Changeset 476 for stable

Timestamp:

10/03/08 16:09:05 (4 years ago)

Author:

winfried

Message:

moving the authorisation from file to db

Location:

stable

Files:

• HelpIM/intranet/lib/auth.py (deleted)
• HelpIM/intranet/lib/servletbase.py (modified) (2 diffs)
• HelpIM/intranet/lib/session.py (modified) (6 diffs)
• HelpIM/intranet/scripts/login.py (modified) (4 diffs)
• HelpIM/revision.py (modified) (1 diff)
• setup/skeleton.sql (modified) (2 diffs)

stable/HelpIM/intranet/lib/servletbase.py

@@ -9 +9 @@
 import HelpIM.logger
 import HelpIM.intranet.lib.session
-import HelpIM.intranet.lib.auth
 import HelpIM.intranet.lib.inpy
 
@@ -56 +55 @@
         # start session
         if self.cookies.get('sessid'):
-            self.session = HelpIM.intranet.lib.session.fileSession(
-                self.cookies.get('sessid'),
-                config['conf']['session']['tmpdir'])
-        else:
-            self.session = HelpIM.intranet.lib.session.fileSession(empty = True)
+            self.session = HelpIM.intranet.lib.session.dbSession(
+                self.cookies.get('sessid'))
+        else:
+            self.session = HelpIM.intranet.lib.session.dbSession(empty = True)
 
         # the whole application needs a valid user to be logged in:
-        if self.session.get('userId'):
+        if self.session.userId:
             try:
-                self.user = HelpIM.users.user(self.session['userId'])
+                self.user = HelpIM.users.user(self.session.userId)
             except AttributeError:
                 # user has been changing him / her self, clean-up autentification and login again
                 # To-Do: make this so that a relogin is only nesseceraly when user deleted him / herself
-                HelpIM.intranet.lib.auth.logout(self.session)
+                self.session.logout()
                 self.user = None
         else:

stable/HelpIM/intranet/lib/session.py

@@ -9 +9 @@
 import md5
 import random
+import datetime
 
-TEMPDIR = '/tmp'
+import HelpIM.database
+import HelpIM.users
 
-class fileSession(dict):
+class PasswordError(Exception):
+    "The password or username given are not correct."
+
+
+class dbSession():
     """
-    fileSession handles the saving and loading of a session to and from disk.
+    Session handles the saving and loading of a session to and from the database
     """
 
-    def __init__(self, sessionId='', tmpDir=TEMPDIR, empty=False):
+    def __init__(self, sessionId='', empty=False, timeOut = 5400):
         """
         Create a new session. If there is a sessionId, try to find it on disk.
@@ -24 +30 @@
         """
         self.sessionId = sessionId
-        self.tmpDir = tmpDir
-
+        self.userId = None
+        self.time_out = timeOut
         self.readSession(empty)
 
@@ -33 +39 @@
         """
         self.writeSession()
+        self.cleanStaleSessions()
 
     def getUniqueId(self):
@@ -48 +55 @@
         """
         if self.sessionId:
+            self.cleanStaleSessions()
+            c = HelpIM.database.cursor()
             try:
-                fp = file(os.path.normpath("%s/%s" % (self.tmpDir, self.sessionId)), 'rb')
-                self.update(pickle.Unpickler(fp).load()) 
-            except IOError:
-                pass
+                c.execute(["SELECT user_id FROM userSession WHERE sessionId = ", c.p(self.sessionId)])
+                result = c.fetchone()
+                if result:
+                    self.userId = result[0]
+                    c.execute(["UPDATE userSession SET lastactive = NOW() WHERE sessionId = ", c.p(self.sessionId)])
+            finally:
+                c.close()
         else:
             if not empty:
@@ -62 +74 @@
         Write The session to file.
         """
-        if self.sessionId:
-            data = {}
-            for key, value in self.items():
-                data[key] = value
-            fp = file(os.path.normpath("%s/%s" % (self.tmpDir, self.sessionId)),'wb')
-            pickle.Pickler(fp, 1).dump(data) 
+        if self.sessionId and self.userId:
+            c = HelpIM.database.cursor()
+            try:
+                c.execute(["INSERT INTO userSession SET user_id = ", c.p(self.userId),
+                           ", sessionId = ", c.p(self.sessionId),
+                           ", lastactive = NOW() ON DUPLICATE KEY UPDATE user_id = ", c.p(self.userId),
+                           ", sessionId = ", c.p(self.sessionId),
+                           ", lastactive = NOW()"])
+            finally:
+                c.close()
 
