[MERGE] reset password, signup and auth renames

bzr revid: al@openerp.com-20120808152042-zfrxriyffvu9uw9v
This commit is contained in:
Antony Lesuisse 2012-08-08 17:20:42 +02:00
commit 163b211e12
60 changed files with 531 additions and 102 deletions

View File

@ -3,17 +3,17 @@
'description': 'Allow anonymous access to OpenERP.',
'author': 'OpenERP SA',
'version': '1.0',
'category': 'Tools',
'category': 'Authentication',
'website': 'http://www.openerp.com',
'installable': True,
'depends': ['web'],
'data': [
'anonymous.xml',
'auth_anonymous.xml',
],
'js': [
'static/src/js/anonymous.js',
'static/src/js/auth_anonymous.js',
],
'qweb': [
'static/src/xml/anonymous.xml',
'static/src/xml/auth_anonymous.xml',
],
}

View File

@ -1,11 +1,11 @@
openerp.anonymous = function(instance) {
openerp.auth_anonymous = function(instance) {
instance.web.Login.include({
start: function() {
var self = this;
return $.when(this._super()).pipe(function() {
var dblist = self._db_list;
if (dblist && dblist.length === 1) {
var dblist = self._db_list || [];
if (!self.session.session_is_valid() && dblist.length === 1) {
self.remember_credentials = false;
// XXX get login/pass from server (via a rpc call) ?
return self.do_login(dblist[0], 'anonymous', 'anonymous')
@ -19,7 +19,7 @@ openerp.anonymous = function(instance) {
init: function(parent) {
this._super(parent);
if (this.session.username == 'anonymous') {
this.template = 'UserMenu.anonymous';
this.template = 'UserMenu.auth_anonymous';
this.do_update = function() {}; // avoid change of avatar
}
},
@ -30,8 +30,16 @@ openerp.anonymous = function(instance) {
var p = self.getParent();
var am = p.action_manager;
p.$element.find('.oe_leftbar').hide();
am.do_action({type:'ir.actions.client', tag:'login', target: 'new'});
am.dialog_widget.on('login', p, p.restart);
am.do_action({
type:'ir.actions.client',
tag:'login',
target: 'new',
params: {
login_successful: function() {
am.do_action("reload");
}
}
});
});
}
});

View File

@ -3,7 +3,7 @@
-->
<templates id="template" xml:space="preserve">
<t t-name="UserMenu.anonymous">
<t t-name="UserMenu.auth_anonymous">
<div>
<a href="#" class="oe_user_menu oe_topbar_item oe_topbar_anonymous_login">
<img class="oe_topbar_avatar" t-att-src="_s + '/web/static/src/img/icons/gtk-dialog-authentication.png'"/>

View File

@ -101,7 +101,7 @@ authentication if installed at the same time.
"website" : "http://www.openerp.com",
"category" : "Tools",
"category" : "Authentication",
"data" : [
"users_ldap_view.xml",
"user_ldap_installer.xml",

View File

@ -0,0 +1 @@
import auth_reset_password

View File

@ -0,0 +1,22 @@
{
'name': 'Reset Password',
'description': 'Allow users to reset their password from the login page',
'author': 'OpenERP SA',
'version': '1.0',
'category': 'Authentication',
'website': 'http://www.openerp.com',
'installable': True,
'depends': ['auth_anonymous', 'email_template'],
'data': [
'auth_reset_password.xml',
],
'js': [
'static/src/js/reset_password.js',
],
'css': [
'static/src/css/reset_password.css',
],
'qweb': [
'static/src/xml/reset_password.xml',
],
}

