Thank you for your interest in The Fedora Project (the "Project"). In order to clarify the intellectual property license granted with Contributions from any person or entity, Red hat, Inc. ("Red Hat"), as maintainer of the Project, must have a Contributor License Agreement (CLA) on file that has been signed by each Contributor, indicating agreement to the license terms below. This license is for Your protection as a Contributor as well as the protection of the Project and its users; it does not change your rights to use your own Contributions for any other purpose.
diff --git a/fas/fas/templates/cla/cla.txt b/fas/fas/templates/cla/cla.txt index bb76078..68e0a18 100644 --- a/fas/fas/templates/cla/cla.txt +++ b/fas/fas/templates/cla/cla.txt @@ -1,6 +1,6 @@ The Fedora Project Individual Contributor License Agreement (CLA) - http://www.fedora.redhat.com/licenses/ + http://fedoraproject.org/wiki/Legal/Licenses/CLA Thank you for your interest in The Fedora Project (the "Project"). In order to clarify the intellectual property license diff --git a/fas/fas/templates/user/email/add.html b/fas/fas/templates/user/email/add.html new file mode 100644 index 0000000..9f063a3 --- /dev/null +++ b/fas/fas/templates/user/email/add.html @@ -0,0 +1,30 @@ + + +| ${email.email} | ${email.description} | ${_('Verified')} | @@ -36,7 +36,7 @@
| ${purpose.email} | ${purpose.person_email.description} | ${purpose.purpose} | diff --git a/fas/fas/user.py b/fas/fas/user.py index 8df5ae8..5ca4b01 100644 --- a/fas/fas/user.py +++ b/fas/fas/user.py @@ -3,6 +3,8 @@ from turbogears import controllers, expose, paginate, identity, redirect, widget from turbogears.database import session import cherrypy +import turbomail + import os import re import gpgme @@ -221,7 +223,8 @@ class User(controllers.Controller): target = person if not canEditUser(person, target): turbogears.flash(_('You cannot edit %s') % target.username ) - username = turbogears.identity.current.username + turbogears.redirect('/user/view/%s', target.username) + return dict() return dict(target=target) @identity.require(turbogears.identity.not_anonymous()) @@ -236,7 +239,7 @@ class User(controllers.Controller): if not canEditUser(person, target): turbogears.flash(_("You do not have permission to edit '%s'") % target.username) - turbogears.redirect('/user/edit/%s', target.username) + turbogears.redirect('/user/view/%s', target.username) return dict() try: target.human_name = human_name @@ -286,7 +289,6 @@ class User(controllers.Controller): # Also, perhaps implement a timeout- delete account # if the e-mail is not verified (i.e. the person changes # their password) withing X days. - import turbomail try: person = People() person.username = username @@ -296,6 +298,7 @@ class User(controllers.Controller): person.status = 'active' session.flush() + # TODO: Handle properly if email has already been used. This might be painful, since the person already exists, at this point. person_email = PersonEmails() person_email.email = email person_email.person = person diff --git a/fas/fas/user_email.py b/fas/fas/user_email.py index 2ef95c7..415a4cd 100644 --- a/fas/fas/user_email.py +++ b/fas/fas/user_email.py @@ -3,11 +3,16 @@ from turbogears import controllers, expose, paginate, identity, redirect, widget from turbogears.database import session import cherrypy +import turbomail +import random + from fas.model import People from fas.model import PersonEmails from fas.model import EmailPurposes from fas.model import Log +from fas.auth import * + class NonFedoraEmail(validators.FancyValidator): '''Make sure that an email address is not @fedoraproject.org''' def _to_python(self, value, state): @@ -16,13 +21,20 @@ class NonFedoraEmail(validators.FancyValidator): if value.endswith('@fedoraproject.org'): raise validators.Invalid(_("To prevent email loops, your email address cannot be @fedoraproject.org."), value, state) -class EmailCreate(validators.Schema): +class EmailSave(validators.Schema): email = validators.All( validators.Email(not_empty=True, strip=True), NonFedoraEmail(not_empty=True, strip=True), ) - #fedoraPersonBugzillaMail = validators.Email(strip=True) - postal_address = validators.String(max=512) + description = validators.String(not_empty=True, max=512) + +def generate_validtoken(length=32): + ''' Generate Validation Token ''' + chars = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ' + token = '' + for i in xrange(length): + token += random.choice(chars) + return token class Email(controllers.Controller): @@ -34,7 +46,7 @@ class Email(controllers.Controller): def index(self): '''Redirect to manage ''' - turbogears.redirect('/user/email/manage/%s' % turbogears.identity.current.user_name) + turbogears.redirect('/user/email/manage') @expose(template="fas.templates.error") @@ -48,12 +60,135 @@ class Email(controllers.Controller): #@validate(validators=UserView()) @error_handler(error) @expose(template="fas.templates.user.email.manage", allow_json=True) - def manage(self, username=None): + def manage(self, targetname=None): ''' - Manage a person's emails. + Manage a person's emails ''' - if not username: - username = turbogears.identity.current.user_name + # TODO: Some sort of auth checking - other people should + # probably be limited to looking at a person's email through + # /user/view, although admins should probably be able to set + # emails (with/without verification?) + username = turbogears.identity.current.user_name person = People.by_username(username) - return dict(person=person) + + if targetname: + target = People.by_username(targetname) + else: + target = person + + return dict(target=target) + + @identity.require(turbogears.identity.not_anonymous()) + #@validate(validators=UserView()) + @error_handler(error) + @expose(template="fas.templates.user.email.add", allow_json=True) + def add(self, targetname=None): + ''' + Display the form to add an email + ''' + username = turbogears.identity.current.user_name + person = People.by_username(username) + + if targetname: + target = People.by_username(targetname) + else: + target = person + + if not canEditUser(person, target): + turbogears.flash(_('You cannot edit %s') % target.username ) + turbogears.redirect('/user/email/manage') + return dict() + + return dict(target=target) + + @identity.require(turbogears.identity.not_anonymous()) + @validate(validators=EmailSave()) + @error_handler(error) + @expose(template="fas.templates.user.email.add", allow_json=True) + def save(self, targetname, email, description): + ''' + Display the form to add an email + ''' + username = turbogears.identity.current.user_name + person = People.by_username(username) + + if targetname: + target = People.by_username(targetname) + else: + target = person + + if not canEditUser(person, target): + turbogears.flash(_('You cannot edit %s') % target.username ) + turbogears.redirect('/user/email/manage') + return dict() + + validtoken = generate_validtoken() + + try: + person_email = PersonEmails() + person_email.email = email + person_email.person = target + person_email.description = description + person_email.validtoken = validtoken + session.flush() + # Hmm, should this be checked in the validator or here? + except IntegrityError: + turbogears.flash(_('The email \'%s\' is already in used.') % email) + return dict(target=target) + else: + # TODO: Make this email more friendly. Maybe escape the @ in email too? + validurl = config.get('base_url_filter.base_url') + turbogears.url('/user/email/verify/%s/%s/%s') % (target.username, email, validtoken) + message = turbomail.Message(config.get('accounts_mail'), email, _('Confirm this email address')) + message.plain = _(''' +Go to this URL to verify that you own this email address: %s +''') % validurl + turbomail.enqueue(message) + turbogears.flash(_('Your email has been added. Before you can use this email, you must verify it. The email you added should receive a message with instructions shortly.')) + + return dict(target=target) + + return dict(target=target) + + @identity.require(turbogears.identity.not_anonymous()) + # TODO: Validation! + #@validate(validators=UserView()) + @error_handler(error) + @expose(allow_json=True) + def verify(self, targetname, email, validtoken): + ''' + Verify an email + ''' + username = turbogears.identity.current.user_name + person = People.by_username(username) + + if targetname: + target = People.by_username(targetname) + else: + target = person + + if not canEditUser(person, target): + turbogears.flash(_('You cannot edit %s') % target.username ) + turbogears.redirect('/user/email/manage') + return dict() + + if target.person_emails[email].verified: + turbogears.flash(_('The email provided has already been verified.')) + turbogears.redirect('/user/email/manage') + return dict() + + try: + if target.person_emails[email].validtoken == validtoken: + target.person_emails[email].validtoken = '' + target.person_emails[email].verified = True + turbogears.flash(_('Your email has been successfully verified.')) + turbogears.redirect('/user/email/manage') + return dict() + else: + turbogears.flash(_('The verification string did not match.')) + turbogears.redirect('/user/email/manage') + return dict() + except KeyError: + turbogears.flash(_('No such email is associated with your user.')) + turbogears.redirect('/user/email/manage') + return dict() diff --git a/fas/fas2.sql b/fas/fas2.sql index 25dfa93..9871e40 100644 --- a/fas/fas2.sql +++ b/fas/fas2.sql @@ -71,11 +71,12 @@ cluster people_status_idx on people; CREATE TABLE person_emails ( id serial primary key, - email text not null unique, + email text not null, person_id INTEGER NOT NULL references people(id), validtoken text, description text, verified boolean NOT NULL DEFAULT false + unique (email, verified) --You can't "claim" an email before you verify it first ); create index person_emails_person_id_idx on person_emails(person_id); @@ -141,11 +142,12 @@ cluster groups_group_type_idx on groups; -- CREATE TABLE group_emails ( id serial primary key, - email text not null unique, + email text not null, group_id INTEGER NOT NULL references groups(id), validtoken text, description text, verified boolean NOT NULL DEFAULT false + unique (email, verified) --You can't "claim" an email before you verify it first ); create index group_emails_group_id_idx on group_emails(group_id);