     def getSessionId(self):
@@ -76 +92 @@
         """
         return self.sessionId
+
+    def login(self, username, password):
+        """
+        Try to authorize the user
+
+        @param session: A valid session
+        @param username: A valid username
+        @param password: A valid password with the username
+        """
+        id = HelpIM.users.auth(username, password)
+        if id:
+            self.userId = id
+            self.writeSession()
+        else:
+            self.userId = None
+            raise PasswordError()
+
+    def logout(self):
+        """
+        Log the user out
+
+        @param session: The session containing a userId
+        """
+        c = HelpIM.database.cursor()
+        try:
+            c.execute(["DELETE FROM userSession WHERE sessionId = ", c.p(self.sessionId)])
+        finally:
+            c.close()
+        self.userId = None
+
+    def cleanStaleSessions(self):
+        c = HelpIM.database.cursor()
+        try:
+            c.execute(["DELETE FROM userSession WHERE lastactive < ",
+                       c.p(datetime.datetime.now()-datetime.timedelta(seconds=self.time_out))])
+        finally:
+            c.close()

stable/HelpIM/intranet/scripts/login.py

@@ -2 +2 @@
 import HelpIM.users
 import HelpIM.revision
-import HelpIM.intranet.lib.auth
 import HelpIM.intranet.lib.servletbase
+from HelpIM.intranet.lib.session import PasswordError
 
 class servlet(HelpIM.intranet.lib.servletbase.servlet):
@@ -14 +14 @@
         namespace['version'] = "HelpIM 2.2 - revision " + str(HelpIM.revision.revision)
         
-        if self.session.get('userId') is None:
+        if not self.session.userId:
             form = self.requestVars.get('form')
             if form is not None: 
                 try: 
-                    HelpIM.intranet.lib.auth.login(self.session, form.get('username'), form.get('password'))
-                except HelpIM.intranet.lib.auth.PasswordError:
+                    self.session.login(form.get('username'), form.get('password'))
+                except PasswordError:
                     namespace['errors'].append('password_invalid')
                     self.log.warn('failed login attempt: ' + form.get('username'))
@@ -33 +33 @@
                     self.log.info('login: ' + form.get('username'))
 
-        if self.session.get('userId') is not None:
-            currentuser = HelpIM.users.user(self.session['userId'])
+        if self.session.userId:
+            currentuser = HelpIM.users.user(self.session.userId)
         else:
             currentuser = None
@@ -40 +40 @@
         if self.requestVars.get('action') == 'logout':
             if currentuser is not None:
-                HelpIM.intranet.lib.auth.logout(self.session)
+                self.session.logout()
         else:
             if (currentuser is not None) and currentuser.id:

stable/HelpIM/revision.py

@@ -1 @@
-revision = '474'
+revision = '475'

stable/setup/skeleton.sql

@@ -352 +352 @@
 );
 
+CREATE TABLE userSession (
+  id int(10) unsigned NOT NULL auto_increment,
+  timestamp timestamp(14) NOT NULL,
+  user_id int(10) unsigned NOT NULL,
+  sessionId varchar(32),
+  lastactive timestamp(14),
+  PRIMARY KEY (id),
+  UNIQUE KEY user_id(user_id),
+  UNIQUE KEY sessionId(sessionId)
+);  
+
 -- When upgrading to revision 468 or higher (from a lower revision)
 -- execute these two lines of SQL:
@@ -358 +369 @@
 -- ALTER TABLE staffstatus ADD priority INT DEFAULT 1;
 
+-- When upgrading to revision 476 or higher (from a lower revision)
+-- execute these three lines of SQL:
+
+-- ALTER TABLE user ADD passwordChanged timestamp(14);
+-- ALTER TABLE user ADD lastLogin timestamp(14);
+-- ALTER TABLE user ADD passwordFailures int(10);
+
+
+
+