><a href="http://fedoraproject.org/join-fedora.html">${_('Join Fedora')}</a></li>
<li><a href="http://fedoraproject.org/wiki/Communicate">${_('Communicate')}</a></li>
<li><a href="http://docs.fedoraproject.org/">${_('Help/Documentation')}</a></li>
</ul>
</div>
<div id="infobar">
<div id="authstatus">
<span py:if="not tg.identity.anonymous">
<strong>${_('Logged in:')}</strong> ${tg.identity.user.username}
</span>
</div>
<div id="control">
<ul>
<li><a href="${tg.url('/about')}">About</a></li>
<li py:if="not tg.identity.anonymous"><a href="${tg.url('/user/view/%s' % tg.identity.user.username)}">${_('My Account')}</a></li>
<li py:if="not tg.identity.anonymous"><a href="${tg.url('/logout')}">${_('Log Out')}</a></li>
<li py:if="tg.identity.anonymous"><a href="${tg.url('/login')}">${_('Log In')}</a></li>
</ul>
</div>
</div>
<div id="main">
<div id="sidebar">
<ul>
<li class="first"><a href="${tg.url('/home')}">${_('Home')}</a></li>
<div py:if="not tg.identity.anonymous and 'accounts' in tg.identity.groups" py:strip=''>
<!-- TODO: Make these use auth.py -->
<li><a href="${tg.url('/group/new')}">${_('New Group')}</a></li>
<li><a href="${tg.url('/user/list')}">${_('User List')}</a></li>
</div>
<li py:if="not tg.identity.anonymous"><a href="${tg.url('/group/list/A*')}">${_('Group List')}</a></li>
<li py:if="not tg.identity.anonymous"><a href="${tg.url('/group/list/A*')}">${_('Apply For a new Group')}</a></li>
<li><a href="http://fedoraproject.org/wiki/FWN/LatestIssue">${_('News')}</a></li>
</ul>
<div py:if="tg.identity.anonymous and tg.available_languages" id="language">
<!-- TODO: Should this be available to logged in users to (and actually change their DB entry?) -->
<form action="${tg.url('/language')}" method="get">
<label for="locale">${_('Locale:')}</label>
<select name="locale" id="locale">
<option py:for="language in tg.available_languages" value="${language}" py:attrs="{'selected': tg.lang == language and 'selected' or None}">${language}</option>
</select>
<input type="submit" value="${_('OK')}" />
</form>
</div>
</div>
<div id="content">
<div py:if="tg_flash" class="flash">
${tg_flash}
</div>
<div py:replace="select('*|text()')" />
</div>
<div id="footer">
<ul id="footlinks">
<li class="first"><a href="${tg.url('/about')}">${_('About')}</a></li>
<li><a href="http://fedoraproject.org/wiki/Communicate">${_('Contact Us')}</a></li>
<li><a href="http://fedoraproject.org/wiki/Legal">${_('Legal &amp; Privacy')}</a></li>
<!--<li><a href="/">Site Map</a></li>-->
<li><a href="${tg.url('/logout')}">${_('Log Out')}</a></li>
</ul>
<p class="copy">
${Markup(_('Copyright &copy; 2007 Red Hat, Inc. and others. All Rights Reserved. Please send any comments or corrections to the &lt;a href="mailto:webmaster@fedoraproject.org"&gt;websites team&lt;/a&gt;.'))}
</p>
<p class="disclaimer">
${_('The Fedora Project is maintained and driven by the community and sponsored by Red Hat. This is a community maintained site. Red Hat is not responsible for content.')}
</p>
</div>
</div>
</div> <!-- End wrapper -->
</body>
</html>

0
fas/fas/templates/openid/__init__.py
View file

15
fas/fas/templates/openid/about.html
View file

@ -1,15 +0,0 @@
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:py="http://genshi.edgewall.org/"
xmlns:xi="http://www.w3.org/2001/XInclude">
<xi:include href="../master.html" />
<head>
<title>${_('Fedora Accounts System')}</title>
</head>
<body>
<h2>${_('Fedora Project OpenID Provider')}</h2>
<p>
${Markup_('Description goes here, &lt;a href="http://username.fedorapeople.org/"&gt;username.fedorapeople.org&lt;/a&gt;')}
</p>
</body>
</html>

1
fas/fas/templates/openid/auth.txt
View file

@ -1 +0,0 @@
${body}

21
fas/fas/templates/openid/id.html
View file

@ -1,21 +0,0 @@
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:py="http://genshi.edgewall.org/"
xmlns:xi="http://www.w3.org/2001/XInclude">
<xi:include href="../master.html" />
<head>
<title>${_('Fedora Accounts System')}</title>
<link rel="openid.server" href="${server}" />
</head>
<body>
<h2>${_('User %s') % person.username}</h2>
<div class="userbox">
<dl>
<dt>${_('Username:')}</dt>
<dd>${person.username}</dd>
<dt>${_('Name:')}</dt>
<dd>${person.human_name}</dd>
</dl>
</div>
</body>
</html>

20
fas/fas/templates/openid/trusted.html
View file

@ -1,20 +0,0 @@
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:py="http://genshi.edgewall.org/"
xmlns:xi="http://www.w3.org/2001/XInclude">
<xi:include href="../master.html" />
<head>
<title>${_('Fedora Accounts System')}</title>
</head>
<body>
<h2>${_('Fedora Project OpenID Provider')}</h2>
<form action="${tg.url('/openid/server')}">
<div>
<input type="hidden" id="url" name="url" value="${url}" />
<input type="checkbox" id="trusted" name="trusted" value="allow" />
<label for="trusted">${Markup(_('Allow &lt;strong&gt;%s&lt;/strong&gt; to authenticate to your OpenID identity?') % url)}</label><br />
<input type="submit" value="${_('Submit')}" />
</div>
</form>
</body>
</html>

0
fas/fas/templates/user/__init__.py
View file

2
fas/fas/templates/user/cert.txt
View file

@ -1,2 +0,0 @@
${cert}
${key}

20
fas/fas/templates/user/changepass.html
View file

@ -1,20 +0,0 @@
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:py="http://genshi.edgewall.org/"
xmlns:xi="http://www.w3.org/2001/XInclude">
<xi:include href="../master.html" />
<head>
<title>${_('Change Password')}</title>
</head>
<body>
<h2>${_('Change Password')}</h2>
<form action="${tg.url('/user/setpass')}" method="post">
<ul>
<div class="field"><label for="currentpassword">${_('Current Password:')}</label> <input type="password" id="currentpassword" name="currentpassword" /></div>
<div class="field"><label for="password">${_('New Password:')}</label> <input type="password" id="password" name="password" /></div>
<div class="field"><label for="passwordcheck">${_('Confirm Password:')}</label> <input type="password" id="passwordcheck" name="passwordcheck" /></div>
<div class="field"><input type="submit" value="${_('Change Password')}" /></div>
</ul>
</form>
</body>
</html>

Some files were not shown because too many files have changed in this diff Show more