Python User.authorize方法代码示例

# 需要导入模块: from rainwave.user import User [as 别名]
# 或者: from rainwave.user.User import authorize [as 别名]
	def test_get_request(self):
		db.c.update("DELETE FROM r4_listeners")
		db.c.update("DELETE FROM r4_request_store")
		u = User(2)
		u.authorize(1, None, None, True)
		u.put_in_request_line(1)
		# TODO: Use proper request class here instead of DB call
		db.c.update("INSERT INTO r4_listeners (sid, user_id, listener_icecast_id) VALUES (1, %s, 1)", (u.id,))
		db.c.update("INSERT INTO r4_request_store (user_id, song_id, sid) VALUES (%s, %s, 1)", (u.id, self.song1.id,))

		e = Election.create(1)
		req = e.get_request()
		self.assertNotEqual(None, req)
		self.assertEqual(self.song1.id, req.id)

# 需要导入模块: from rainwave.user import User [as 别名]
# 或者: from rainwave.user.User import authorize [as 别名]
	def test_check_song_for_conflict(self):
		db.c.update("DELETE FROM r4_listeners")
		db.c.update("DELETE FROM r4_request_store")
	
		e = Election.create(1)
		self.assertEqual(False, e._check_song_for_conflict(self.song1))
		
		u = User(2)
		u.authorize(1, None, None, True)
		self.assertEqual(1, u.put_in_request_line(1))
		# TODO: Use proper request/user methods here instead of DB call
		db.c.update("UPDATE r4_request_line SET line_top_song_id = %s, line_expiry_tune_in = %s WHERE user_id = %s", (self.song1.id, time.time()+9999, u.id))
		db.c.update("INSERT INTO r4_listeners (sid, user_id, listener_icecast_id) VALUES (1, %s, 1)", (u.id,))
		db.c.update("INSERT INTO r4_request_store (user_id, song_id, sid) VALUES (%s, %s, 1)", (u.id, self.song1.id))
		request.update_cache(1)
		cache.update_local_cache_for_sid(1)
		self.assertEqual(True, e._check_song_for_conflict(self.song1))
		self.assertEqual(False, e._check_song_for_conflict(self.song5))
		self.assertEqual(event.ElecSongTypes.conflict, self.song5.data['entry_type'])
		self.assertEqual(event.ElecSongTypes.request, self.song1.data['entry_type'])

# 需要导入模块: from rainwave.user import User [as 别名]
# 或者: from rainwave.user.User import authorize [as 别名]
class WSHandler(tornado.websocket.WebSocketHandler):
	is_websocket = True
	local_only = False
	help_hidden = False
	locale = None
	sid = None
	uuid = None

	def check_origin(self, origin):
		if websocket_allow_from == "*":
			return True
		parsed_origin = urlparse.urlparse(origin)
		return parsed_origin.netloc.endswith(websocket_allow_from)

	def open(self, *args, **kwargs):
		super(WSHandler, self).open(*args, **kwargs)

		try:
			self.sid = int(args[0])
		except Exception:
			pass

		if not self.sid:
			self.write_message({ "wserror": { "tl_key": "missing_station_id", "text": self.locale.translate("missing_station_id") } })
			return
		if not self.sid in config.station_ids:
			self.write_message({ "wserror": { "tl_key": "invalid_station_id", "text": self.locale.translate("invalid_station_id") } })
			return

		self.locale = get_browser_locale(self)

		self.authorized = False

		self.msg_times = []
		self.throttled = False
		self.throttled_msgs = []

	def rw_finish(self, *args, **kwargs):
		self.close()

	def keep_alive(self):
		self.write_message({ "ping": { "timestamp": timestamp() }})

	def on_close(self):
		global sessions
		self.throttled_msgs = []
		if self.sid:
			sessions[self.sid].remove(self)
		super(WSHandler, self).on_close()

