[mentors-ops] r44 - in website/cgi-bin: . Mentors

chaas at mentors.debian.net chaas at mentors.debian.net
Sat Dec 31 00:37:02 CET 2005


Author: chaas
Date: 2005-12-31 00:37:02 +0100 (Sat, 31 Dec 2005)
New Revision: 44

Modified:
   website/cgi-bin/Mentors/Database.py
   website/cgi-bin/Mentors/Signup.py
   website/cgi-bin/Mentors/Web.py
   website/cgi-bin/ibeodb
   website/cgi-bin/mypage
   website/cgi-bin/signup
Log:
 * Authentication now behind MD5 hashes.
 * Signup page fully works (only a information page needs to be added)
 * Fixed SQL queries in Mentors/Web.py
 * mypage fully fixed, it shows lintian errors and import errors from the
   importer


Modified: website/cgi-bin/Mentors/Database.py
===================================================================
--- website/cgi-bin/Mentors/Database.py	2005-12-30 19:29:52 UTC (rev 43)
+++ website/cgi-bin/Mentors/Database.py	2005-12-30 23:37:02 UTC (rev 44)
@@ -3,7 +3,9 @@
 """
 
 import MySQLdb
-import Config
+import sys
+sys.path.append('/etc/mentors')
+import Config # global config from /etc/mentors
 
 class Database:
    def __init__(self):

Modified: website/cgi-bin/Mentors/Signup.py
===================================================================
--- website/cgi-bin/Mentors/Signup.py	2005-12-30 19:29:52 UTC (rev 43)
+++ website/cgi-bin/Mentors/Signup.py	2005-12-30 23:37:02 UTC (rev 44)
@@ -2,6 +2,10 @@
 
 import Web
 import Email
+import sys
+import re
+sys.path.append('/etc/mentors')
+import Config # global config from /etc/mentors
 
 class Signup(Web.CGI):
    def __init__(self, cginame, print_debug=False):
@@ -272,14 +276,14 @@
    #      - SSH2 public key
    def signup_validate(self):
       dbcursor = self.db.cursor()
-      query = "SELECT COUNT(id) FROM users WHERE email='%(email)s" % { 'email':self.formfields.getvalue('email') }
+      query = "SELECT COUNT(id) AS count FROM %(users)s WHERE email='%(email)s'" % { 'email':self.formfields.getvalue('email'), 'users':Config.DatabaseTableUsers }
       dbcursor.execute(query)
       result = dbcursor.fetchone()
       if self.formfields.getvalue('user') == '':
          return "Full name is a required field."
       if self.formfields.getvalue('email') == '':
          return "E-mail is a required field."
-      if result != None:
+      if result["count"] != 0:
          return "Mail address already exists."
       if self.formfields.getvalue('pwd') == '' or self.formfields.getvalue('repwd') == '':
          return "Password is a required field."
@@ -287,38 +291,33 @@
          return "Passwords don't match"
       if self.formfields.getvalue('gpgkey') == '':
          return "Please provide your gpgkey."
-      if self.formfields.getvalue('sshkey') == '':
-         return "Please provide your ssh key."
-      #query = "SELECT COUNT(id) FROM users WHERE gpg_checksum='%(gpg_checksum)'" { 'gpg_checksum':calculate_checksum(self.formfields.getvalue('gpgkey')) }
-      #dbcursor.execute(query)
-      #result = dbcursor.fetchone()
-      if result != None:
+
+      query = "SELECT COUNT(id) AS count FROM %(users)s WHERE gpgkey = '%(gpgkey)s'" % { 'gpgkey':self.formfields.getvalue('gpgkey'), 'users':Config.DatabaseTableUsers }
+      dbcursor.execute(query)
+      result = dbcursor.fetchone()
+      if result["count"] != 0:
          return "GPG key already exists in database"
-      #query = "SELECT COUNT(id) FROM users WHERE ssh_checksum='%(ssh_checksum)'" { 'ssh_checksum':calculate_checksum(self.formfields.getvalue('sshkey')) }
-      #dbcursor.execute(query)
-      #result = dbcursor.fetchone()
-      if result != None:
-         return "SSH key already exists in database"
 
-      #TODO: If return self.signup_putindatabase() is enabled the signup proces
-      #        will work.
-      return True
-      #return self.signup_putindatabase()
+      regex1 = re.compile("^-----BEGIN\sPGP\sPUBLIC\sKEY\sBLOCK-----")
+      regex2 = re.compile("-----END\sPGP\sPUBLIC\sKEY\sBLOCK-----$")
+      if regex1.search(self.formfields.getvalue('gpgkey')) == None or regex2.search(self.formfields.getvalue('gpgkey')) == None:
+         return "This is not a GPG public key."
 
