almet/ihatemoney
1
0
Fork 0
mirror of https://github.com/spiral-project/ihatemoney.git synced 2025-05-05 12:41:49 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Revert to an empty default ADMIN_PASSWORD

Browse source 
When ADMIN_PASSWORD is left empty, all
administrative tasks are not available
This commit is contained in:
0livd 2017-07-03 23:36:00 +02:00
parent 503bbff0c9
commit b2ca059910
11 changed files with 35 additions and 29 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
.gitignore vendored
View file

@ -9,3 +9,4 @@ dist
docs/_build/
.tox
dist
.cache/

2
budget/default_settings.py
View file

@ -11,7 +11,7 @@ MAIL_DEFAULT_SENDER = ("Budget manager", "budget@notmyidea.org")
ACTIVATE_DEMO_PROJECT = True
ADMIN_PASSWORD = "pbkdf2:sha256:50000$jc3isZTD$b3be8d04ed5c2c1ac89d5eb777facc94adaee48d473c9620f1e0cb73f3dcfa11"
ADMIN_PASSWORD = ""
ALLOW_PUBLIC_PROJECT_CREATION = True

13
budget/run.py
View file

@ -71,19 +71,6 @@ def configure():
UserWarning
)
if not app.config['ADMIN_PASSWORD']:
app.config['ADMIN_PASSWORD'] = default_settings.ADMIN_PASSWORD
# Since 2.0
warnings.warn(
"The way Ihatemoney handles admin authentication has changed. You seem to be using "
+ "an empty ADMIN_PASSWORD which is not supported anymore. Your ADMIN_PASWWORD has been"
+ " automatically set to the default password to let you access your admin endpoints."
+ " However this password is not secure and must be changed in your settings file. Use"
+ " the command './budget/manage.py generate_password_hash' to generate a proper"
+ " password hash and copy the output to the value of ADMIN_PASSWORD",
UserWarning
)
configure()

12
budget/templates/admin.html Normal file
View file

@ -0,0 +1,12 @@
{% extends "layout.html" %}
{% block content %}
<h2>Authentication</h2>
{% if is_admin_auth_enabled %}
<form class="form-horizontal" method="POST" accept-charset="utf-8">
{{ forms.admin(form) }}
</form>
{% else %}
<div class="alert alert-danger">{{ _("Administration tasks are currently not activated.") }}</div>
{% endif %}
{% endblock %}

6
budget/templates/authenticate.html
View file

@ -7,13 +7,7 @@
to") }} <a href="{{ url_for(".create_project", project_id=create_project) }}">{{ _("create it") }}</a>{{ _("?") }}
</p>
{% endif %}
{% if admin_auth %}
<form class="form-horizontal" method="POST" accept-charset="utf-8">
{{ forms.admin(form) }}
</form>
{% else %}
<form class="form-horizontal" method="POST" accept-charset="utf-8">
{{ forms.authenticate(form) }}
</form>
{% endif %}
{% endblock %}

2
budget/templates/layout.html
View file

@ -70,7 +70,7 @@
{% endif %}
<li class="nav-item{% if g.lang == "fr" %} active{% endif %}"><a class="nav-link" href="{{ url_for(".change_lang", lang="fr") }}">fr</a></li>
<li class="nav-item{% if g.lang == "en" %} active{% endif %}"><a class="nav-link" href="{{ url_for(".change_lang", lang="en") }}">en</a></li>
{% if g.is_dashboard_activated %}
{% if g.show_admin_dashboard_link %}
<li class="nav-item{% if request.url_rule.endpoint == "main.dashboard" %} active{% endif %}"><a class="nav-link" href="{{ url_for(".dashboard") }}">{{ _("Dashboard") }}</a></li>
{% endif %}
</ul>

1
budget/tests/tests.py
View file

@ -614,6 +614,7 @@ class BudgetTestCase(TestCase):
# test access to the dashboard when it is activated
run.app.config['ACTIVATE_ADMIN_DASHBOARD'] = True
run.app.config['ADMIN_PASSWORD'] = generate_password_hash("adminpass")
resp = self.app.post("/admin?goto=%2Fdashboard", data={'admin_password': 'adminpass'},
follow_redirects=True)
self.assertIn('<thead><tr><th>Project</th><th>Number of members', resp.data.decode('utf-8'))

BIN
budget/translations/fr/LC_MESSAGES/messages.mo
View file

Binary file not shown.