	def write_message(self, obj, *args, **kwargs):
		message = json.dumps(obj)
		try:
			super(WSHandler, self).write_message(message, *args, **kwargs)
		except tornado.websocket.WebSocketClosedError:
			self.on_close()
		except tornado.websocket.WebSocketError as e:
			log.exception("websocket", "WebSocket Error", e)
			try:
				self.close()
			except Exception:
				self.on_close()

	def refresh_user(self):
		self.user.refresh(self.sid)
		# TODO: DJ permission checks

	def process_throttle(self):
		if not len(self.throttled_msgs):
			self.throttled = False
			return
		self.throttled_msgs.sort()
		# log.debug("throttle", "Throttled with %s messages" % len(self.throttled_msgs))
		action = self.throttled_msgs[0]['action']
		msg = None
		if not action in nonunique_actions:
			msgs = [ m for m in self.throttled_msgs if m['action'] == action ]
			msg = msgs.pop()
			for m in msgs:
				if "message_id" in m and fieldtypes.zero_or_greater_integer(m['message_id']):
					self.write_message({
						"wsthrottle": { "tl_key": "websocket_throttle", "text": self.locale.translate("websocket_throttle") },
						"message_id": { "message_id": fieldtypes.zero_or_greater_integer(m['message_id']), "success": False, "tl_key": "websocket_throttle" }
					})
			self.throttled_msgs = [ m for m in self.throttled_msgs if m['action'] != action ]
			# log.debug("throttle", "Handling last throttled %s message." % action)
		else:
			msg = self.throttled_msgs.pop(0)
			# log.debug("throttle", "Handling last throttled %s message." % action)
		if msg:
			self._process_message(msg, is_throttle_process=True)
		tornado.ioloop.IOLoop.instance().add_timeout(datetime.timedelta(seconds=0.5), self.process_throttle)

	def should_vote_throttle(self):
		if not self.votes_by_key in votes_by:
			return 0

		vote_limit = 3
		# log.debug("vote_throttle", "%s - %s - %s" % (vote_limit, votes_by[self.votes_by_key], (timestamp() < (last_vote_by[self.votes_by_key] + vote_once_every_seconds))))
		if (votes_by[self.votes_by_key] >= vote_limit) and (timestamp() < (last_vote_by[self.votes_by_key] + vote_once_every_seconds)):
#.........这里部分代码省略.........

# 需要导入模块: from rainwave.user import User [as 别名]
# 或者: from rainwave.user.User import authorize [as 别名]

#.........这里部分代码省略.........
			self.do_phpbb_auth()
		else:
			self.rainwave_auth()

		if self.auth_required and not self.user:
			raise APIException("auth_required", http_code=403)

		if self.login_required and (not self.user or self.user.is_anonymous()):
			raise APIException("login_required", http_code=403)
		if self.tunein_required and (not self.user or not self.user.is_tunedin()):
			raise APIException("tunein_required", http_code=403)
		if self.admin_required and (not self.user or not self.user.is_admin()):
			raise APIException("admin_required", http_code=403)
		if self.dj_required and (not self.user or not self.user.is_dj()):
			raise APIException("dj_required", http_code=403)
		if self.perks_required and (not self.user or not self.user.has_perks()):
			raise APIException("perks_required", http_code=403)

		if self.unlocked_listener_only and not self.user:
			raise APIException("auth_required", http_code=403)
		elif self.unlocked_listener_only and self.user.data['listener_lock'] and self.user.data['listener_lock_sid'] != self.sid:
			raise APIException("unlocked_only", station=config.station_id_friendly[self.user.data['listener_lock_sid']], lock_counter=self.user.data['listener_lock_counter'], http_code=403)

	def do_phpbb_auth(self):
		phpbb_cookie_name = config.get("phpbb_cookie_name")
		self.user = None
		if not fieldtypes.integer(self.get_cookie(phpbb_cookie_name + "u", "")):
			self.user = User(1)
		else:
			user_id = int(self.get_cookie(phpbb_cookie_name + "u"))
			if self._verify_phpbb_session(user_id):
				# update_phpbb_session is done by verify_phpbb_session if successful
				self.user = User(user_id)
				self.user.authorize(self.sid, None, None, True)
				return True

