|
|
@ -153,7 +153,7 @@ class UserManager(BaseUserManager): |
|
|
|
|
|
|
|
|
user.set_password(password) |
|
|
user.set_password(password) |
|
|
if su: |
|
|
if su: |
|
|
user.is_superuser=True |
|
|
user.is_superuser = True |
|
|
user.save(using=self._db) |
|
|
user.save(using=self._db) |
|
|
return user |
|
|
return user |
|
|
|
|
|
|
|
|
@ -171,7 +171,9 @@ class UserManager(BaseUserManager): |
|
|
""" |
|
|
""" |
|
|
return self._create_user(pseudo, surname, email, password, True) |
|
|
return self._create_user(pseudo, surname, email, password, True) |
|
|
|
|
|
|
|
|
class User(RevMixin, FieldPermissionModelMixin, AbstractBaseUser, PermissionsMixin, AclMixin): |
|
|
|
|
|
|
|
|
class User(RevMixin, FieldPermissionModelMixin, AbstractBaseUser, |
|
|
|
|
|
PermissionsMixin, AclMixin): |
|
|
""" Definition de l'utilisateur de base. |
|
|
""" Definition de l'utilisateur de base. |
|
|
Champs principaux : name, surnname, pseudo, email, room, password |
|
|
Champs principaux : name, surnname, pseudo, email, room, password |
|
|
Herite du django BaseUser et du système d'auth django""" |
|
|
Herite du django BaseUser et du système d'auth django""" |
|
|
@ -219,7 +221,11 @@ class User(RevMixin, FieldPermissionModelMixin, AbstractBaseUser, PermissionsMix |
|
|
registered = models.DateTimeField(auto_now_add=True) |
|
|
registered = models.DateTimeField(auto_now_add=True) |
|
|
telephone = models.CharField(max_length=15, blank=True, null=True) |
|
|
telephone = models.CharField(max_length=15, blank=True, null=True) |
|
|
uid_number = models.PositiveIntegerField(default=auto_uid, unique=True) |
|
|
uid_number = models.PositiveIntegerField(default=auto_uid, unique=True) |
|
|
rezo_rez_uid = models.PositiveIntegerField(unique=True, blank=True, null=True) |
|
|
rezo_rez_uid = models.PositiveIntegerField( |
|
|
|
|
|
unique=True, |
|
|
|
|
|
blank=True, |
|
|
|
|
|
null=True |
|
|
|
|
|
) |
|
|
|
|
|
|
|
|
USERNAME_FIELD = 'pseudo' |
|
|
USERNAME_FIELD = 'pseudo' |
|
|
REQUIRED_FIELDS = ['surname', 'email'] |
|
|
REQUIRED_FIELDS = ['surname', 'email'] |
|
|
@ -228,13 +234,18 @@ class User(RevMixin, FieldPermissionModelMixin, AbstractBaseUser, PermissionsMix |
|
|
|
|
|
|
|
|
class Meta: |
|
|
class Meta: |
|
|
permissions = ( |
|
|
permissions = ( |
|
|
("change_user_password", "Peut changer le mot de passe d'un user"), |
|
|
("change_user_password", |
|
|
|
|
|
"Peut changer le mot de passe d'un user"), |
|
|
("change_user_state", "Peut éditer l'etat d'un user"), |
|
|
("change_user_state", "Peut éditer l'etat d'un user"), |
|
|
("change_user_force", "Peut forcer un déménagement"), |
|
|
("change_user_force", "Peut forcer un déménagement"), |
|
|
("change_user_shell", "Peut éditer le shell d'un user"), |
|
|
("change_user_shell", "Peut éditer le shell d'un user"), |
|
|
("change_user_groups", "Peut éditer les groupes d'un user ! Permission critique"), |
|
|
("change_user_groups", |
|
|
("change_all_users", "Peut éditer tous les users, y compris ceux dotés de droits. Superdroit"), |
|
|
"Peut éditer les groupes d'un user ! Permission critique"), |
|
|
("view_user", "Peut voir un objet user quelquonque"), |
|
|
("change_all_users", |
|
|
|
|
|
"Peut éditer tous les users, y compris ceux dotés de droits. " |
|
|
|
|
|
"Superdroit"), |
|
|
|
|
|
("view_user", |
|
|
|
|
|
"Peut voir un objet user quelquonque"), |
|
|
) |
|
|
) |
|
|
|
|
|
|
|
|
@cached_property |
|
|
@cached_property |
|
|
@ -286,7 +297,7 @@ class User(RevMixin, FieldPermissionModelMixin, AbstractBaseUser, PermissionsMix |
|
|
@property |
|
|
@property |
|
|
def is_admin(self): |