+      return self.signup_putindatabase()
+
    def signup_putindatabase(self):
       # Create hash
       hash = self.generate_session_id()
       list = self.signup_getform()
-      list['sshkey'] = self.formfields.getvalue('sshkey')
       list['gpgkey'] = self.formfields.getvalue('gpgkey')
       list['pwd'] = self.formfields.getvalue('pwd')
-      list['comment'] = self.formfields.getvalue('comment')
       list['country'] = self.formfields.getvalue('country')
       list['hash'] = hash
+      list['users'] = Config.DatabaseTableUsers
 
       # Put data in database
       dbcursor = self.db.cursor()
-      query = "INSERT INTO users(realname, email, country, ircnick, ssh2key, gpgkey, comment, status, password, hash) VALUES('%(user)s', '%(email)s', '%(country)s', '%(nickname)s', '%(sshkey)s', '%(gpgkey)s', '%(comment)s', 'new', '%(pwd)s', '%(hash)s')" % list
+      query = "INSERT INTO %(users)s(realname, email, country, ircnick, gpgkey, status, password, hash) VALUES('%(user)s', '%(email)s', '%(country)s', '%(nickname)s', '%(gpgkey)s', 'new', MD5('%(pwd)s'), '%(hash)s')" % list
       dbcursor.execute(query)
 
       # Send confirmation email to user.
@@ -327,7 +326,7 @@
    def signup_sendmail(self, hash):
       message = """Thank you for your interest in mentors.debian.net. You are just one step away from having your account set up so you can start uploading your own packages. This email has been sent to you to confirm that the email address is in fact yours.
 
-Please click on <a href='http://mentors-test.workaround.org/cgi-bin/signup?valid=%(hash)s'>this link</a> to have your account setup.
+Please click on http://mentors-test.workaround.org/cgi-bin/signup?valid=%(hash)sthis link to have your account setup.
 
 If you did not want to get an account at mentors.debian.net please accept our apologies. Someone seems to have abused your email address. Just reply to this mail so we can permanently block your email address.""" % { 'hash':hash }
 
@@ -339,7 +338,6 @@
       formlist['user'] = ''
       formlist['email'] = ''
       formlist['nickname'] = ''
-      formlist['sshkey'] = ''
       formlist['gpgkey'] = ''
       formlist['countries'] = self.countrylist()
       if self.formfields.has_key('user'):
@@ -349,8 +347,6 @@
       if self.formfields.has_key('nickname'):
          formlist['nickname'] = self.formfields.getvalue('nickname')
       # input type file gives only the filename back, not the path
-      #if self.formfields.has_key('sshkey'):
-      #   formlist['sshkey'] = self.formfields.getvalue('sshkey')
       #if self.formfields.has_key('gpgkey'):
       #   formlist['gpgkey'] = self.formfields.getvalue('gpgkey')
 
@@ -366,12 +362,12 @@
       if len(hash) != 40:
          return """Invalid hash or user has not signed up yet. Please signup first."""
       dbcursor = self.db.cursor()
-      query = "SELECT id FROM users WHERE hash='%(hash)s'" % { 'hash':hash }
+      query = "SELECT id FROM %(users)s WHERE hash='%(hash)s'" % { 'hash':hash, 'users':Config.DatabaseTableUsers }
       dbcursor.execute(query)
 
       result = dbcursor.fetchone()
       if result != None:
-         query = "UPDATE users SET status='active', hash='' WHERE id='%(id)s'" % { 'id':result['id'] }
+         query = "UPDATE %(users)s SET status='active', hash='' WHERE id='%(id)s'" % { 'id':result['id'], 'users':Config.DatabaseTableUsers }
          dbcursor.execute(query)
          return True
       return """No user with this hash in database."""