			if not self.user and self.get_cookie(phpbb_cookie_name + "k"):
				can_login = db.c_old.fetch_var("SELECT 1 FROM phpbb_sessions_keys WHERE key_id = %s AND user_id = %s", (hashlib.md5(self.get_cookie(phpbb_cookie_name + "k")).hexdigest(), user_id))
				if can_login == 1:
					self._update_phpbb_session(self._get_phpbb_session(user_id))
					self.user = User(user_id)
					self.user.authorize(self.sid, None, None, True)
					return True
		return False

	def _verify_phpbb_session(self, user_id = None):
		# TODO: Do we want to enhance this with IP checking and other bits and pieces like phpBB does?
		if not user_id and not self.user:
			return None
		if not user_id:
			user_id = self.user.id
		cookie_session = self.get_cookie(config.get("phpbb_cookie_name") + "sid")
		if cookie_session:
			if cookie_session == db.c_old.fetch_var("SELECT session_id FROM phpbb_sessions WHERE session_user_id = %s AND session_id = %s", (user_id, cookie_session)):
				self._update_phpbb_session(cookie_session)
				return cookie_session
		return None

	def _get_phpbb_session(self, user_id = None):
		return db.c_old.fetch_var("SELECT session_id FROM phpbb_sessions WHERE session_user_id = %s ORDER BY session_last_visit DESC LIMIT 1", (user_id,))

	def _update_phpbb_session(self, session_id):
		db.c_old.update("UPDATE phpbb_sessions SET session_last_visit = %s, session_page = %s WHERE session_id = %s", (int(time.time()), "rainwave", session_id))

	def rainwave_auth(self):
		user_id_present = "user_id" in self.request.arguments

# 需要导入模块: from rainwave.user import User [as 别名]
# 或者: from rainwave.user.User import authorize [as 别名]

#.........这里部分代码省略.........
		if not self.user and self.auth_required:
			raise APIException("auth_required", http_code=403)
		elif not self.user and not self.auth_required:
			self.user = User(1)
			self.user.ip_address = self.request.remote_ip

		self.user.refresh(self.sid)

		if self.user and config.get("store_prefs"):
			self.user.save_preferences(self.request.remote_ip, self.get_cookie("r4_prefs", None))

		self.permission_checks()

	# works without touching cookies or headers, primarily used for websocket requests
	def prepare_standalone(self, message_id=None):
		self._output = {}
		if message_id != None:
			self.append("message_id", { "message_id": message_id })
		self.setup_output()
		self.arg_parse()
		self.sid_check()
		self.permission_checks()

	def do_phpbb_auth(self):
		phpbb_cookie_name = config.get("phpbb_cookie_name") + "_"
		user_id = fieldtypes.integer(self.get_cookie(phpbb_cookie_name + "u", ""))
		if not user_id:
			pass
		else:
			if self._verify_phpbb_session(user_id):
				# update_phpbb_session is done by verify_phpbb_session if successful
				self.user = User(user_id)
				self.user.ip_address = self.request.remote_ip
				self.user.authorize(self.sid, None, bypass=True)
				return True

			if not self.user and self.get_cookie(phpbb_cookie_name + "k"):
				can_login = db.c.fetch_var("SELECT 1 FROM phpbb_sessions_keys WHERE key_id = %s AND user_id = %s", (hashlib.md5(self.get_cookie(phpbb_cookie_name + "k")).hexdigest(), user_id))
				if can_login == 1:
					self._update_phpbb_session(self._get_phpbb_session(user_id))
					self.user = User(user_id)
					self.user.ip_address = self.request.remote_ip
					self.user.authorize(self.sid, None, bypass=True)
					return True
		return False