|
|
def is_admin(self): |
|
|
""" Renvoie si l'user est admin""" |
|
|
""" Renvoie si l'user est admin""" |
|
|
admin,_ = Group.objects.get_or_create(name="admin") |
|
|
admin, _ = Group.objects.get_or_create(name="admin") |
|
|
return self.is_superuser or admin in self.groups.all() |
|
|
return self.is_superuser or admin in self.groups.all() |
|
|
|
|
|
|
|
|
def get_full_name(self): |
|
|
def get_full_name(self): |
|
|
@ -393,8 +404,9 @@ class User(RevMixin, FieldPermissionModelMixin, AbstractBaseUser, PermissionsMix |
|
|
|
|
|
|
|
|
def has_access(self): |
|
|
def has_access(self): |
|
|
""" Renvoie si un utilisateur a accès à internet """ |
|
|
""" Renvoie si un utilisateur a accès à internet """ |
|
|
return self.state == User.STATE_ACTIVE\ |
|
|
return (self.state == User.STATE_ACTIVE and |
|
|
and not self.is_ban() and (self.is_connected() or self.is_whitelisted()) |
|
|
not self.is_ban() and |
|
|
|
|
|
(self.is_connected() or self.is_whitelisted())) |
|
|
|
|
|
|
|
|
def end_access(self): |
|
|
def end_access(self): |
|
|
""" Renvoie la date de fin normale d'accès (adhésion ou whiteliste)""" |
|
|
""" Renvoie la date de fin normale d'accès (adhésion ou whiteliste)""" |
|
|
@ -480,7 +492,8 @@ class User(RevMixin, FieldPermissionModelMixin, AbstractBaseUser, PermissionsMix |
|
|
self.assign_ips() |
|
|
self.assign_ips() |
|
|
self.state = User.STATE_ACTIVE |
|
|
self.state = User.STATE_ACTIVE |
|
|
|
|
|
|
|
|
def ldap_sync(self, base=True, access_refresh=True, mac_refresh=True, group_refresh=False): |
|
|
def ldap_sync(self, base=True, access_refresh=True, mac_refresh=True, |
|
|
|
|
|
group_refresh=False): |
|
|
""" Synchronisation du ldap. Synchronise dans le ldap les attributs de |
|
|
""" Synchronisation du ldap. Synchronise dans le ldap les attributs de |
|
|
self |
|
|
self |
|
|
Options : base : synchronise tous les attributs de base - nom, prenom, |
|
|
Options : base : synchronise tous les attributs de base - nom, prenom, |
|
|
@ -573,12 +586,15 @@ class User(RevMixin, FieldPermissionModelMixin, AbstractBaseUser, PermissionsMix |
|
|
'asso_mail': AssoOption.get_cached_value('contact'), |
|
|
'asso_mail': AssoOption.get_cached_value('contact'), |
|
|
'site_name': GeneralOption.get_cached_value('site_name'), |
|
|
'site_name': GeneralOption.get_cached_value('site_name'), |
|
|
'url': request.build_absolute_uri( |
|
|
'url': request.build_absolute_uri( |
|
|
reverse('users:process', kwargs={'token': req.token})), |
|
|
reverse('users:process', kwargs={'token': req.token}) |
|
|
'expire_in': str(GeneralOption.get_cached_value('req_expire_hrs')) + ' heures', |
|
|
), |
|
|
} |
|
|
'expire_in': str( |
|
|
|
|
|
GeneralOption.get_cached_value('req_expire_hrs') |
|
|
|
|
|
) + ' heures', |
|
|
|
|
|
} |
|
|
send_mail( |
|
|
send_mail( |
|
|
'Changement de mot de passe du %(name)s / Password\ |
|
|
'Changement de mot de passe du %(name)s / Password renewal for ' |
|
|
renewal for %(name)s' % {'name': AssoOption.get_cached_value('name')}, |
|
|
'%(name)s' % {'name': AssoOption.get_cached_value('name')}, |
|
|
template.render(context), |
|
|
template.render(context), |
|
|
GeneralOption.get_cached_value('email_from'), |
|
|
GeneralOption.get_cached_value('email_from'), |
|
|
[req.user.email], |
|
|
[req.user.email], |
|
|
@ -590,7 +606,9 @@ class User(RevMixin, FieldPermissionModelMixin, AbstractBaseUser, PermissionsMix |
|
|
""" Fonction appellée par freeradius. Enregistre la mac pour |
|
|
""" Fonction appellée par freeradius. Enregistre la mac pour |
|
|
une machine inconnue sur le compte de l'user""" |
|
|
