from re import X import sys import json import libgravatar import logging import requests import tornado.web import tornado.escape from app.classes.shared.authentication import authentication from app.classes.shared.helpers import Helpers, helper from app.classes.web.base_handler import BaseHandler from app.classes.shared.console import console from app.classes.shared.main_models import fn from app.classes.models.users import Users logger = logging.getLogger(__name__) try: import bleach except ModuleNotFoundError as e: logger.critical("Import Error: Unable to load {} module".format(e.name), exc_info=True) console.critical("Import Error: Unable to load {} module".format(e.name)) sys.exit(1) class PublicHandler(BaseHandler): def set_current_user(self, user_id: str = None): expire_days = helper.get_setting('cookie_expire') # if helper comes back with false if not expire_days: expire_days = "5" if user_id is not None: self.set_cookie("token", authentication.generate(user_id), expires_days=int(expire_days)) else: self.clear_cookie("user") def get(self, page=None): error = bleach.clean(self.get_argument('error', "Invalid Login!")) error_msg = bleach.clean(self.get_argument('error_msg', '')) page_data = {'version': helper.get_version_string(), 'error': error, 'lang': tornado.locale.get("en_EN")} # sensible defaults template = "public/404.html" if page == "login": template = "public/login.html" elif page == 404: template = "public/404.html" elif page == "error": template = "public/error.html" elif page == "logout": self.clear_cookie("user") self.clear_cookie("user_data") self.redirect('/public/login') return # if we have no page, let's go to login else: self.redirect('/public/login') return self.render( template, data=page_data, translate=self.translator.translate, error_msg = error_msg ) def post(self, page=None): if page == 'login': next_page = "/public/login" entered_username = bleach.clean(self.get_argument('username')) entered_password = bleach.clean(self.get_argument('password')) user_data = Users.get_or_none(fn.Lower(Users.username) == entered_username.lower()) # if we don't have a user if not user_data: error_msg = "Inncorrect username or password. Please try again." self.clear_cookie("user") self.clear_cookie("user_data") self.redirect('/public/login?error_msg={}'.format(error_msg)) return # if they are disabled if not user_data.enabled: error_msg = "User account disabled. Please contact your system administrator for more info." self.clear_cookie("user") self.clear_cookie("user_data") self.redirect('/public/login?error_msg={}'.format(error_msg)) return login_result = helper.verify_pass(entered_password, user_data.password) # Valid Login if login_result: self.set_current_user(user_data.user_id) logger.info("User: {} Logged in from IP: {}".format(user_data, self.get_remote_ip())) # record this login q = Users.select().where(Users.username == entered_username.lower()).get() q.last_ip = self.get_remote_ip() q.last_login = helper.get_time_as_string() q.save() # log this login self.controller.management.add_to_audit_log(user_data.user_id, "Logged in", 0, self.get_remote_ip()) if helper.get_setting("allow_nsfw_profile_pictures"): rating = "x" else: rating = "g" #Get grvatar hash for profile pictures if user_data.email != 'default@example.com' or "": g = libgravatar.Gravatar(libgravatar.sanitize_email(user_data.email)) url = g.get_image(size=80, default="404", force_default=False, rating=rating, filetype_extension=False, use_ssl=True) # + "?d=404" if requests.head(url).status_code != 404: profile_url = url else: profile_url = "/static/assets/images/faces-clipart/pic-3.png" else: profile_url = "/static/assets/images/faces-clipart/pic-3.png" next_page = "/panel/dashboard" self.redirect(next_page) else: self.clear_cookie("user") self.clear_cookie("user_data") error_msg = "Inncorrect username or password. Please try again." # log this failed login attempt self.controller.management.add_to_audit_log(user_data.user_id, "Tried to log in", 0, self.get_remote_ip()) self.redirect('/public/login?error_msg={}'.format(error_msg)) else: self.redirect("/public/login")