View File

@ -0,0 +1,132 @@
import base64
import hashlib
import simplejson
import time
import urlparse
from openerp.tools import config
from openerp.osv import osv, fields
TWENTY_FOUR_HOURS = 24 * 60 * 60
def message_sign(data, secret):
src = simplejson.dumps([data, secret], indent=None, separators=(',', ':'), sort_keys=True)
sign = hashlib.sha1(src).hexdigest()
msg = simplejson.dumps([data, sign], indent=None, separators=(',', ':'), sort_keys=True)
# pad message to avoid '='
pad = (3 - len(msg) % 3) % 3
msg = msg + " " * pad
msg = base64.urlsafe_b64encode(msg)
return msg, sign
def message_check(msg, secret):
msg = base64.urlsafe_b64decode(msg)
l = simplejson.loads(msg)
msg_data = l[0]
msg_sign = l[1]
tmp, sign = message_sign(msg_data, secret)
if msg_sign == sign:
return msg_data
class res_users(osv.osv):
_inherit = 'res.users'
_sql_constraints = [
('email_uniq', 'UNIQUE (user_email)', 'You can not have two users with the same email!')
]
def _auth_reset_password_secret(self, cr, uid, context=None):
uuid = self.pool.get('ir.config_parameter').get_param(cr, uid, 'database.uuid')
res = {
'dbname': cr.dbname,
'uuid': uuid,
'admin_passwd': config['admin_passwd']
}
return res
def _auth_reset_password_host(self, cr, uid, context=None):
return self.pool.get('ir.config_parameter').get_param(cr, uid, 'web.base.url', '')
def _auth_reset_password_link(self, cr, uid, ids, context=None):
assert len(ids) == 1
host = self._auth_reset_password_host(cr, uid, context)
secret = self._auth_reset_password_secret(cr, uid, context)
msg_src = {
'time': time.time(),
'uid': ids[0],
}
msg, sign = message_sign(msg_src, secret)
link = urlparse.urljoin(host, '/login?db=%s&login=anonymous&key=anonymous#action=reset_password&token=%s' % (cr.dbname, msg))
return link
def _auth_reset_password_check_token(self, cr, uid, token, context=None):
secret = self._auth_reset_password_secret(cr, uid, context)
data = message_check(token, secret)
if data and (time.time() - data['time'] < TWENTY_FOUR_HOURS):
return data
return None
def _auth_reset_password_send_email(self, cr, uid, email_to, tpl_name, res_id, context=None):
model, tpl_id = self.pool.get('ir.model.data').get_object_reference(cr, uid, 'auth_reset_password', tpl_name)
assert model == 'email.template'
msg_id = self.pool.get(model).send_mail(cr, uid, tpl_id, res_id, force_send=False, context=context)
MailMessage = self.pool.get('mail.message')
MailMessage.write(cr, uid, [msg_id], {'email_to': email_to}, context=context)
MailMessage.send(cr, uid, [msg_id], context=context)
def send_reset_password_request(self, cr, uid, email, context=None):
ids = self.pool.get('res.users').search(cr, 1, [('user_email', '=', email)], context=context)
if ids:
self._auth_reset_password_send_email(cr, 1, email, 'reset_password_email', ids[0], context=context)
return True
#else:
# _m, company_id = self.pool.get('ir.model.data').get_object_reference(cr, uid, 'base', 'main_company')
# self._auth_reset_password_send_email(cr, uid, email, 'email_no_user', company_id, context=context)
return False
class auth_reset_password(osv.TransientModel):
_name = 'auth.reset_password'
_rec_name = 'password'
_columns = {
'password': fields.char('Password', size=64),
'password_confirmation': fields.char('Confirm Password', size=64),
'token': fields.char('Token', size=128),
'state': fields.selection([(x, x) for x in 'draft done missmatch error'.split()], required=True),
}
_defaults = {
'state': 'draft',
}
def create(self, cr, uid, values, context=None):
# NOTE here, invalid values raises exceptions to avoid storing
# sensitive data into the database (which then are available to anyone)
pw = values.get('password')
if not pw or pw != values.get('password_confirmation'):
raise osv.except_osv('Error', 'Passwords missmatch')
Users = self.pool.get('res.users')
data = Users._auth_reset_password_check_token(cr, uid, values.get('token', ''))
if data:
Users.write(cr, 1, data['uid'], {'password': pw}, context=context)
else:
raise osv.except_osv('Error', 'Invalid token')
# Dont store password
values = {'state': 'done'}
return super(auth_reset_password, self).create(cr, uid, values, context)
def change(self, cr, uid, ids, context=None):
return True
def onchange_pw(self, cr, uid, ids, password, password_confirmation, context=None):
if password != password_confirmation:
return {'value': {'state': 'missmatch'}}
return {'value': {'state': 'draft'}}
def onchange_token(self, cr, uid, ids, token, context=None):
Users = self.pool.get('res.users')
if not Users._auth_reset_password_check_token(cr, uid, token, context=context):
return {'value': {'state': 'error'}}
return {}