une machine inconnue sur le compte de l'user""" |
|
|
all_interfaces = self.user_interfaces(active=False) |
|
|
all_interfaces = self.user_interfaces(active=False) |
|
|
if all_interfaces.count() > OptionalMachine.get_cached_value('max_lambdauser_interfaces'): |
|
|
if all_interfaces.count() > OptionalMachine.get_cached_value( |
|
|
|
|
|
'max_lambdauser_interfaces' |
|
|
|
|
|
): |
|
|
return False, "Maximum de machines enregistrees atteinte" |
|
|
return False, "Maximum de machines enregistrees atteinte" |
|
|
if not nas_type: |
|
|
if not nas_type: |
|
|
return False, "Re2o ne sait pas à quel machinetype affecter cette\ |
|
|
return False, "Re2o ne sait pas à quel machinetype affecter cette\ |
|
|
@ -625,9 +643,9 @@ class User(RevMixin, FieldPermissionModelMixin, AbstractBaseUser, PermissionsMix |
|
|
template = loader.get_template('users/email_auto_newmachine') |
|
|
template = loader.get_template('users/email_auto_newmachine') |
|
|
context = Context({ |
|
|
context = Context({ |
|
|
'nom': self.get_full_name(), |
|
|
'nom': self.get_full_name(), |
|
|
'mac_address' : interface.mac_address, |
|
|
'mac_address': interface.mac_address, |
|
|
'asso_name': AssoOption.get_cached_value('name'), |
|
|
'asso_name': AssoOption.get_cached_value('name'), |
|
|
'interface_name' : interface.domain, |
|
|
'interface_name': interface.domain, |
|
|
'asso_email': AssoOption.get_cached_value('contact'), |
|
|
'asso_email': AssoOption.get_cached_value('contact'), |
|
|
'pseudo': self.pseudo, |
|
|
'pseudo': self.pseudo, |
|
|
}) |
|
|
}) |
|
|
@ -674,13 +692,13 @@ class User(RevMixin, FieldPermissionModelMixin, AbstractBaseUser, PermissionsMix |
|
|
:param self: The user which is to be edited. |
|
|
:param self: The user which is to be edited. |
|
|
:param user_request: The user who requests to edit self. |
|
|
:param user_request: The user who requests to edit self. |
|
|
:return: a message and a boolean which is True if self is a club and |
|
|
:return: a message and a boolean which is True if self is a club and |
|
|
user_request one of its member, or if user_request is self, or if |
|
|
user_request one of its member, or if user_request is self, or if |
|
|
user_request has the 'cableur' right. |
|
|
user_request has the 'cableur' right. |
|
|
""" |
|
|
""" |
|
|
if self.is_class_club and user_request.is_class_adherent: |
|
|
if self.is_class_club and user_request.is_class_adherent: |
|
|
if self == user_request or \ |
|
|
if (self == user_request or |
|
|
user_request.has_perm('users.change_user') or \ |
|
|
user_request.has_perm('users.change_user') or |
|
|
user_request.adherent in self.club.administrators.all(): |
|
|
user_request.adherent in self.club.administrators.all()): |
|
|
return True, None |
|
|
return True, None |
|
|
else: |
|
|
else: |
|
|
return False, u"Vous n'avez pas le droit d'éditer ce club" |
|
|
return False, u"Vous n'avez pas le droit d'éditer ce club" |
|
|
@ -691,52 +709,70 @@ class User(RevMixin, FieldPermissionModelMixin, AbstractBaseUser, PermissionsMix |
|
|
return True, None |
|
|
return True, None |
|
|
elif user_request.has_perm('users.change_user'): |
|
|
elif user_request.has_perm('users.change_user'): |
|
|
if self.groups.filter(listright__critical=True): |
|
|
if self.groups.filter(listright__critical=True): |
|
|
return False, u"Utilisateurs avec droits critiques, ne peut etre édité" |
|
|
return False, (u"Utilisateurs avec droits critiques, ne " |
|
|
|
|
|
"peut etre édité") |
|
|
elif self == AssoOption.get_cached_value('utilisateur_asso'): |
|
|
elif self == AssoOption.get_cached_value('utilisateur_asso'): |
|
|
