From 30a8dfeda6a305758b841e8d829b4c774e76fe8d Mon Sep 17 00:00:00 2001 From: Dennis Kaarsemaker Date: Thu, 15 Feb 2007 23:16:44 +0100 Subject: [PATCH] No more passwords --- Bantracker/bans.cgi | 153 +++-------------------------------------- Bantracker/plugin.py | 57 ++++++++++----- LpLogin/README.txt | 1 + LpLogin/__init__.py | 38 ++++++++++ LpLogin/config.py | 20 ++++++ LpLogin/get_ircteam.py | 43 ++++++++++++ LpLogin/plugin.py | 83 ++++++++++++++++++++++ LpLogin/test.py | 14 ++++ 8 files changed, 248 insertions(+), 161 deletions(-) create mode 100644 LpLogin/README.txt create mode 100644 LpLogin/__init__.py create mode 100644 LpLogin/config.py create mode 100755 LpLogin/get_ircteam.py create mode 100644 LpLogin/plugin.py create mode 100644 LpLogin/test.py diff --git a/Bantracker/bans.cgi b/Bantracker/bans.cgi index 17a7511..649f37f 100755 --- a/Bantracker/bans.cgi +++ b/Bantracker/bans.cgi @@ -16,144 +16,33 @@ import sys sys.path.append('/var/www/bots.ubuntulinux.nl') from commoncgi import * -import lp_auth -import sha ### Variables db = '/home/dennis/ubugtu/data/bans.db' -lp_group = 'ubuntu-irc' num_per_page = 100 con = sqlite.connect(db) cur = con.cursor() # Login check -person = None error = '' -anonymous = form.has_key('anonymous') -anonlink = '' -if anonymous: - anonlink = '&anonymous=1'; +user = None # Delete old sessions cur.execute("""DELETE FROM sessions WHERE time < %d""", int(time.time()) - 2592000 * 3) -# Registration? -if form.has_key('lpuser') and form.has_key('lpmail'): - cur.execute("""SELECT * FROM USERS WHERE username = %s""", form['lpuser'].value) - if len(cur.fetchall()): - error = """User is already registered""" - else: - import sha, commands, random - try: - newperson = lp_auth.LaunchpadPerson(nick=form['lpuser'].value, email=form['lpmail'].value) - except: - error = """Username incorrect. Your username is the $someone in - http://launchpad.net/people/$someone that is your - launchpad homepage""" - else: - mailsha = sha.new('mailto:%s' % form['lpmail'].value).hexdigest().lower() - if mailsha in newperson.mail_shasums: - if not newperson.key: - error = """Your launchpad account does not have a GPG key. Please - set a GPG key on launchpad""" - else: - chars = "qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM1234567890" - password = "" - salt = "" - for i in xrange(8): - password += chars[random.randint(0,len(chars)-1)] - salt += chars[random.randint(0,len(chars)-1)] - try: - os.system('gpg --homedir /tmp --keyserver hkp://subkeys.pgp.net --recv-keys %s 2>/dev/null' % newperson.key) - (infd, outfd) = os.popen2('gpg --homedir /tmp --encrypt --armor --trust-model always --recipient %s 2>/dev/null' - % newperson.key) - infd.write(password) - infd.close() - gpg = outfd.read() - outfd.close() - except: - error = "A gpg error occured. Please check your key on launchpad" - else: - fd = os.popen('mail -a "From: Ubugtu " -s "Your bantracker account" %s' - % form['lpmail'].value.replace('ubuntu@sourceguru.net','mezzle@gmail.com'), 'w') - fd.write(gpg) - fd.close() - error = "Your password has been sent (encrypted) to your e-mail address" - cur.execute("""INSERT INTO users (username, salt, password) VALUES (%s, %s, %s)""", - (form['lpuser'].value, salt, - sha.new(salt + sha.new(password + salt).hexdigest().lower()).hexdigest().lower())) - con.commit() - else: - error = """Username and mailaddress don't match. Username is the $someone - in http://launchpad.net/people/$someone that is your - launchpad homepage""" # Session handling +if form.has_key('sess'): + cookie['sess'] = form['sess'].value if cookie.has_key('sess'): try: sess = cookie['sess'].value cur.execute("""SELECT user FROM sessions WHERE session_id=%s""",sess) user = cur.fetchall()[0][0] - person = pickle.loads(user) except: con.commit() pass -# Login -if not person and form.has_key('user') and form.has_key('pw'): - import sha - cur.execute("SELECT salt, password FROM users WHERE username = %s", form['user'].value) - data = cur.fetchall() - if data: - salt, password = data[0] - if password != sha.new(salt + sha.new(form['pw'].value + salt).hexdigest().lower()).hexdigest().lower(): - error = "Username or password incorrect" - else: - try: - person = lp_auth.LaunchpadPerson(nick = form['user'].value) - except lp_auth.LaunchpadException: - person = None - error = 'An error occured while talking to launchpad' - person.authenticated = True - if person.check_group_membership(lp_group): - # Create a session - sessid = md5.new('%s%s%d' % (os.environ['REMOTE_ADDR'], time.time(), random.randint(1,100000))).hexdigest() - cookie['sess'] = sessid - try: - cur.execute("""INSERT INTO sessions (session_id, user, time) VALUES - (%s, %s, %d);""", (sessid, pickle.dumps(person), int(time.time()))) - except: - con.commit() - raise - con.commit() - else: - person.authenticated = False - error = "You are not in the '%s' group on launchpad" % lp_group - -# Not authenticated. -if not (person and person.authenticated) and not anonymous: - if error: - print """%s""" % error - print """
- Login:
-
- Password:
-
- -
-
- No account yet? Enter your launchpad name and mailaddress - here.