View File

@ -0,0 +1,66 @@
<?xml version="1.0" encoding="UTF-8"?>
<openerp>
<data>
<!-- Email template for reset password -->
<record id="reset_password_email" model="email.template">
<field name="name">Reset Password</field>
<field name="model_id" ref="base.model_res_users"/>
<field name="email_from"><![CDATA[${object.company_id.name} <${object.company_id.email}>]]></field>
<field name="email_to" eval="False"><!--(set by reset_password module)--></field>
<field name="subject">Password reset</field>
<field name="body_text"><![CDATA[
A password reset was requested the OpenERP account linked to this email on ${object._auth_reset_password_host()}
You may change your password following this link:
${object._auth_reset_password_link()}
If you don't have asked for password reset, you can safely ignore this email.
]]></field>
</record>
<!-- TODO get own css -->
<record id="reset_password_wizard_form_view" model="ir.ui.view">
<field name="name">auth.reset_password.form</field>
<field name="model">auth.reset_password</field>
<field name="type">form</field>
<field name="arch" type="xml">
<form string="Reset Password" version="7.0">
<field name="state" invisible="1"/>
<field name="token" on_change="onchange_token(token)" invisible="1"/>
<group colspan="4" states="draft,missmatch">
<field name="password" required='1' on_change="onchange_pw(password,password_confirmation)"/>
<field name="password_confirmation" required='1' on_change="onchange_pw(password,password_confirmation)"/>
<group colspan="4" states="missmatch">
<div>Passwords missmatch</div>
</group>
<group colspan="2" col="1">
<button string="Change Password" name="change" icon="gtk-dialog-authentication" attrs="{'readonly': [('state', '=', 'missmatch')]}"/>
</group>
</group>
<group colspan="4" states="error" col="1">
<div>Invalid or expired token</div>
<button special="cancel" string="Close"/>
</group>
<group colspan="4" states="done" col="1">
<div>Password changed. We sent you an email confirming the password change.</div>
<button special="cancel" string="Close"/>
</group>
</form>
</field>
</record>
<record id="action_reset" model="ir.actions.act_window">
<field name="name">Reset Password</field>
<field name="type">ir.actions.act_window</field>
<field name="res_model">auth.reset_password</field>
<field name="view_type">form</field>
<field name="view_mode">form</field>
<field name="target">new</field>
</record>
</data>
</openerp>

View File

@ -0,0 +1,12 @@
.openerp .oe_login .oe_login_pane {
height: 152px;
}
.openerp .oe_login .oe_login_pane ul.oe_login_switch a {
color: #eeeeee;
margin: 0 8px;
}
.openerp .oe_login .oe_login_pane ul.oe_login_switch a:hover {
text-decoration: underline;
}