return False, u"Impossible d'éditer l'utilisateur asso sans droit change_all_users" |
|
|
return False, (u"Impossible d'éditer l'utilisateur asso " |
|
|
|
|
|
"sans droit change_all_users") |
|
|
else: |
|
|
else: |
|
|
return True, None |
|
|
return True, None |
|
|
elif user_request.has_perm('users.change_all_users'): |
|
|
elif user_request.has_perm('users.change_all_users'): |
|
|
return True, None |
|
|
return True, None |
|
|
else: |
|
|
else: |
|
|
return False, u"Vous ne pouvez éditer un autre utilisateur que vous même" |
|
|
return False, (u"Vous ne pouvez éditer un autre utilisateur " |
|
|
|
|
|
"que vous même") |
|
|
|
|
|
|
|
|
def can_change_password(self, user_request, *args, **kwargs): |
|
|
def can_change_password(self, user_request, *args, **kwargs): |
|
|
if self.is_class_club and user_request.is_class_adherent: |
|
|
if self.is_class_club and user_request.is_class_adherent: |
|
|
if self == user_request or \ |
|
|
if (self == user_request or |
|
|
user_request.has_perm('users.change_user_password') or \ |
|
|
user_request.has_perm('users.change_user_password') or |
|
|
user_request.adherent in self.club.administrators.all(): |
|
|
user_request.adherent in self.club.administrators.all()): |
|
|
return True, None |
|
|
return True, None |
|
|
else: |
|
|
else: |
|
|
return False, u"Vous n'avez pas le droit d'éditer ce club" |
|
|
return False, u"Vous n'avez pas le droit d'éditer ce club" |
|
|
else: |
|
|
else: |
|
|
if self == user_request or \ |
|
|
if (self == user_request or |
|
|
user_request.has_perm('users.change_user_groups'): |
|
|
user_request.has_perm('users.change_user_groups')): |
|
|
# Peut éditer les groupes d'un user, c'est un privilège élevé, True |
|
|
# Peut éditer les groupes d'un user, |
|
|
|
|
|
# c'est un privilège élevé, True |
|
|
return True, None |
|
|
return True, None |
|
|
elif user_request.has_perm('users.change_user') and not self.groups.all(): |
|
|
elif (user_request.has_perm('users.change_user') and |
|
|
|
|
|
not self.groups.all()): |
|
|
return True, None |
|
|
return True, None |
|
|
else: |
|
|
else: |
|
|
return False, u"Vous ne pouvez éditer un autre utilisateur que vous même" |
|
|
return False, (u"Vous ne pouvez éditer un autre utilisateur " |
|
|
|
|
|
"que vous même") |
|
|
|
|
|
|
|
|
def check_selfpasswd(self, user_request, *args, **kwargs): |
|
|
def check_selfpasswd(self, user_request, *args, **kwargs): |
|
|
return user_request == self, None |
|
|
return user_request == self, None |
|
|
|
|
|
|
|
|
@staticmethod |
|
|
@staticmethod |
|
|
def can_change_state(user_request, *args, **kwargs): |
|
|
def can_change_state(user_request, *args, **kwargs): |
|
|
return user_request.has_perm('users.change_user_state'), "Droit requis pour changer l'état" |
|
|
return ( |
|
|
|
|
|
user_request.has_perm('users.change_user_state'), |
|
|
|
|
|
"Droit requis pour changer l'état" |
|
|
|
|
|
) |
|
|
|
|
|
|
|
|
@staticmethod |
|
|
@staticmethod |
|
|
def can_change_shell(user_request, *args, **kwargs): |
|
|
def can_change_shell(user_request, *args, **kwargs): |
|
|
return user_request.has_perm('users.change_user_shell'), "Droit requis pour changer le shell" |
|
|
return ( |
|
|
|
|
|
user_request.has_perm('users.change_user_shell'), |
|
|
|
|
|
"Droit requis pour changer le shell" |
|
|
|
|
|
) |
|
|
|
|
|
|
|
|
@staticmethod |
|
|
@staticmethod |
|
|
def can_change_force(user_request, *args, **kwargs): |
|
|
def can_change_force(user_request, *args, **kwargs): |
|
|
return user_request.has_perm('users.change_user_force'), "Droit requis pour forcer le déménagement" |
|
|