- Name:
-
- Mail address:
-

- -
- Browse the bantracker anonymously - """ - send_page('bans.tmpl') - # Log if form.has_key('log'): cur.execute("""SELECT log FROM bans WHERE id=%s""", form['log'].value) @@ -164,23 +53,22 @@ if form.has_key('log'): # Main page # Process comments -if form.has_key('comment') and form.has_key('comment_id') and not anonymous: +if form.has_key('comment') and form.has_key('comment_id') and user: cur.execute("""SELECT ban_id FROM comments WHERE ban_id=%s and comment=%s""", (form['comment_id'].value, form['comment'].value)) comm = cur.fetchall() if not len(comm): cur.execute("""INSERT INTO comments (ban_id, who, comment, time) VALUES (%s, %s, %s, %s)""", - (form['comment_id'].value,person.name,form['comment'].value,pickle.dumps(datetime.datetime.now(pytz.UTC)))) + (form['comment_id'].value,user,form['comment'].value,pickle.dumps(datetime.datetime.now(pytz.UTC)))) con.commit() # Write the page print '
' -if anonymous: - print '' # Personal data print '
' -if not anonymous: - print 'Logged in as: %s
' % person.name +if user: + print 'Logged in as: %s
' % user + print 'Timezone: ' if form.has_key('tz') and form['tz'].value in pytz.common_timezones: tz = form['tz'].value @@ -196,23 +84,6 @@ for zone in pytz.common_timezones: print ' selected="selected"' print ">%s" % zone print '
' -if not anonymous: - if form.has_key('pw1') and form.has_key('pw2'): - pw1 = form['pw1'].value; pw2 = form['pw2'].value - if pw1 and pw2: - if pw1 != pw2: - print "Passwords don't match!
" - else: - cur.execute("SELECT salt FROM users WHERE username = %s", person.nick) - salt = cur.fetchall()[0][0] - cur.execute("UPDATE USERS SET password = %s WHERE username = %s", - (sha.new(salt + sha.new(pw1 + salt).hexdigest().lower()).hexdigest().lower(), person.nick)) - con.commit() - print '
' - print 'Password: ' - print '' - print '' - print '
' print '
' tz = pytz.timezone(tz) @@ -220,8 +91,6 @@ tz = pytz.timezone(tz) # Search form print '' # Empty log div, will be filled with AJAX @@ -282,7 +151,7 @@ for h in [['Channel',0], ['Nick/Mask',1], ['Operator',2], ['Time',6]]: if v < 10: h[1] += 10 except: pass - print '%s' % (h[1],anonlink,h[0]) + print '%s' % (h[1],h[0]) print 'Log' # Select and filter bans @@ -385,7 +254,7 @@ for b in bans[start:end]: print q(c[1]) print u'
%s, %s

' % \ (c[0],pickle.loads(c[2]).astimezone(tz).strftime("%b %d %Y %H:%M:%S")) - if not anonymous: + if user: print """Add comment""" % b[6] print """