Modified: website/cgi-bin/Mentors/Web.py
===================================================================
--- website/cgi-bin/Mentors/Web.py	2005-12-30 19:29:52 UTC (rev 43)
+++ website/cgi-bin/Mentors/Web.py	2005-12-30 23:37:02 UTC (rev 44)
@@ -10,6 +10,8 @@
 import Database
 import re
 import time
+sys.path.append('/etc/mentors')
+import Config # global config from /etc/mentors
 
 # Enable CGI debugging only when necessary!
 # It may display secret information in case of errors!
@@ -201,14 +203,15 @@
    def del_session(self, sessionid):
       self.debug.append("Deleting session: %s" % sessionid)
       dbcursor = self.db.cursor()
-      dbcursor.execute("""delete from sessions where sessionid=%s and ipaddress=%s""", (sessionid, self.client_ip) )
+      dbcursor.execute("""DELETE FROM sessions WHERE sessionid=%s AND ipaddress=%s""", (sessionid, self.client_ip) )
 
    # Check if the email address and passwords match
    def login(self, email, password):
       dbcursor = self.db.cursor()
-      dbcursor.execute("select count(*) from users where email=%s and password=%s", (email, password) )
+      query = "SELECT COUNT(*) AS count FROM %(users)s WHERE email='%(email)s' AND password=MD5('%(pwd)s')" % { 'email':email, 'pwd':password, 'users':Config.DatabaseTableUsers }
+      dbcursor.execute(query)
       entry = dbcursor.fetchone()   # becomes None if nothing was fetched
-      if entry['count(*)'] >= 1:   # actually there should be no more than one user
+      if entry['count'] >= 1:   # actually there should be no more than one user
          return True
       return False
 
@@ -287,27 +290,29 @@
       dbcursor = self.db.cursor()
       html = ""
       if maintainer == False:
-         query = "SELECT maintainer, package, description, age, version FROM packages ORDER BY age DESC LIMIT 20"
+         query = "SELECT realname, package, description, import_timestamp, version FROM %(users)s INNER JOIN %(packages)s ON %(users)s.id = %(packages)s.user_id ORDER BY import_timestamp DESC LIMIT 20" % { 'users':Config.DatabaseTableUsers, 'packages':Config.DatabaseTablePackages }
       else:
-         query = "SELECT maintainer, package, description, age, version FROM packages WHERE maintainer LIKE '%%%(maint)s%%' ORDER BY age DESC" % { 'maint':'emeitner at f2o.org' }
-         #query = "SELECT maintainer, package, description, age, version FROM packages WHERE maintainer LIKE '%%%(maint)s%%' ORDER BY age DESC" % { 'maint':self.user_logged_in }
+         query = "SELECT realname, package, description, import_timestamp, version FROM %(users)s INNER JOIN %(packages)s ON %(users)s.id = %(packages)s.user_id WHERE email = '%(maint)s' ORDER BY import_timestamp DESC LIMIT 20" % { 'maint':self.user_logged_in, 'users':Config.DatabaseTableUsers, 'packages':Config.DatabaseTablePackages }
       dbcursor.execute(query)
       html += "<table>"
       result = dbcursor.fetchone()
       while result != None:
-         age = round((time.time() - result['age']) / (60 * 60 * 24))
-         if age == 0.0:
+         age = datetime.datetime.now() - result['import_timestamp']
+         if age.days == 0:
             age = "Today"
-         elif age == 1.0:
+         elif age.days == 1:
             age = "Yesterday"
          else:
-            age = str(age) + " days ago"
+            age = str(age.days) + " days ago"
          html += "<tr>"
-         html += "<td><a href='mypage?package=" + result['package'] + "'>" + result['package'] + "</a></td>"
+         if maintainer == False:
+            html += "<td>" + result['package'] + "</td>"
+         else:
+            html += "<td><a href='mypage?package=" + result['package'] + "'>" + result['package'] + "</a></td>"
          html += "<td>" + result['description'] + "</td>"
          html += "<td>" + result['version'] + "</td>"
          if maintainer == False:
-            html += "<td>" + re.sub("( \<.*\>)", "", result['maintainer']) + "</td>"
+            html += "<td>" + result['realname'] + "</td>"
          html += "<td>" + age + "</td>"
          html += "</tr>"
          result = dbcursor.fetchone()
@@ -316,6 +321,31 @@
 