return ( |
|
|
|
|
|
user_request.has_perm('users.change_user_force'), |
|
|
|
|
|
"Droit requis pour forcer le déménagement" |
|
|
|
|
|
) |
|
|
|
|
|
|
|
|
@staticmethod |
|
|
@staticmethod |
|
|
def can_change_groups(user_request, *args, **kwargs): |
|
|
def can_change_groups(user_request, *args, **kwargs): |
|
|
return user_request.has_perm('users.change_user_groups'), "Droit requis pour éditer les groupes de l'user" |
|
|
return ( |
|
|
|
|
|
user_request.has_perm('users.change_user_groups'), |
|
|
|
|
|
"Droit requis pour éditer les groupes de l'user" |
|
|
|
|
|
) |
|
|
|
|
|
|
|
|
def can_view(self, user_request, *args, **kwargs): |
|
|
def can_view(self, user_request, *args, **kwargs): |
|
|
"""Check if an user can view an user object. |
|
|
"""Check if an user can view an user object. |
|
|
@ -744,45 +780,55 @@ class User(RevMixin, FieldPermissionModelMixin, AbstractBaseUser, PermissionsMix |
|
|
:param self: The targeted user. |
|
|
:param self: The targeted user. |
|
|
:param user_request: The user who ask for viewing the target. |
|
|
:param user_request: The user who ask for viewing the target. |
|
|
:return: A boolean telling if the acces is granted and an explanation |
|
|
:return: A boolean telling if the acces is granted and an explanation |
|
|
text |
|
|
text |
|
|
""" |
|
|
""" |
|
|
if self.is_class_club and user_request.is_class_adherent: |
|
|
if self.is_class_club and user_request.is_class_adherent: |
|
|
if self == user_request or \ |
|
|
if (self == user_request or |
|
|
user_request.has_perm('users.view_user') or \ |
|
|
user_request.has_perm('users.view_user') or |
|
|
user_request.adherent in self.club.administrators.all() or \ |
|
|
user_request.adherent in self.club.administrators.all() or |
|
|
user_request.adherent in self.club.members.all(): |
|
|
user_request.adherent in self.club.members.all()): |
|
|
return True, None |
|
|
return True, None |
|
|
else: |
|
|
else: |
|
|
return False, u"Vous n'avez pas le droit de voir ce club" |
|
|
return False, u"Vous n'avez pas le droit de voir ce club" |
|
|
else: |
|
|
else: |
|
|
if self == user_request or user_request.has_perm('users.view_user'): |
|
|
if (self == user_request or |
|
|
|
|
|
user_request.has_perm('users.view_user')): |
|
|
return True, None |
|
|
return True, None |
|
|
else: |
|
|
else: |
|
|
return False, u"Vous ne pouvez voir un autre utilisateur que vous même" |
|
|
return False, (u"Vous ne pouvez voir un autre utilisateur " |
|
|
|
|
|
"que vous même") |
|
|
|
|
|
|
|
|
def can_view_all(user_request, *args, **kwargs): |
|
|
def can_view_all(user_request, *args, **kwargs): |
|
|
"""Check if an user can access to the list of every user objects |
|
|
"""Check if an user can access to the list of every user objects |
|
|
|
|
|
|
|
|
:param user_request: The user who wants to view the list. |
|
|
:param user_request: The user who wants to view the list. |
|
|
:return: True if the user can view the list and an explanation message. |
|
|
:return: True if the user can view the list and an explanation |
|
|
|
|
|
message. |
|
|
""" |
|
|
""" |
|
|
return user_request.has_perm('users.view_user'), u"Vous n'avez pas accès à la liste des utilisateurs." |
|
|
return ( |
|
|
|
|
|
user_request.has_perm('users.view_user'), |
|
|
|
|
|
u"Vous n'avez pas accès à la liste des utilisateurs." |
|
|
|
|
|
) |
|
|
|
|
|
|
|
|
def can_delete(self, user_request, *args, **kwargs): |
|
|
def can_delete(self, user_request, *args, **kwargs): |
|
|
"""Check if an user can delete an user object. |
|
|
"""Check if an user can delete an user object. |
|
|
|
|
|
|
|
|
