From b2ca05991071b4e63ee8e8f32f236b5f417f4cb5 Mon Sep 17 00:00:00 2001 From: 0livd <0livd@users.noreply.github.com> Date: Mon, 3 Jul 2017 23:36:00 +0200 Subject: [PATCH] Revert to an empty default ADMIN_PASSWORD When ADMIN_PASSWORD is left empty, all administrative tasks are not available --- .gitignore | 1 + budget/default_settings.py | 2 +- budget/run.py | 13 ------------- budget/templates/admin.html | 12 ++++++++++++ budget/templates/authenticate.html | 6 ------ budget/templates/layout.html | 2 +- budget/tests/tests.py | 1 + .../translations/fr/LC_MESSAGES/messages.mo | Bin 8537 -> 8665 bytes .../translations/fr/LC_MESSAGES/messages.po | 4 ++++ budget/web.py | 16 +++++++++++----- docs/installation.rst | 7 ++++--- 11 files changed, 35 insertions(+), 29 deletions(-) create mode 100644 budget/templates/admin.html diff --git a/.gitignore b/.gitignore index cb78e40b..f1083404 100644 --- a/.gitignore +++ b/.gitignore @@ -9,3 +9,4 @@ dist docs/_build/ .tox dist +.cache/ diff --git a/budget/default_settings.py b/budget/default_settings.py index f17651bc..e656ece2 100644 --- a/budget/default_settings.py +++ b/budget/default_settings.py @@ -11,7 +11,7 @@ MAIL_DEFAULT_SENDER = ("Budget manager", "budget@notmyidea.org") ACTIVATE_DEMO_PROJECT = True -ADMIN_PASSWORD = "pbkdf2:sha256:50000$jc3isZTD$b3be8d04ed5c2c1ac89d5eb777facc94adaee48d473c9620f1e0cb73f3dcfa11" +ADMIN_PASSWORD = "" ALLOW_PUBLIC_PROJECT_CREATION = True diff --git a/budget/run.py b/budget/run.py index 8144707f..5e65c905 100644 --- a/budget/run.py +++ b/budget/run.py @@ -71,19 +71,6 @@ def configure(): UserWarning ) - if not app.config['ADMIN_PASSWORD']: - app.config['ADMIN_PASSWORD'] = default_settings.ADMIN_PASSWORD - # Since 2.0 - warnings.warn( - "The way Ihatemoney handles admin authentication has changed. You seem to be using " - + "an empty ADMIN_PASSWORD which is not supported anymore. Your ADMIN_PASWWORD has been" - + " automatically set to the default password to let you access your admin endpoints." - + " However this password is not secure and must be changed in your settings file. Use" - + " the command './budget/manage.py generate_password_hash' to generate a proper" - + " password hash and copy the output to the value of ADMIN_PASSWORD", - UserWarning - ) - configure() diff --git a/budget/templates/admin.html b/budget/templates/admin.html new file mode 100644 index 00000000..95fe68b2 --- /dev/null +++ b/budget/templates/admin.html @@ -0,0 +1,12 @@ +{% extends "layout.html" %} +{% block content %} +

Authentication

+ +{% if is_admin_auth_enabled %} +
+ {{ forms.admin(form) }} +
+{% else %} +
{{ _("Administration tasks are currently not activated.") }}
+{% endif %} +{% endblock %} diff --git a/budget/templates/authenticate.html b/budget/templates/authenticate.html index f241c487..98914d09 100644 --- a/budget/templates/authenticate.html +++ b/budget/templates/authenticate.html @@ -7,13 +7,7 @@ to") }} {{ _("create it") }}{{ _("?") }}

{% endif %} -{% if admin_auth %} -
- {{ forms.admin(form) }} -
-{% else %}
{{ forms.authenticate(form) }}
-{% endif %} {% endblock %} diff --git a/budget/templates/layout.html b/budget/templates/layout.html index bb4153d0..07edb0c1 100644 --- a/budget/templates/layout.html +++ b/budget/templates/layout.html @@ -70,7 +70,7 @@ {% endif %}
  • fr
  • en
    • - {% if g.is_dashboard_activated %} + {% if g.show_admin_dashboard_link %}
  • {{ _("Dashboard") }}
