214 lines
7.6 KiB
Python
214 lines
7.6 KiB
Python
from pyramid.view import (
|
|
view_config,
|
|
forbidden_view_config,
|
|
)
|
|
from pyramid.httpexceptions import HTTPFound
|
|
from pyramid.security import remember, forget
|
|
from ..services.user import UserService
|
|
from ..services.blog_record import BlogRecordService
|
|
from ..forms import UserCreateForm, BlogSearchForm
|
|
from ..models.user import User
|
|
|
|
import os
|
|
import shutil
|
|
import magic
|
|
|
|
@view_config(route_name='home',
|
|
renderer='cao_blogr:templates/home.jinja2')
|
|
def home(request):
|
|
# get the last created posts
|
|
last_ten = BlogRecordService.get_last_created(request)
|
|
|
|
criteria = ''
|
|
form = BlogSearchForm(request.POST)
|
|
|
|
return {
|
|
'page_title': "Bienvenue sur mon blog",
|
|
'last_ten': last_ten,
|
|
'form': form,
|
|
'criteria': criteria,
|
|
}
|
|
|
|
|
|
@view_config(route_name='apropos',
|
|
renderer='cao_blogr:templates/apropos.jinja2')
|
|
def apropos(request):
|
|
|
|
return {
|
|
'page_title': "A propos",
|
|
}
|
|
|
|
|
|
@view_config(route_name='login', renderer='cao_blogr:templates/login.jinja2')
|
|
@forbidden_view_config(renderer='cao_blogr:templates/login.jinja2')
|
|
def login(request):
|
|
username = ''
|
|
login_url = request.route_url('login')
|
|
|
|
referrer = request.url
|
|
if referrer == login_url:
|
|
referrer = '/' # never use the login form itself as came_from
|
|
|
|
came_from = request.params.get('came_from', referrer)
|
|
username = request.POST.get('username')
|
|
userpwd = request.POST.get('password')
|
|
if username:
|
|
user = UserService.by_name(request, username)
|
|
if user and user.verify_password(userpwd):
|
|
headers = remember(request, username)
|
|
request.session.flash("Bienvenue %s !" % username, 'success')
|
|
return HTTPFound(location=came_from, headers=headers)
|
|
else:
|
|
headers = forget(request)
|
|
request.session.flash("Login et mot de passe invalides. La connexion a échoué.", "danger")
|
|
|
|
return {
|
|
'page_title': "",
|
|
'came_from': came_from,
|
|
'login_url': login_url,
|
|
}
|
|
|
|
|
|
@view_config(route_name='logout', renderer='string')
|
|
def logout(request):
|
|
username = request.authenticated_userid
|
|
headers = forget(request)
|
|
request.session.flash('Au revoir ' + username + ' !', 'success')
|
|
return HTTPFound(location=request.route_url('home'), headers=headers)
|
|
|
|
|
|
@view_config(route_name='users', renderer='cao_blogr:templates/users.jinja2', permission='manage')
|
|
def users(request):
|
|
# get all users
|
|
users = UserService.all(request)
|
|
return {
|
|
'page_title': "Liste des utilisateurs",
|
|
'users': users
|
|
}
|
|
|
|
|
|
@view_config(route_name='user_edit', renderer='cao_blogr:templates/user_edit.jinja2', permission='view')
|
|
def user_edit(request):
|
|
message = ''
|
|
name = request.matchdict['name']
|
|
url = request.route_url('user_edit', name=name)
|
|
if request.authenticated_userid == 'admin':
|
|
url_retour = request.route_url('users')
|
|
else:
|
|
url_retour = request.route_url('home')
|
|
|
|
if name == '0':
|
|
# nouvel utilisateur
|
|
user = User()
|
|
form = UserCreateForm(request.POST, user)
|
|
page_title = "Nouvel utilisateur"
|
|
else:
|
|
# lire la fiche du user
|
|
user = UserService.by_name(request, name)
|
|
if not user:
|
|
request.session.flash("Utilisateur non trouvé : %s" % name, 'danger')
|
|
return HTTPFound(location=url_retour)
|
|
|
|
form = UserCreateForm(request.POST, user)
|
|
page_title = "Modification utilisateur"
|
|
|
|
|
|
if 'form.submitted' in request.params and form.validate():