:param self: The user who is to be deleted. |
|
|
:param self: The user who is to be deleted. |
|
|
:param user_request: The user who requests deletion. |
|
|
:param user_request: The user who requests deletion. |
|
|
:return: True if user_request has the right 'bureau', and a message. |
|
|
:return: True if user_request has the right 'bureau', and a |
|
|
|
|
|
message. |
|
|
""" |
|
|
""" |
|
|
return user_request.has_perm('users.delete_user'), u"Vous ne pouvez pas supprimer cet utilisateur." |
|
|
return ( |
|
|
|
|
|
user_request.has_perm('users.delete_user'), |
|
|
|
|
|
u"Vous ne pouvez pas supprimer cet utilisateur." |
|
|
|
|
|
) |
|
|
|
|
|
|
|
|
def __init__(self, *args, **kwargs): |
|
|
def __init__(self, *args, **kwargs): |
|
|
super(User, self).__init__(*args, **kwargs) |
|
|
super(User, self).__init__(*args, **kwargs) |
|
|
self.field_permissions = { |
|
|
self.field_permissions = { |
|
|
'shell' : self.can_change_shell, |
|
|
'shell': self.can_change_shell, |
|
|
'force' : self.can_change_force, |
|
|
'force': self.can_change_force, |
|
|
'selfpasswd' : self.check_selfpasswd, |
|
|
'selfpasswd': self.check_selfpasswd, |
|
|
} |
|
|
} |
|
|
|
|
|
|
|
|
def __str__(self): |
|
|
def __str__(self): |
|
|
@ -812,16 +858,20 @@ class Adherent(User): |
|
|
|
|
|
|
|
|
:param user_request: The user who wants to create a user object. |
|
|
:param user_request: The user who wants to create a user object. |
|
|
:return: a message and a boolean which is True if the user can create |
|
|
:return: a message and a boolean which is True if the user can create |
|
|
an user or if the `options.all_can_create` is set. |
|
|
a user or if the `options.all_can_create` is set. |
|
|
""" |
|
|
""" |
|
|
if(not user_request.is_authenticated and not OptionalUser.get_cached_value('self_adhesion')): |
|
|
if (not user_request.is_authenticated and |
|
|
|
|
|
not OptionalUser.get_cached_value('self_adhesion')): |
|
|
return False, None |
|
|
return False, None |
|
|
else: |
|
|
else: |
|
|
if(OptionalUser.get_cached_value('all_can_create_adherent') or OptionalUser.get_cached_value('self_adhesion')): |
|
|
if (OptionalUser.get_cached_value('all_can_create_adherent') or |
|
|
|
|
|
OptionalUser.get_cached_value('self_adhesion')): |
|
|
return True, None |
|
|
return True, None |
|
|
else: |
|
|
else: |
|
|
return user_request.has_perm('users.add_user'), u"Vous n'avez pas le\ |
|
|
return ( |
|
|
droit de créer un utilisateur" |
|
|
user_request.has_perm('users.add_user'), |
|
|
|
|
|
u"Vous n'avez pas le droit de créer un utilisateur" |
|
|
|
|
|
) |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
class Club(User): |
|
|
class Club(User): |
|
|
@ -843,7 +893,7 @@ class Club(User): |
|
|
related_name='club_members' |
|
|
related_name='club_members' |
|
|
) |
|
|
) |
|
|
mailing = models.BooleanField( |
|
|
mailing = models.BooleanField( |
|
|
default = False |
|
|
default=False |
|
|
) |
|
|
) |
|
|
|
|
|
|
|
|
def can_create(user_request, *args, **kwargs): |
|
|
def can_create(user_request, *args, **kwargs): |
|
|
@ -851,7 +901,7 @@ class Club(User): |
|
|
|
|
|
|
|
|
:param user_request: The user who wants to create a user object. |
|
|
:param user_request: The user who wants to create a user object. |
|
|
:return: a message and a boolean which is True if the user can create |
|
|
:return: a message and a boolean which is True if the user can create |
|
|
an user or if the `options.all_can_create` is set. |
|
|
an user or if the `options.all_can_create` is set. |
|
|
""" |
|
|
""" |
|
|
if not user_request.is_authenticated: |
|
|