    • {% endif %} diff --git a/budget/tests/tests.py b/budget/tests/tests.py index bb265316..040936f3 100644 --- a/budget/tests/tests.py +++ b/budget/tests/tests.py @@ -614,6 +614,7 @@ class BudgetTestCase(TestCase): # test access to the dashboard when it is activated run.app.config['ACTIVATE_ADMIN_DASHBOARD'] = True + run.app.config['ADMIN_PASSWORD'] = generate_password_hash("adminpass") resp = self.app.post("/admin?goto=%2Fdashboard", data={'admin_password': 'adminpass'}, follow_redirects=True) self.assertIn('ProjectNumber of members', resp.data.decode('utf-8')) diff --git a/budget/translations/fr/LC_MESSAGES/messages.mo b/budget/translations/fr/LC_MESSAGES/messages.mo index 9797791b9e9f1c94edaf925590955854024f7c0f..5e2cc5fe97e46349a3afec5869b0226f6aa461b6 100644 GIT binary patch delta 2116 zcmY+^YiLwQ7{>9p8sl1%7^7QlwrS3axvDWLcx$biG~!*Pm`a1#HCb^rZftg=Mr#*o z+N#YLQ47)vk_1Hk;3bH7tEsKl1}(IOTCc$yjY6w}*rN6Ff5<>FoSfgxoH;Y|zB6Yp zmRu}NT+2w>X8f(?{|){hc318HzjHm!UZ;8DqmS^&0gIOvM5mgkvxhKR~@# zhk5uhYN0Ji#I_r`>=3sC=C?KqO5t793Lm37rf^ezAZo>hsK|;j1t+6YJ{uK4xoeN0 z`mID|Y~fq9W~1 zItJhn)VQUnj4VJ8SG)G@*h#%LmHd}b_=b(D!w$^Hd89)FeS*3873SaxR75vXd#*4Q zX)kVCU?wUfMK~BoV>MQ|=Vy_%+7(m)chbrKn-uQTpcMBZ-_nn4w*{Oz_%`+7I3BA} z3*3b|8z+&VtOJMPU#Lt4*cW9e7d7rg%)&C%_>~C?>bM-WqSdIwqITJUjAa|$^RH16 zHlZTkgL?m4RAfJ)PW|tw32wXgd#FSDpKH(N<;{G*i2@3W;1~yBC|*XT*ylIvhB?SP zmXDhFEoUie0W*-~*+LB93Y>tAsQ&H9WxsOMmUZHAe1K#sVL`qnb)17r)%&OcSD-Sm z9+le9F%P$*GIAU>@XyF)w_N)ZRH{?iAI`7!Lmk3wS09hc*c43G_dl0{QZpZwvbCr) z@fm6%EvU>KLiM|WoImTqY88ne^@~@A3Sb&Hjk5?xVKpj)J5dX7MJ_wdZ2AuALPc7LYM+D}Xf|qrAEF}t2(|a?kTqH(>aexA`YHGP5{{w$4kp%9 z2$CPY*o=zoAZp@MsL!Y!^};>$FprJaz*A9YWicvapE{eco%(n9E;iC>9sYu4IER-R z%C=>Z{~`+eY0!7xfyzKKqiK(_P!Z;%4%;|X24ftQ znwv6QjtXo6YMgL(qHBT}4J9-*;5+yuYK6&O*F-^7il^g9EJrP9Ba%hifjZrXaTvCt z&cNTO_x^SDq+r)V(ohTW&!?c3WTC#_A@0Fg)E-Vk4WNEHL{+GXSD_~S618<(Q5k7Q zjdO0xk)CbERm&sMNGx6(ibraqUOW_A7V|>2VXv~Twl*A%SJ!*dnz$FLj7L_6;^C^I o)>XdWQoNbrm>2)Psd5Qc<%M1zBvupMvMDprEmqVz&7Yp~0^BLrNdN!< delta 2011 zcmYM!duWzb90%~ToR{fR(`lM5=cU2eZK60UY_^;oO7P@oXhY0o_Ao;Kzr@@ zxcctmv)1=g-?Kwf`~S0Ncqx-rKjT~;Wh+OHD5Z|qa}3+)R$0UhaVJOe9**Yn%1(|_ zU(KX?%`G*XO83rPi3IjnSQ;T#O=&Zzu?9EnHjiFcoLB*Y~ehn zeHqVi72COdwD>=*(Br_a;CPvoffllr_w#bDV|LWboZaWlPQPLn*v~}dENAjhKF-NH z<$f2ft-Q%>U>h&v`(wpFAwHlX9;V|g1C=MZQ2iG!;8o5k3w)HxjrFvd(!<%@!9;3+ ziO@-A-1BVa5a*Tgr!oDmt|??i^O$70sj{7(DNCyR4=_7?nAy<^W`JjzoxQ|l{U&CD ztyTMbOp@-d+K=%y@9k-31GP00;2MQDm=N#d1w280$|+{ze=6%H3@)I7f>N3}g>#sG zOX({2`N>hO;I&-EM5vePcaS1fD@PSF&~Hox>bzqK=`hY>6BCJr)TP`_S9zprU&n;_ z70TDLkx9NSRed)TseMeO4>1wxXG7lqa|%g@p$;|+naM=tMy6v2usBG6Q|fEbs?r zr@u32ex4b)(L0tTo5|GMnfuE*pPhW3y;b`RVX9?ka}_diJM;Q1Wgb|`7H(q({+h{= zQ%uB$IQTf7eY};ou~Db>yqAl4kRB-$3^Iq;v6T-si@)fXE)6-O9%hHznJoW=iOd1! z|KWSCWxZLGbT!J$vYE+&51Fj~mgaeiXP|AXzUpDO-0D=hI;R@lW%)XRjp zk8^p1Sx`gE;6GV2lil+Z-nhS;(u*Lb{oS^f0gOjyn``V;6H~dzk_H pnIt;NO#C-9;izeYXWGOpbOtlfT^sig-@EhE5r-Og_DvYm_#aUPxxD}Y diff --git a/budget/translations/fr/LC_MESSAGES/messages.po b/budget/translations/fr/LC_MESSAGES/messages.po index eec04676..09b5af70 100644 --- a/budget/translations/fr/LC_MESSAGES/messages.po +++ b/budget/translations/fr/LC_MESSAGES/messages.po @@ -247,6 +247,10 @@ msgstr "le créer" msgid "?" msgstr " ?" +#: templates/authenticate.html:7 +msgid "Administration tasks are currently not activated." +msgstr "Les tâches d'administration sont actuellement désactivées." + #: templates/create_project.html:4 msgid "Create a new project" msgstr "Créer un nouveau projet" diff --git a/budget/web.py b/budget/web.py index 95909158..ea49a2e2 100644 --- a/budget/web.py +++ b/budget/web.py @@ -69,11 +69,13 @@ def