Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
super(Application, self).__init__(handlers,
cookie_secret=cookie_secret,
**kwargs)
d = pkg_resources.resource_filename('taguette', 'l10n')
tornado.locale.load_gettext_translations(d, 'taguette_main')
tornado.locale.set_default_locale(self.config['DEFAULT_LANGUAGE'])
self.DBSession = database.connect(config['DATABASE'])
self.event_waiters = {}
db = self.DBSession()
admin = (
db.query(database.User)
.filter(database.User.login == 'admin')
.one_or_none()
)
if admin is None:
logger.warning("Creating user 'admin'")
admin = database.User(login='admin')
if config['MULTIUSER']:
self._set_password(admin)
db.add(admin)
db.commit()
elif config['MULTIUSER'] and not admin.hashed_password:
self._set_password(admin)
db.commit()
if config['MULTIUSER']:
self.single_user_token = None
logger.info("Starting in multi-user mode")
d = pkg_resources.resource_filename('taguette', 'l10n')
tornado.locale.load_gettext_translations(d, 'taguette_main')
tornado.locale.set_default_locale(self.config['DEFAULT_LANGUAGE'])
self.DBSession = database.connect(config['DATABASE'])
self.event_waiters = {}
db = self.DBSession()
admin = (
db.query(database.User)
.filter(database.User.login == 'admin')
.one_or_none()
)
if admin is None:
logger.warning("Creating user 'admin'")
admin = database.User(login='admin')
if config['MULTIUSER']:
self._set_password(admin)
db.add(admin)
db.commit()
elif config['MULTIUSER'] and not admin.hashed_password:
self._set_password(admin)
db.commit()
if config['MULTIUSER']:
self.single_user_token = None
logger.info("Starting in multi-user mode")
else:
self.single_user_token = hmac.new(
cookie_secret.encode('utf-8'),
b'taguette_single_user',
digestmod=hashlib.sha256,
if not self.application.multiuser:
raise HTTPError(404)
if not self.application.register_enabled:
raise HTTPError(403)
login = self.get_body_argument('login')
password1 = self.get_body_argument('password1')
password2 = self.get_body_argument('password2')
if password1 != password2:
self.render('login.html', register=True,
register_error="Passwords do not match")
return
if self.db.query(database.User).get(login) is not None:
self.render('login.html', register=True,
register_error="Username is taken")
return
user = database.User(login=login)
user.set_password(password1)
self.db.add(user)
self.db.commit()
logger.info("User registered: %r", login)
self.set_secure_cookie('user', login)
self.redirect(self.reverse_url('index'))
password2 = self.get_body_argument('password2')
login = validate.user_login(login)
validate.user_password(password1)
email = self.get_body_argument('email', '')
if email:
validate.user_email(email)
if password1 != password2:
raise validate.InvalidFormat(_f("Passwords do not match"))
if self.db.query(database.User).get(login) is not None:
raise validate.InvalidFormat(_f("User name is taken"))
if (email and
self.db.query(database.User)
.filter(database.User.email == email).count() > 0):
raise validate.InvalidFormat(_f("Email address is already "
"used"))
user = database.User(login=login)
user.set_password(password1)
if email:
user.email = email
self.db.add(user)
self.db.commit()
logger.info("User registered: %r", login)
self.set_secure_cookie('user', login)
return self.redirect(self.reverse_url('index'))
except validate.InvalidFormat as e:
logger.info("Error validating Register: %r", e)
return self.render('login.html', register=True,
register_error=self.gettext(e.message))
try:
login = self.get_body_argument('login')
password1 = self.get_body_argument('password1')
password2 = self.get_body_argument('password2')
login = validate.user_login(login)
validate.user_password(password1)
email = self.get_body_argument('email', '')
if email:
validate.user_email(email)
if password1 != password2:
raise validate.InvalidFormat(_f("Passwords do not match"))
if self.db.query(database.User).get(login) is not None:
raise validate.InvalidFormat(_f("User name is taken"))
if (email and
self.db.query(database.User)
.filter(database.User.email == email).count() > 0):
raise validate.InvalidFormat(_f("Email address is already "
"used"))
user = database.User(login=login)
user.set_password(password1)
if email:
user.email = email
self.db.add(user)
self.db.commit()
logger.info("User registered: %r", login)
self.set_secure_cookie('user', login)
return self.redirect(self.reverse_url('index'))
except validate.InvalidFormat as e:
logger.info("Error validating Register: %r", e)
return self.render('login.html', register=True,
register_error=self.gettext(e.message))
self.multiuser = multiuser
self.register_enabled = register_enabled
self.DBSession = database.connect(db_url)
self.event_waiters = {}
db = self.DBSession()
admin = (
db.query(database.User)
.filter(database.User.login == 'admin')
.one_or_none()
)
if admin is None:
logger.warning("Creating user 'admin'")
admin = database.User(login='admin')
if self.multiuser:
self._set_password(admin)
db.add(admin)
db.commit()
elif self.multiuser and not admin.hashed_password:
self._set_password(admin)
db.commit()
if self.multiuser:
self.single_user_token = None
logging.info("Starting in multi-user mode")
else:
self.single_user_token = hmac.new(
cookie_secret.encode('utf-8'),
b'taguette_single_user',
digestmod=hashlib.sha256,
)
super(Application, self).__init__(handlers,
cookie_secret=cookie_secret,
**kwargs)
self.multiuser = multiuser
self.register_enabled = register_enabled
self.DBSession = database.connect(db_url)
self.event_waiters = {}
db = self.DBSession()
admin = (
db.query(database.User)
.filter(database.User.login == 'admin')
.one_or_none()
)
if admin is None:
logger.warning("Creating user 'admin'")
admin = database.User(login='admin')
if self.multiuser:
self._set_password(admin)
db.add(admin)
db.commit()
elif self.multiuser and not admin.hashed_password:
self._set_password(admin)
db.commit()
if self.multiuser:
self.single_user_token = None
logging.info("Starting in multi-user mode")
def post(self):
if not self.application.config['MULTIUSER']:
raise HTTPError(404)
login = self.get_body_argument('login')
try:
login = validate.user_login(login)
except validate.InvalidFormat:
logger.info("Login: invalid login")
else:
password = self.get_body_argument('password')
user = self.db.query(database.User).get(login)
if user is None:
logger.info("Login: non-existent user")
elif not user.check_password(password):
logger.info("Login: invalid password for %r", user.login)
else:
self.login(user.login)
return self._go_to_next()
return self.render(
'login.html', register=False,
next=self.get_argument('next', ''),
login_error=self.gettext("Invalid login or password"),
)