if not user_request.is_authenticated: |
|
|
return False, None |
|
|
return False, None |
|
|
@ -859,19 +909,24 @@ class Club(User): |
|
|
if OptionalUser.get_cached_value('all_can_create_club'): |
|
|
if OptionalUser.get_cached_value('all_can_create_club'): |
|
|
return True, None |
|
|
return True, None |
|
|
else: |
|
|
else: |
|
|
return user_request.has_perm('users.add_user'), u"Vous n'avez pas le\ |
|
|
return ( |
|
|
droit de créer un club" |
|
|
user_request.has_perm('users.add_user'), |
|
|
|
|
|
u"Vous n'avez pas le droit de créer un club" |
|
|
|
|
|
) |
|
|
|
|
|
|
|
|
def can_view_all(user_request, *args, **kwargs): |
|
|
def can_view_all(user_request, *args, **kwargs): |
|
|
"""Check if an user can access to the list of every user objects |
|
|
"""Check if an user can access to the list of every user objects |
|
|
|
|
|
|
|
|
:param user_request: The user who wants to view the list. |
|
|
:param user_request: The user who wants to view the list. |
|
|
:return: True if the user can view the list and an explanation message. |
|
|
:return: True if the user can view the list and an explanation |
|
|
|
|
|
message. |
|
|
""" |
|
|
""" |
|
|
if user_request.has_perm('users.view_user'): |
|
|
if user_request.has_perm('users.view_user'): |
|
|
return True, None |
|
|
return True, None |
|
|
if hasattr(user_request,'is_class_adherent') and user_request.is_class_adherent: |
|
|
if (hasattr(user_request, 'is_class_adherent') and |
|
|
if user_request.adherent.club_administrator.all() or user_request.adherent.club_members.all(): |
|
|
user_request.is_class_adherent): |
|
|
|
|
|
if (user_request.adherent.club_administrator.all() or |
|
|
|
|
|
user_request.adherent.club_members.all()): |
|
|
return True, None |
|
|
return True, None |
|
|
return False, u"Vous n'avez pas accès à la liste des utilisateurs." |
|
|
return False, u"Vous n'avez pas accès à la liste des utilisateurs." |
|
|
|
|
|
|
|
|
@ -892,9 +947,15 @@ def user_post_save(sender, **kwargs): |
|
|
Synchronise le ldap""" |
|
|
Synchronise le ldap""" |
|
|
is_created = kwargs['created'] |
|
|
is_created = kwargs['created'] |
|
|
user = kwargs['instance'] |
|
|
user = kwargs['instance'] |
|
|
#if is_created: |
|
|
# TODO : remove if unnecessary |
|
|
#user.notif_inscription() |
|
|
# if is_created: |
|
|
user.ldap_sync(base=True, access_refresh=True, mac_refresh=False, group_refresh=True) |
|
|
# user.notif_inscription() |
|
|
|
|
|
user.ldap_sync( |
|
|
|
|
|
base=True, |
|
|
|
|
|
access_refresh=True, |
|
|
|
|
|
mac_refresh=False, |
|
|
|
|
|
group_refresh=True |
|
|
|
|
|
) |
|
|
regen('mailing') |
|
|
regen('mailing') |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@ -907,6 +968,7 @@ def user_post_delete(sender, **kwargs): |
|
|
user.ldap_del() |
|
|
user.ldap_del() |
|
|
regen('mailing') |
|
|
regen('mailing') |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
class ServiceUser(RevMixin, AclMixin, AbstractBaseUser): |
|
|
class ServiceUser(RevMixin, AclMixin, AbstractBaseUser): |
|
|
""" Classe des users daemons, règle leurs accès au ldap""" |
|
|
""" Classe des users daemons, règle leurs accès au ldap""" |
|
|
readonly = 'readonly' |
|
|
readonly = 'readonly' |
|
|
@ -977,6 +1039,7 @@ class ServiceUser(RevMixin, AclMixin, AbstractBaseUser): |
|
|
def __str__(self): |
|
|
def __str__(self): |
|
|
return self.pseudo |
|
|
return self.pseudo |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@receiver(post_save, sender=ServiceUser) |
|
|
@receiver(post_save, sender=ServiceUser) |
|
|
def service_user_post_save(sender, **kwargs): |
|
|
def service_user_post_save(sender, **kwargs): |
