Produits Entr'ouvert » Authentic 2

{% load i18n staticfiles %}

{% extends "authentic2/manager/base.html" %}

{% load i18n %}

{% block content %}

<form>

    <p>

      {% blocktrans trimmed with fullname=user.get_full_name %}

      To switch to user {{ fullname }}, use the following link

      (it expires after <span class="js-seconds-until" data-target="#su-link" data-replace="Expired!">{{ duration }}</span> seconds).

      {% endblocktrans %}

    </p>

    <p>

        <a id='su-link' href="{{ su_url }}">{{ su_url }}</a>

    </p>

    <script>

      window.a2_js_seconds_until();

    </script>

</form>

{% endblock %}

        url(r'^users/(?P<pk>\d+)/su/$', user_views.su,

            name='a2-manager-user-su'),

from django.core.exceptions import PermissionDenied

from django.contrib.auth import get_user_model, REDIRECT_FIELD_NAME

from django.views.generic import FormView, TemplateView, DetailView

from authentic2.utils import build_su_url, send_password_reset_mail, redirect, select_next_url, make_url

                    TitleMixin, PermissionMixin, MediaMixin)

User = get_user_model()

            yield Action('su', _('Impersonate this user'),

                         url_name='a2-manager-user-su')

    def action_su(self, request, *args, **kwargs):

        return redirect(request, 'auth_logout',

                        params={REDIRECT_FIELD_NAME: build_su_url(self.object)})

class UserSuView(MediaMixin, TitleMixin, PermissionMixin, DetailView):

    model = User

    template_name = 'authentic2/manager/user_su.html'

    title = _('Switch user')

    duration = 30  # seconds

    class Media:

        js = (

            'authentic2/js/js_seconds_until.js',

        )

    def dispatch(self, request, *args, **kwargs):

        if not request.user.is_superuser:

            raise PermissionDenied

        return super(UserSuView, self).dispatch(request, *args, **kwargs)

    def get_context_data(self, **kwargs):

        ctx = super(UserSuView, self).get_context_data(**kwargs)

        ctx['su_url'] = make_url(

            'auth_logout',

            params={REDIRECT_FIELD_NAME: build_su_url(self.object, self.duration)},

            request=self.request,

            absolute=True)

        ctx['duration'] = self.duration

        return ctx

su = UserSuView.as_view()

  window.a2_js_seconds_until = function () {

      var spans = document.getElementsByClassName('js-seconds-until');

      if (! spans.length) {

        return;

      }

      var span = spans[0];

      var timeout_id;

      var initial_time = Date.now();

      var until = initial_time + parseInt(span.textContent) * 1000;

      function decrease_seconds() {

        var now = Date.now();

        var duration = (until - now) / 1000;

        if (duration < 1) {

          var target_selector = span.getAttribute('data-target');

          if (target_selector) {

            var target = document.querySelector(target_selector);

            var replace = span.getAttribute('data-replace');

            if (replace) {

              target.innerHtml = '';

              target.textContent = replace;

              if (target.href) {

                  target.href = '';

              }

            } else {

              /* remove the target */

              target.parentNode.removeChild(target);

            }

          } else {

            /* remove the container */

            span.parentNode.parentNode.removeChild(span.parentNode);

          }

          clearInterval(timeout_id);

        } else {

          /* decrease seconds before retry */

          span.textContent = Math.floor(duration).toString();

        }

      }

      timeout_id = setInterval(decrease_seconds, 500);

  window.a2_js_seconds_until();

    url(r'^su/(?P<token>[a-f0-9]+)/$', views.su, name='su'),

import re

def build_su_url(user, duration=30):

    token = get_hex_uuid()

    data = {'user_pk': user.pk}

    cache.set('switch-%s' % token, data, duration)

    return make_url('su', kwargs={'token': token})

HEX_RE = re.compile('^[a-f0-9]+$')

def get_su_user(token):

    User = get_user_model()

    if not token:

        return None

    if not HEX_RE.match(token):

        return None

    key = 'switch-%s' % token

    data = cache.get(key)

    if not isinstance(data, dict):

        return None

    if not data.get('user_pk'):

        return None

    cache.delete(key)

    try:

        return User.objects.get(pk=data['user_pk'])

    except User.DoesNotExist:

        return None

class SuView(View):

    def get(self, request, token):

        user = utils.get_su_user(token)

        if not user:

            raise Http404

        return utils.simulate_authentication(request, user, 'su')

su = SuView.as_view()

def app_factory():

    try:

        def factory(hostname='localhost'):

            return django_webtest.DjangoTestApp(extra_environ={'HTTP_HOST': hostname})

        yield factory

    finally:

        wtm._unpatch_settings()

@pytest.fixture

def app(app_factory):

    return app_factory()

def test_su_permission(app, admin, simple_user):

    resp = login(app, admin, '/manage/users/%s/' % simple_user.pk)

    assert len(resp.pyquery('button[name="su"]')) == 0

    assert app.get('/manage/users/%s/su/' % simple_user.pk, status=403)

def test_su_superuser_post(app, app_factory, superuser, simple_user):

    resp = login(app, superuser, '/manage/users/%s/' % simple_user.pk)

    assert len(resp.pyquery('button[name="su"]')) == 1

    su_resp = resp.form.submit(name='su')

    new_app = app_factory()

    new_app.get(su_resp.location).maybe_follow()

    assert new_app.session['_auth_user_id'] == str(simple_user.pk)

def test_su_superuser_dialog(app, app_factory, superuser, simple_user):

    resp = login(app, superuser, '/manage/users/%s/' % simple_user.pk)

    assert len(resp.pyquery('button[name="su"]')) == 1

    su_view_url = resp.pyquery('button[name="su"]')[0].get('data-url')

    resp = app.get(su_view_url)

    anchors = resp.pyquery('a#su-link')

    assert len(anchors) == 1

    su_url = anchors[0].get('href')

    new_app = app_factory()

    new_app.get(su_url).maybe_follow()

    assert new_app.session['_auth_user_id'] == str(simple_user.pk)