|
|
# controle que le password a moins 6 car
|
|
if len(form.password.data) < 6 :
|
|
message = "Le mot de passe doit avoir au moins 6 caractères"
|
|
else:
|
|
if name == '0':
|
|
# en création, controler que le nouvel user n'existe pas dans la BD
|
|
new_user = UserService.by_name(request, form.name.data)
|
|
if new_user:
|
|
message = "Utilisateur déjà créé : %s" % form.name.data
|
|
else:
|
|
form.populate_obj(user)
|
|
user.set_password(form.password.data.encode('utf8'))
|
|
# créer le nouveau
|
|
request.dbsession.add(user)
|
|
request.session.flash("La fiche a été créée avec succès.", 'success')
|
|
return HTTPFound(location=url_retour)
|
|
|
|
else:
|
|
# en modif
|
|
del form.name # SECURITY: prevent overwriting of primary key
|
|
form.populate_obj(user)
|
|
user.set_password(form.password.data.encode('utf8'))
|
|
request.session.flash("La fiche a été modifiée avec succès.", 'success')
|
|
return HTTPFound(location=url_retour)
|
|
|
|
if 'form.deleted' in request.params:
|
|
UserService.delete(request, user.id)
|
|
request.session.flash("La fiche a été supprimée avec succès.", 'success')
|
|
return HTTPFound(location=url_retour)
|
|
|
|
return {
|
|
'page_title': page_title,
|
|
'message': message,
|
|
'form': form,
|
|
'url': url,
|
|
'url_retour': url_retour,
|
|
'name': name,
|
|
}
|
|
|
|
|
|
@view_config(route_name='uploads', renderer='cao_blogr:templates/uploads.jinja2', permission='view')
|
|
def uploads(request):
|
|
message = ''
|
|
folder_path = request.registry.settings['uploads_dir']
|
|
|
|
files_list = []
|
|
# récupérer tous les fichiers contenus dans dossier static/uploads
|
|
for f in os.scandir(folder_path):
|
|
files = []
|
|
files.append(request.static_url('cao_blogr:static/uploads/') + f.name)
|
|
files.append(f.name)
|
|
files_list.append(files)
|
|
|
|
|
|
if 'form.submitted' in request.params:
|
|
# controler que le nom du fichier n'est pas vide
|
|
if request.POST['uploadfile'] != b'':
|
|
# récupère le fichier download dans le dossier /tmp
|
|
input_file = request.POST['uploadfile'].file
|
|
input_name = request.POST['uploadfile'].filename
|
|
ext_allowed = ['text/plain', 'application/pdf', 'image/jpeg', 'image/jpg', 'image/png']
|
|
|
|
mime = magic.from_buffer(input_file.read(), mime=True)
|
|
import pdb;pdb.set_trace()
|
|
# types de fichiers autorisés ?
|
|
if mime not in ext_allowed:
|
|
request.session.flash("ERREUR: Le format du fichier n'est pas valide. Téléchargement impossible.", 'danger')
|
|
return HTTPFound(location=request.route_url('uploads'))
|
|
|
|
# Finally write the data to a temporary file
|
|
temp_file_path = os.path.join(folder_path, input_name)
|
|
# supprimer le fichier s'il existe déjà
|
|
if os.path.exists(temp_file_path):
|
|
os.remove(temp_file_path)
|
|
|
|
# copie le fichier upload dans temp_file
|
|
input_file.seek(0)
|
|
with open(temp_file_path, 'wb') as output_file:
|
|
shutil.copyfileobj(input_file, output_file)
|
|
|
|
# controler la taille du fichier < 4 Mo
|
|
filesize = round(os.path.getsize(temp_file_path) / 1024)
|
|
if filesize > 4096:
|
|
os.remove(temp_file_path)
|
|
request.session.flash("ERREUR: La taille du fichier dépasse la limite autorisée. Téléchargement impossible.", 'danger')
|
|
return HTTPFound(location=request.route_url('uploads'))
|
|
|
|
request.session.flash('%s : Ce fichier est téléchargé avec succès.' % input_name, 'success')
|
|
return HTTPFound(location=request.route_url('uploads'))
|
|
|
|
|
|
return {
|
|
'page_title': "Téléchargements",
|
|
'files_list': files_list
|
|
}
|
|
|
|
|