|
|
""" Synchronise un service user ldap après modification django""" |
|
|
""" Synchronise un service user ldap après modification django""" |
|
|
@ -1019,8 +1082,8 @@ class ListRight(RevMixin, AclMixin, Group): |
|
|
unique=True, |
|
|
unique=True, |
|
|
validators=[RegexValidator( |
|
|
validators=[RegexValidator( |
|
|
'^[a-z]+$', |
|
|
'^[a-z]+$', |
|
|
message="Les groupes unix ne peuvent contenir\ |
|
|
message=("Les groupes unix ne peuvent contenir que des lettres " |
|
|
que des lettres minuscules" |
|
|
"minuscules") |
|
|
)] |
|
|
)] |
|
|
) |
|
|
) |
|
|
gid = models.PositiveIntegerField(unique=True, null=True) |
|
|
gid = models.PositiveIntegerField(unique=True, null=True) |
|
|
@ -1148,10 +1211,10 @@ class Ban(RevMixin, AclMixin, models.Model): |
|
|
:return: A boolean telling if the acces is granted and an explanation |
|
|
:return: A boolean telling if the acces is granted and an explanation |
|
|
text |
|
|
text |
|
|
""" |
|
|
""" |
|
|
if not user_request.has_perm('users.view_ban') and\ |
|
|
if (not user_request.has_perm('users.view_ban') and |
|
|
self.user != user_request: |
|
|
self.user != user_request): |
|
|
return False, u"Vous n'avez pas le droit de voir les bannissements\ |
|
|
return False, (u"Vous n'avez pas le droit de voir les " |
|
|
autre que les vôtres" |
|
|
"bannissements autre que les vôtres") |
|
|
else: |
|
|
else: |
|
|
return True, None |
|
|
return True, None |
|
|
|
|
|
|
|
|
@ -1213,10 +1276,10 @@ class Whitelist(RevMixin, AclMixin, models.Model): |
|
|
:return: A boolean telling if the acces is granted and an explanation |
|
|
:return: A boolean telling if the acces is granted and an explanation |
|
|
text |
|
|
text |
|
|
""" |
|
|
""" |
|
|
if not user_request.has_perm('users.view_whitelist') and\ |
|
|
if (not user_request.has_perm('users.view_whitelist') and |
|
|
self.user != user_request: |
|
|
self.user != user_request): |
|
|
return False, u"Vous n'avez pas le droit de voir les accès\ |
|
|
return False, (u"Vous n'avez pas le droit de voir les accès " |
|
|
gracieux autre que les vôtres" |
|
|
"gracieux autre que les vôtres") |
|
|
else: |
|
|
else: |
|
|
return True, None |
|
|
return True, None |
|
|
|
|
|
|
|
|
@ -1270,8 +1333,12 @@ class Request(models.Model): |
|
|
|
|
|
|
|
|
def save(self): |
|
|
def save(self): |
|
|
if not self.expires_at: |
|
|
if not self.expires_at: |
|
|
self.expires_at = timezone.now() \ |
|
|
self.expires_at = (timezone.now() + |
|
|
+ datetime.timedelta(hours=GeneralOption.get_cached_value('req_expire_hrs')) |
|
|
datetime.timedelta( |
|
|
|
|
|
hours=GeneralOption.get_cached_value( |
|
|
|
|
|
'req_expire_hrs' |
|
|
|
|
|
) |
|
|
|
|
|
)) |
|
|
if not self.token: |
|
|
if not self.token: |
|
|
self.token = str(uuid.uuid4()).replace('-', '') # remove hyphens |
|
|
self.token = str(uuid.uuid4()).replace('-', '') # remove hyphens |
|
|
super(Request, self).save() |
|
|
super(Request, self).save() |
|
|
@ -1375,7 +1442,10 @@ class LdapUserGroup(ldapdb.models.Model): |
|
|
|
|
|
|
|
|
# attributes |
|
|
# attributes |
|
|
gid = ldapdb.models.fields.IntegerField(db_column='gidNumber') |
|
|
gid = ldapdb.models.fields.IntegerField(db_column='gidNumber') |
|
|
members = ldapdb.models.fields.ListField(db_column='memberUid', blank=True) |
|
|
members = ldapdb.models.fields.ListField( |
|
|
|
|
|
db_column='memberUid', |
|
|
|
|
|
blank=True |
|
|
|
|
|
) |
|
|
name = ldapdb.models.fields.CharField( |
|
|
name = ldapdb.models.fields.CharField( |
|
|
db_column='cn', |
|
|
db_column='cn', |
|
|
max_length=200, |
|
|
max_length=200, |
|
|
|