	def _verify_phpbb_session(self, user_id = None):
		# TODO: Do we want to enhance this with IP checking and other bits and pieces like phpBB does?
		if not user_id and not self.user:
			return None
		if not user_id:
			user_id = self.user.id
		cookie_session = self.get_cookie(config.get("phpbb_cookie_name") + "_sid")
		if cookie_session:
			if cookie_session == db.c.fetch_var("SELECT session_id FROM phpbb_sessions WHERE session_user_id = %s AND session_id = %s", (user_id, cookie_session)):
				self._update_phpbb_session(cookie_session)
				return cookie_session
		return None

	def _get_phpbb_session(self, user_id = None):
		return db.c.fetch_var("SELECT session_id FROM phpbb_sessions WHERE session_user_id = %s ORDER BY session_last_visit DESC LIMIT 1", (user_id,))

	def _update_phpbb_session(self, session_id):
		db.c.update("UPDATE phpbb_sessions SET session_last_visit = %s, session_page = %s WHERE session_id = %s", (int(timestamp()), "rainwave", session_id))

	def rainwave_auth(self):

# 需要导入模块: from rainwave.user import User [as 别名]
# 或者: from rainwave.user.User import authorize [as 别名]
class RequestHandler(tornado.web.RequestHandler):
	# The following variables can be overridden by you.
	# Fields is a hash with { "form_name" => (fieldtypes.[something], True|False } format, so that automatic form validation can be done for you.  True/False values are for required/optional.
	fields = {}
	# This URL variable is setup by the server decorator - DON'T TOUCH IT.
	url = False
	# Do we need a Rainwave auth key for this request?
	auth_required = True
	# return_name is used for documentation, can be an array.
	# If not inherited, return_key automatically turns into url + "_result".  Useful for simple requests like rate, vote, etc.
	return_name = False
	# Validate user's tuned in status first.
	tunein_required = False
	# Validate user's logged in status first.
	login_required = False
	# Validate user is a station administrator.
	admin_required = False
	# Validate user is currently DJing.
	dj_required = False
	# Do we need a valid SID as part of the submitted form?
	sid_required = True
	# Description string for documentation.
	description = "Undocumented."
	# Only for the backend to be called
	local_only = False
	# Should the user be free to vote and rate?
	unlocked_listener_only = False

	# Called by Tornado, allows us to setup our request as we wish. User handling, form validation, etc. take place here.
	def prepare(self):
		self._startclock = time.clock()
		self.request_ok = False
		self.user = None
		
		if self.local_only and not self.request.remote_ip in config.get("trusted_ips"):
			self.failed = True
			self.set_status(403)
			self.finish()

		if self.return_name == False:
			self.return_name = self.__class__.url + "_result"
		else:
			self.return_name = self.__class__.return_name
			
		if self.admin_required or self.dj_required:
			self.login_required = True
	
		if 'in_order' in self.request.arguments:
			self._output = []
			self._output_array = True
		else:
			self._output = {}
			self._output_array = False
			
		request_ok = True
	
		self.args = {}
		for field, field_attribs in self.__class__.fields.iteritems():
			type_cast, required = field_attribs
			if required and field not in self.request.arguments:
				self.append("error", api.returns.ErrorReturn(-1000, "Missing %s argument." % field))
				request_ok = False
			elif not required and field not in self.request.arguments:
				pass
			else:
				parsed = type_cast(self.get_argument(field))
				if parsed == None:
					self.append("error", api.returns.ErrorReturn(-1000, "Invalid argument %s: %s" % (field, getattr(fieldtypes, "%s_error" % type_cast.__name__))))
					request_ok = False
				else:
					self.args[field] = parsed

		self.sid = None
		if "sid" in self.request.arguments:
			self.sid = int(self.get_argument("sid"))
		elif self.sid_required:
			self.append("error", api.returns.ErrorReturn(-1000, "Missing station ID argument."))
			request_ok = False
		if request_ok and self.sid and not self.sid in config.station_ids:
			self.append("error", api.returns.ErrorReturn(-1000, "Invalid station ID."))
			request_ok = False
				