View File

@ -0,0 +1,72 @@
openerp.auth_reset_password = function(instance) {
var _t = instance.web._t;
instance.web.Login.include({
start: function() {
var $e = this.$element;
$e.find('a.oe_login_switch').click(function() {
$e.find('ul.oe_login_switch').toggle();
var $m = $e.find('form input[name=is_reset_pw]');
$m.attr('checked', !$m.is(':checked'));
});
return this._super();
},
on_submit: function(ev) {
if(ev) {
ev.preventDefault();
}
var $e = this.$element;
var db = $e.find("form [name=db]").val();
if (!db) {
this.do_warn(_t("Login"), _t("No database selected !"));
return false;
}
var $m = $e.find('form input[name=is_reset_pw]');
if ($m.is(':checked')) {
var email = $e.find('form input[name=email]').val();
return this.do_reset_password(db, email);
} else {
return this._super(ev);
}
},
do_reset_password: function(db, email) {
var self = this;
instance.connection.session_authenticate(db, 'anonymous', 'anonymous', true).pipe(function () {
var func = new instance.web.Model("res.users").get_func("send_reset_password_request");
return func(email).then(function(res) {
// show message
self.do_notify(_t('Reset Password'), _.str.sprintf(_t('We have sent an email to %s with further instructions'), email), true);
}, function(error, event) {
// no traceback please
event.preventDefault();
});
}).fail(function(error, event) {
// cannot log as anonymous or reset_password not installed
self.do_warn(_t('Reset Password'), _.str.sprintf(_t('Reset Password functionnality is not available for database %s'), db), true);
});
}
});
instance.reset_password = {};
instance.reset_password.ResetPassword = instance.web.Widget.extend({
init: function(parent, params) {
this._super(parent);
this.token = (params && params.token) || false;
},
start: function() {
this.do_action({
name: 'Reset Password',
type: 'ir.actions.act_window',
context: {default_token: this.token},
res_model: 'auth.reset_password',
target: 'new',
views: [[false, 'form']]
});
}
});
instance.web.client_actions.add("reset_password", "instance.reset_password.ResetPassword");
};

View File

@ -0,0 +1,26 @@
<?xml version="1.0" encoding="UTF-8"?>
<!-- vim:fdl=1:
-->
<templates id="template" xml:space="preserve">
<t t-extend="Login">
<t t-jquery="form ul:first">
// addClass does not work :(
this.attr('class', (this.attr('class') || '') + ' oe_login_switch');
</t>
<t t-jquery="form ul:first li:last" t-operation="after">
<li>
<a class="oe_login_switch" href="#">Forgot your password?</a>
</li>
</t>
<t t-jquery="form ul:first" t-operation="after">
<ul class="oe_login_switch" style="display:none;">
<li style="display:none;"><input type="checkbox" name="is_reset_pw"/></li>
<li>Email</li>
<li><input type="email" name="email"/></li>
<li><button name="submit">Reset Password</button></li>
<li><a class="oe_login_switch" href="#">&lt; Back</a></li>
</ul>
</t>
</t>
</templates>

View File

@ -0,0 +1,2 @@
import res_config
import auth_signup

View File

@ -0,0 +1,22 @@
{
'name': 'Signup',
'description': 'Allow users to sign up',
'author': 'OpenERP SA',
'version': '1.0',
'category': 'Authentication',
'website': 'http://www.openerp.com',
'installable': True,
'depends': ['auth_anonymous', 'base_setup'],
'data': [
'res_config.xml',
],
'js': [
'static/src/js/auth_signup.js',
],
'css': [
'static/src/css/auth_signup.css',
],
'qweb': [
'static/src/xml/auth_signup.xml',
],
}

View File

@ -8,23 +8,18 @@ class res_users(osv.Model):
]
class signup_signup(osv.TransientModel):
_name = 'signup.signup'
_name = 'auth.signup'
# TODO add captcha
_columns = {
'name': fields.char('Name', size=64),
'email': fields.char('Email', size=64),
'password': fields.char('Password', size=64),
'password_confirmation': fields.char('Confirm Password', size=64),
'state': fields.selection([(x, x) for x in 'draft done missmatch'.split()], required=True),
}
_defaults = {
'state': 'draft',
}
def create(self, cr, uid, values, context=None):
# NOTE here, invalid values raises exceptions to avoid storing
# sensitive data into the database (which then are available to anyone)
if values['password'] != values['password_confirmation']:
raise osv.except_osv('Error', 'Passwords missmatch')
new_user = {
'name': values['name'],
@ -34,24 +29,11 @@ class signup_signup(osv.TransientModel):
'active': True,
}
user_template_id = self.pool.get('ir.config_parameter').get_param(cr, uid, 'signup.user_template_id', 0)
user_template_id = self.pool.get('ir.config_parameter').get_param(cr, uid, 'auth.signup_template_user_id', 0)
if user_template_id:
self.pool.get('res.users').copy(cr, 1, user_template_id, new_user, context=context)
else:
self.pool.get('res.users').create(cr, 1, new_user, context=context)
# Dont store the password
values = {'state': 'done'}
return super(signup_signup, self).create(cr, uid, values, context)
def signup(self, cr, uid, ids, context=None):
return {
'type': 'ir.actions.client',
'tag': 'login',
}
def onchange_pw(self, cr, uid, ids, pw, cpw, context=None):
if pw != cpw:
return {'value': {'state': 'missmatch'}}
return {'value': {'state': 'draft'}}
# Dont store anything
return 0