add_project_id(endpoint, values): @main.url_value_preprocessor -def set_is_dashboard_activated(endpoint, values): - """Set is_dashboard_activated application wide +def set_show_admin_dashboard_link(endpoint, values): + """Set show_admin_dashboard_link application wide so this variable can be used in the layout template """ - g.is_dashboard_activated = current_app.config["ACTIVATE_DASHBOARD"] + + g.show_admin_dashboard_link = (current_app.config["ACTIVATE_ADMIN_DASHBOARD"] and + current_app.config["ADMIN_PASSWORD"]) @main.url_value_preprocessor @@ -106,9 +108,12 @@ def pull_project(endpoint, values): @main.route("/admin", methods=["GET", "POST"]) def admin(): - """Admin authentication""" + """Admin authentication + When ADMIN_PASSWORD is empty, admin authentication is deactivated + """ form = AdminAuthenticationForm() goto = request.args.get('goto', url_for('.home')) + is_admin_auth_enabled = bool(current_app.config['ADMIN_PASSWORD']) if request.method == "POST": if form.validate(): if check_password_hash(current_app.config['ADMIN_PASSWORD'], form.admin_password.data): @@ -118,7 +123,8 @@ def admin(): else: msg = _("This admin password is not the right one") form.errors['admin_password'] = [msg] - return render_template("authenticate.html", form=form, admin_auth=True) + return render_template("admin.html", form=form, + is_admin_auth_enabled=is_admin_auth_enabled) @main.route("/authenticate", methods=["GET", "POST"]) diff --git a/docs/installation.rst b/docs/installation.rst index 59e658e7..610a844b 100644 --- a/docs/installation.rst +++ b/docs/installation.rst @@ -85,15 +85,16 @@ properly. +------------------------------+---------------------------+----------------------------------------------------------------------------------------+ | ACTIVATE_DEMO_PROJECT | ``True`` | If set to `True`, a demo project will be available on the frontpage. | +------------------------------+---------------------------+----------------------------------------------------------------------------------------+ -| | | Hashed password to access protected endpoints. The default password is ``adminpass``. | -| | | **This needs to be changed** when you disable public project creation or activate the | -| ADMIN_PASSWORD | ``"pbkdf2:sha256:50.."`` | dashboard. | +| | | Hashed password to access protected endpoints. When left empty, all administrative | +| ADMIN_PASSWORD | ``""`` | tasks are disabled. | | | | To generate the proper password HASH, use ``./budget/manage.py generate_password_hash``| | | | and copy its output into the value of *ADMIN_PASSWORD*. | +------------------------------+---------------------------+----------------------------------------------------------------------------------------+ | ALLOW_PUBLIC_PROJECT_CREATION| ``True`` | If set to `True`, everyone can create a project without entering the admin password | +| | | If set to `False`, a non empty ADMIN_PASSWORD needs to be set | +------------------------------+---------------------------+----------------------------------------------------------------------------------------+ | ACTIVATE_ADMIN_DASHBOARD | ``False`` | If set to `True`, the dashboard will become accessible entering the admin password | +| | | If set to `True`, a non empty ADMIN_PASSWORD needs to be set | +------------------------------+---------------------------+----------------------------------------------------------------------------------------+ .. _`the SQLAlechemy documentation`: http://docs.sqlalchemy.org/en/latest/core/engines.html#database-urls