4
budget/translations/fr/LC_MESSAGES/messages.po
View file

@ -247,6 +247,10 @@ msgstr "le créer"
msgid "?"
msgstr " ?"
#: templates/authenticate.html:7
msgid "Administration tasks are currently not activated."
msgstr "Les tâches d'administration sont actuellement désactivées."
#: templates/create_project.html:4
msgid "Create a new project"
msgstr "Créer un nouveau projet"

16
budget/web.py
View file

@ -69,11 +69,13 @@ def add_project_id(endpoint, values):
@main.url_value_preprocessor
def set_is_dashboard_activated(endpoint, values):
"""Set is_dashboard_activated application wide
def set_show_admin_dashboard_link(endpoint, values):
"""Set show_admin_dashboard_link application wide
so this variable can be used in the layout template
"""
g.is_dashboard_activated = current_app.config["ACTIVATE_DASHBOARD"]
g.show_admin_dashboard_link = (current_app.config["ACTIVATE_ADMIN_DASHBOARD"] and
current_app.config["ADMIN_PASSWORD"])
@main.url_value_preprocessor
@ -106,9 +108,12 @@ def pull_project(endpoint, values):
@main.route("/admin", methods=["GET", "POST"])
def admin():
"""Admin authentication"""
"""Admin authentication
When ADMIN_PASSWORD is empty, admin authentication is deactivated
"""
form = AdminAuthenticationForm()
goto = request.args.get('goto', url_for('.home'))
is_admin_auth_enabled = bool(current_app.config['ADMIN_PASSWORD'])
if request.method == "POST":
if form.validate():
if check_password_hash(current_app.config['ADMIN_PASSWORD'], form.admin_password.data):
@ -118,7 +123,8 @@ def admin():
else:
msg = _("This admin password is not the right one")
form.errors['admin_password'] = [msg]
return render_template("authenticate.html", form=form, admin_auth=True)
return render_template("admin.html", form=form,
is_admin_auth_enabled=is_admin_auth_enabled)
@main.route("/authenticate", methods=["GET", "POST"])

7
docs/installation.rst
View file

@ -85,15 +85,16 @@ properly.
+------------------------------+---------------------------+----------------------------------------------------------------------------------------+
| ACTIVATE_DEMO_PROJECT | ``True`` | If set to `True`, a demo project will be available on the frontpage. |
+------------------------------+---------------------------+----------------------------------------------------------------------------------------+
| | | Hashed password to access protected endpoints. The default password is ``adminpass``. |
| | | **This needs to be changed** when you disable public project creation or activate the |
| ADMIN_PASSWORD | ``"pbkdf2:sha256:50.."`` | dashboard. |
| | | Hashed password to access protected endpoints. When left empty, all administrative |
| ADMIN_PASSWORD | ``""`` | tasks are disabled. |
| | | To generate the proper password HASH, use ``./budget/manage.py generate_password_hash``|
| | | and copy its output into the value of *ADMIN_PASSWORD*. |
+------------------------------+---------------------------+----------------------------------------------------------------------------------------+
| ALLOW_PUBLIC_PROJECT_CREATION| ``True`` | If set to `True`, everyone can create a project without entering the admin password |
| | | If set to `False`, a non empty ADMIN_PASSWORD needs to be set |
+------------------------------+---------------------------+----------------------------------------------------------------------------------------+
| ACTIVATE_ADMIN_DASHBOARD | ``False`` | If set to `True`, the dashboard will become accessible entering the admin password |
| | | If set to `True`, a non empty ADMIN_PASSWORD needs to be set |
+------------------------------+---------------------------+----------------------------------------------------------------------------------------+
.. _`the SQLAlechemy documentation`: http://docs.sqlalchemy.org/en/latest/core/engines.html#database-urls