View File

@ -4,17 +4,16 @@ class base_config_settings(osv.TransientModel):
_inherit = 'base.config.settings'
_columns = {
'signup_template_user_id': fields.many2one('res.users', 'Template user for new users created through signup')
'auth_signup_template_user_id': fields.many2one('res.users', 'Template user for new users created through signup')
}
def get_default_signup(self, cr, uid, fields, context=None):
icp = self.pool.get('ir.config_parameter')
return {
'signup_template_user_id': icp.get_param(cr, uid, 'signup.template_user_id', 0) or False
'auth_signup_template_user_id': icp.get_param(cr, uid, 'auth.signup_template_user_id', 0) or False
}
def set_signup(self, cr, uid, ids, context=None):
config = self.browse(cr, uid, ids[0], context=context)
icp = self.pool.get('ir.config_parameter')
icp.set_param(cr, uid, 'signup.template_user_id', config.signup_user_template_id.id)
icp.set_param(cr, uid, 'auth.signup_template_user_id', config.auth_signup_template_user_id.id)

View File

@ -13,8 +13,8 @@
<label for="id" string="External Users"/>
<div>
<div>
<label for="signup_template_user_id"/>
<field name="signup_template_user_id" class="oe_inline"/>
<label for="auth_signup_template_user_id"/>
<field name="auth_signup_template_user_id" class="oe_inline"/>
</div>
</div>
</group>

View File

@ -0,0 +1,9 @@
.openerp .oe_login .oe_login_pane ul.oe_signup a {
color: #eeeeee;
margin: 0 8px;
}
.openerp .oe_login .oe_login_pane ul.oe_signup a:hover {
text-decoration: underline;
}

View File

@ -0,0 +1,105 @@
openerp.auth_signup = function(instance) {
var _t = instance.web._t;
instance.web.Login.include({
start: function() {
var self = this;
this.$('a.oe_signup').click(function() {
var db = self.$("form [name=db]").val();
if (!db) {
self.do_warn(_t("Login"), _t("No database selected!"));
return false;
}
var cnx = instance.connection;
if (cnx.session_is_valid()) {
self._signup();
} else {
cnx.session_authenticate(db, 'anonymous', 'anonymous', true).then(function() {
self._signup();
}).fail(function(error, event) {
console.log(error);
// cannot log as anonymous or auth_signup not installed
self.do_warn(_t('Sign Up'), _.str.sprintf(_t('Signup functionnality is not available for database %s'), db), true);
});
}
return true;
});
return this._super();
},
_signup: function() {
this.do_action({
type: 'ir.actions.client',
tag: 'auth_signup.signup',
target: 'new',
name: 'Sign up'
});
}
});
instance.auth_signup = instance.auth_signup || {};
instance.auth_signup.Signup = instance.web.Widget.extend({
template: 'auth_signup.signup',
init: function() {
this._super.apply(this, arguments);
this.dataset = new instance.web.DataSet(this, 'auth.signup');
},
start: function() {
var self = this;
this.$('input[type=password]').change(function() {
var v = $(this).val();
var e = !_.isEmpty(v);
if (e) {
e =_.all(self.$('input[type=password]'), function(i) {
return $(i).val() === v;
});
}
var $b = self.$('button');
if (e) {
$b.removeAttr('disabled');
} else {
$b.attr('disabled', 'disabled');
}
});
this.$('form').submit(function(ev) {
if(ev) {
ev.preventDefault();
}
var name = self.$('input[name=name]').val();
var email = self.$('input[name=email]').val();
var password = self.$('input[name=password]').val();
self.dataset.create({
name: name,
email: email,
password: password
}, function() {
self.do_action({
type: 'ir.actions.client',
tag: 'login',
params: {
db: instance.connection.db,
login: email,
password: password,
login_successful: function() {
self.do_action('home');
}
}
});
});
return false;
});
return $.when(this._super());
}
});
instance.web.client_actions.add("auth_signup.signup", "instance.auth_signup.Signup");
};