		if request_ok:
			authorized = self.rainwave_auth()
			if self.auth_required and not authorized:
				request_ok = False
				
		if self.unlocked_listener_only and self.user and self.user.data['listener_lock']:
			request_ok = False
			self.append("error", api.returns.ErrorReturn(-1000, "Listener locked to %s for %s more songs." % (config.station_id_friendly[self.user.data['listener_lock_sid']], self.user.data['listener_lock_count'])))
				
		self.request_ok = request_ok
		if not request_ok:
			self.finish()
	
	def rainwave_auth(self):
		request_ok = True
		user_id_present = "user_id" in self.request.arguments
		
		if self.auth_required and not user_id_present:
#.........这里部分代码省略.........

# 需要导入模块: from rainwave.user import User [as 别名]
# 或者: from rainwave.user.User import authorize [as 别名]
class MainIndex(tornado.web.RequestHandler):
	def prepare(self):
		# TODO: Language
		self.info = []
		self.sid = fieldtypes.integer(self.get_cookie("r4sid", "1"))
		if not self.sid:
			self.sid = 1
		
		if self.request.host == "game.rainwave.cc":
			self.sid = 1
		elif self.request.host == "ocr.rainwave.cc":
			self.sid = 2
		elif self.request.host == "covers.rainwave.cc" or self.request.host == "cover.rainwave.cc":
			self.sid = 3
		elif self.request.host == "chiptune.rainwave.cc":
			self.sid = 4
		elif self.request.host == "all.rainwave.cc":
			self.sid = 5
		
		self.set_cookie("r4sid", str(self.sid), expires_days=365, domain=".rainwave.cc")
	
		self.user = None
		if not fieldtypes.integer(self.get_cookie("phpbb3_38ie8_u", "")):
			self.user = User(1)
		else:
			user_id = int(self.get_cookie("phpbb3_38ie8_u"))
			if self.get_cookie("phpbb3_38ie8_sid"):
				session_id = db.c_old.fetch_var("SELECT session_id FROM phpbb_sessions WHERE session_id = %s AND session_user_id = %s", (self.get_cookie("phpbb3_38ie8_sid"), user_id))
				if session_id:
					db.c_old.update("UPDATE phpbb_sessions SET session_last_visit = %s, session_page = %s WHERE session_id = %s", (time.time(), "rainwave", session_id))
					self.user = User(user_id)
					self.user.authorize(self.sid, None, None, True)

			if not self.user and self.get_cookie("phpbb3_38ie8_k"):
				can_login = db.c_old.fetch_var("SELECT 1 FROM phpbb_sessions_keys WHERE key_id = %s AND user_id = %s", (hashlib.md5(self.get_cookie("phpbb3_38ie8_k")).hexdigest(), user_id))
				if can_login == 1:
					self.user = User(user_id)
					self.user.authorize(self.sid, None, None, True)

		if not self.user:
			self.user = User(1)
		self.user.ensure_api_key(self.request.remote_ip)
		self.user.data['sid'] = self.sid
		
	# this is so that get_info can be called, makes us compatible with the custom web handler used elsewhere in RW
	def append(self, key, value):
		self.info.append({ key: value })
		
	def get(self):
		info.attach_info_to_request(self)
		self.set_header("Content-Type", "text/plain")
		self.render("index.html", user=self.user, info=tornado.escape.json_encode(self.info), sid=self.sid)
		
# @handle_url("authtest_beta")
# class BetaIndex(MainIndex):
	# def get(self):
		# if self.user.data['group_id'] not in (5, 4, 8, 12, 15, 14, 17):
			# self.send_error(403)
		# else:
			# info.attach_info_to_request(self)
			# self.set_header("Content-Type", "text/plain")
			# self.render("index.html", user=self.user, info=tornado.escape.json_encode(self.info), sid=self.sid)