       return html
 
+   # Get the link to the package.
+   def linktopackage(self):
+      dbcursor = self.db.cursor()
+      query = "SELECT path FROM %(packages)s WHERE package = '%(package)s'" % { 'packages':Config.DatabaseTablePackages, 'package':self.formfields["package"].value }
+      dbcursor.execute(query)
+      result = dbcursor.fetchone()
+      # FIXME: Here should be the base path from the Config object.
+      return "http://mentors.debian.net/debian/" + result["path"]
+
+   # Get messages from the importer
+   def getmsgfromimporter(self):
+      dbcursor = self.db.cursor()
+      query = "SELECT lintian_report, lintian_errors, lintian_warnings FROM %(packages)s WHERE package = '%(package)s'" % { 'packages':Config.DatabaseTablePackages, 'package':self.formfields["package"].value }
+      dbcursor.execute(query)
+      result = dbcursor.fetchone()
+      if result["lintian_report"] == "Package was not lintian checked.":
+         return """%(lintian_report)s<br />""" % { 'lintian_report':result["lintian_report"] }
+      else:
+         html = """%(lintian_report)s<br />
+<h2>Lintian Warnings:</h2><br />
+%(lintian_warnings)s<br />
+<h2>Lintian Errors:</h2><br />
+%(lintian_errors)s""" % { 'lintian_report':result["lintian_report"], 'lintian_warnings':result["lintian_warnings"], 'lintian_errors':result["lintian_errors"] }
+      return html
+
    # Create a form that allows searching for packages
    def searchform(self):
       return "Web.searchform()... needs to be written still"

Modified: website/cgi-bin/ibeodb
===================================================================
--- website/cgi-bin/ibeodb	2005-12-30 19:29:52 UTC (rev 43)
+++ website/cgi-bin/ibeodb	2005-12-30 23:37:02 UTC (rev 44)
@@ -4,9 +4,11 @@
 import Mentors.Email
 
 web = Mentors.Web.CGI(cginame='ibeodb')
-
 web.start()
 
+def generate_hash():
+   return web.generate_session_id()
+
 def sendmail():
    if web.formfields.has_key("email"):
       query = "SELECT password FROM users WHERE email='%s'" % web.formfields.getvalue("email")
@@ -60,3 +62,10 @@
 
 web.end()
 
+# email invullen
+# send email plus link hash + hash
+# geef form weer om password te veranderen
+# change password.
+
+# vim:set shiftwidth=3 expandtab textwidth=78 smarttab autoindent:
+

Modified: website/cgi-bin/mypage
===================================================================
--- website/cgi-bin/mypage	2005-12-30 19:29:52 UTC (rev 43)
+++ website/cgi-bin/mypage	2005-12-30 23:37:02 UTC (rev 44)
@@ -15,9 +15,10 @@
 Successfull uploaded to mentors.debian.net archive. You can download the
 package <a href="%(linktopackage)s">here</a>
 <h1>Problems found by the importer</h1>
-Put here some random generated message from the importer.
+%(lintian_check)s
    """ % { 'package':web.formfields["package"].value,
-           'linktopackage':'blabla' }
+           'linktopackage':web.linktopackage(),
+           'lintian_check':web.getmsgfromimporter() }
 
 def printmypage():
    print """

Modified: website/cgi-bin/signup
===================================================================
--- website/cgi-bin/signup	2005-12-30 19:29:52 UTC (rev 43)
+++ website/cgi-bin/signup	2005-12-30 23:37:02 UTC (rev 44)
@@ -6,6 +6,9 @@
 
 web.start()
 
+def print_successful():
+   print """Signup successful"""
+
 def print_form():
    print """
       <h1>Signing to mentors.debian.net</h1>
@@ -42,10 +45,6 @@
                <td><input type='file' name='gpgkey' value='%(gpgkey)s' /></td>
             </tr>
             <tr>
-               <td>Anything you like to tell?</td>
-               <td><textarea name="comment" cols="50" rows="8" id="comment"></textarea></td>
-            </tr>
-            <tr>
                <td>
                   <input type='submit' name='submit-signup' value="Submit" />
                   <input type='reset' name='reset' value="Reset" />
@@ -62,7 +61,7 @@
    else:
       submit = web.signup_validate()
       if submit == True:
-         print """Signup succesfull"""
+         print_successful()
       else:
          print submit
          print_form()




More information about the mentors-ops mailing list