View File

@ -0,0 +1,28 @@
<?xml version="1.0" encoding="UTF-8"?>
<!-- vim:fdl=1:
-->
<templates id="template" xml:space="preserve">
<t t-extend="Login">
<t t-jquery="form ul:first li:last" t-operation="after">
<li>
<a class="oe_signup" href="#">Sign Up</a>
</li>
</t>
</t>
<t t-name="auth_signup.signup">
<div>
<form>
Name = <input type="text" name="name"/>
Email = <input type="email" name="email"/>
Password = <input type="password" name="password"/>
Confirmation = <input type="password" name="password_confirmation"/>
<button type="submit" disabled="disabled">Signup</button>
</form>
</div>
</t>
</templates>

View File

@ -2,7 +2,7 @@
##############################################################################
#
# OpenERP, Open Source Management Solution
# Copyright (C) 2004-2011 OpenERP S.A (<http://www.openerp.com>).
# Copyright (C) 2004-2012 OpenERP S.A (<http://www.openerp.com>).
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as
@ -22,7 +22,7 @@
{
'name' : "Portal",
'version' : "1.0",
'depends' : ["base", "share", "anonymous"],
'depends' : ["base", "share", "auth_anonymous"],
'author' : "OpenERP SA",
'category': 'Portal',
'description': """

View File

@ -23,7 +23,7 @@
<!-- Top menu item -->
<menuitem name="Portal"
id="portal_menu"
groups="base.group_no_one,portal.group_portal_member,anonymous.group_anonymous"
groups="base.group_no_one,portal.group_portal_member,auth_anonymous.group_anonymous"
sequence="20"/>
<menuitem name="Our company" id="portal_company" parent="portal_menu" sequence="10"/>

View File

@ -1,2 +0,0 @@
import res_config
import signup

View File

@ -1,20 +0,0 @@
{
'name': 'Signup',
'description': 'Allow users to sign up',
'author': 'OpenERP SA',
'version': '1.0',
'category': 'Tools',
'website': 'http://www.openerp.com',
'installable': True,
'depends': ['anonymous', 'base_setup'],
'data': [
'res_config.xml',
'signup.xml',
],
'js': [
'static/src/js/signup.js',
],
'qweb': [
'static/src/xml/signup.xml',
],
}

View File

@ -1,21 +0,0 @@
openerp.signup = function(instance) {
instance.web.UserMenu.include({
start: function() {
var self = this;
this._super.apply(this, arguments);
this.$element.find('a.oe_topbar_signup').click(function() {
var p = self.getParent();
var am = p.action_manager;
am.do_action({
type:'ir.actions.act_window',
res_model: 'signup.signup',
views: [[false, 'form']],
target: 'new',
name: 'Sign Up'
});
});
}
});
};

View File

@ -1,14 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<!-- vim:fdl=1:
-->
<templates id="template" xml:space="preserve">
<t t-extend="UserMenu.anonymous">
<t t-jquery="a" t-operation="after">
<a href="#" class="oe_user_menu oe_topbar_item oe_topbar_signup">
<img class="oe_topbar_avatar" t-att-src="_s + '/web/static/src/img/user_menu_avatar.png'"/>
Sign Up
</a>
</t>
</t>
</templates>