RegistrationTool.py

   1 # -*- coding: utf-8 -*-
   2 #######################################################################################
   3 #   Plinn - http://plinn.org                                                          #
   4 #   © 2005-2013  Benoît PIN <pin@cri.ensmp.fr>                                        #
   5 #                                                                                     #
   6 #   This program is free software; you can redistribute it and/or                     #
   7 #   modify it under the terms of the GNU General Public License                       #
   8 #   as published by the Free Software Foundation; either version 2                    #
   9 #   of the License, or (at your option) any later version.                            #
  10 #                                                                                     #
  11 #   This program is distributed in the hope that it will be useful,                   #
  12 #   but WITHOUT ANY WARRANTY; without even the implied warranty of                    #
  13 #   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the                     #
  14 #   GNU General Public License for more details.                                      #
  15 #                                                                                     #
  16 #   You should have received a copy of the GNU General Public License                 #
  17 #   along with this program; if not, write to the Free Software                       #
  18 #   Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.   #
  19 #######################################################################################
  20 """ Plinn registration tool: implements 3 modes to register members:
  21     anonymous, manager, reviewed.
  22
  23
  24
  25 """
  26
  27 from Globals import InitializeClass, PersistentMapping
  28 from Products.PageTemplates.PageTemplateFile import PageTemplateFile
  29 from Products.CMFDefault.RegistrationTool import RegistrationTool as BaseRegistrationTool
  30 from AccessControl import ClassSecurityInfo, ModuleSecurityInfo
  31 from AccessControl.Permission import Permission
  32 from BTrees.OOBTree import OOBTree
  33 from Products.CMFCore.permissions import ManagePortal, AddPortalMember
  34 from Products.CMFCore.exceptions import AccessControl_Unauthorized
  35 from Products.CMFCore.utils import getToolByName
  36 from Products.CMFCore.utils import getUtilityByInterfaceName
  37 from Products.GroupUserFolder.GroupsToolPermissions import ManageGroups
  38 from Products.Plinn.utils import Message as _
  39 from DateTime import DateTime
  40 from types import TupleType, ListType
  41 from uuid import uuid4
  42
  43 security = ModuleSecurityInfo('Products.Plinn.RegistrationTool')
  44 MODE_ANONYMOUS = 'anonymous'
  45 security.declarePublic('MODE_ANONYMOUS')
  46
  47 MODE_MANAGER = 'manager'
  48 security.declarePublic('MODE_MANAGER')
  49
  50 MODE_REVIEWED = 'reviewed'
  51 security.declarePublic('MODE_REVIEWED')
  52
  53 MODES = [MODE_ANONYMOUS, MODE_MANAGER, MODE_REVIEWED]
  54 security.declarePublic('MODES')
  55
  56 DEFAULT_MEMBER_GROUP = 'members'
  57 security.declarePublic('DEFAULT_MEMBER_GROUP')
  58
  59
  60
  61 class RegistrationTool(BaseRegistrationTool) :
  62
  63     """ Create and modify users by making calls to portal_membership.
  64     """
  65
  66     meta_type = "Plinn Registration Tool"
  67
  68     manage_options = ({'label' : 'Registration mode', 'action' : 'manage_regmode'}, ) + \
  69                         BaseRegistrationTool.manage_options
  70
  71     security = ClassSecurityInfo()
  72
  73     security.declareProtected( ManagePortal, 'manage_regmode' )
  74     manage_regmode = PageTemplateFile('www/configureRegistrationTool', globals(),
  75                                         __name__='manage_regmode')
  76
  77     def __init__(self) :
  78         self._mode = MODE_ANONYMOUS
  79         self._chain = ''
  80         self._passwordResetRequests = OOBTree()
  81
  82     security.declareProtected(ManagePortal, 'configureTool')
  83     def configureTool(self, registration_mode, chain, REQUEST=None) :
  84         """ """
  85
  86         if registration_mode not in MODES :
  87             raise ValueError, "Unknown mode: " + registration_mode
  88         else :
  89             self._mode = registration_mode
  90             self._updatePortalRoleMappingForMode(registration_mode)
  91
  92         wtool = getToolByName(self, 'portal_workflow')
  93
  94         if registration_mode == MODE_REVIEWED :
  95             if not hasattr(wtool, '_chains_by_type') :
  96                 wtool._chains_by_type = PersistentMapping()
  97             wfids = []
  98             chain = chain.strip()
  99
 100             if chain == '(Default)' :
 101                 try : del wtool._chains_by_type['Member Data']
 102                 except KeyError : pass
 103                 self._chain = chain
 104             else :
 105                 for wfid in chain.replace(',', ' ').split(' ') :
 106                     if wfid :
 107                         if not wtool.getWorkflowById(wfid) :
 108                             raise ValueError, '"%s" is not a workflow ID.' % wfid
 109                         wfids.append(wfid)
 110
 111                 wtool._chains_by_type['Member Data'] = tuple(wfids)
 112                 self._chain = ', '.join(wfids)
 113         else :
 114             wtool._chains_by_type['Member Data'] = tuple()
 115
 116         if REQUEST :
 117             REQUEST.RESPONSE.redirect(self.absolute_url() + '/manage_regmode?manage_tabs_message=Saved changes.')
 118
 119     def _updatePortalRoleMappingForMode(self, mode) :
 120
 121         urlTool = getToolByName(self, 'portal_url')
 122         portal = urlTool.getPortalObject()
 123
 124         if mode in [MODE_ANONYMOUS, MODE_REVIEWED] :
 125             portal.manage_permission(AddPortalMember, roles = ['Anonymous', 'Manager'], acquire=1)
 126         elif mode == MODE_MANAGER :
 127             portal.manage_permission(AddPortalMember, roles = ['Manager', 'UserManager'], acquire=0)
 128
 129     security.declarePublic('getMode')
 130     def getMode(self) :
 131         # """ return current mode """
 132         return self._mode[:]
 133
 134     security.declarePublic('getWfId')
 135     def getWfChain(self) :
 136         # """ return current workflow id """
 137         return self._chain
 138
 139     security.declarePublic('roleMappingMismatch')
 140     def roleMappingMismatch(self) :
 141         # """ test if the role mapping is correct for the currrent mode """
 142
 143         mode = self._mode
 144         urlTool = getToolByName(self, 'portal_url')
 145         portal = urlTool.getPortalObject()
 146
 147         def rolesOfAddPortalMemberPerm() :
 148             p=Permission(AddPortalMember, [], portal)
 149             return p.getRoles()
 150
 151         if mode in [MODE_ANONYMOUS, MODE_REVIEWED] :
 152             if 'Anonymous' in rolesOfAddPortalMemberPerm() : return False
 153
 154         elif mode == MODE_MANAGER :
 155             roles = rolesOfAddPortalMemberPerm()
 156             if 'Manager' in roles or 'UserManager' in roles and len(roles) == 1 and type(roles) == TupleType :
 157                 return False
 158
 159         return True
 160
 161     security.declareProtected(AddPortalMember, 'addMember')
 162     def addMember(self, id, password, roles=(), groups=(DEFAULT_MEMBER_GROUP,), domains='', properties=None) :
 163         """ Idem CMFCore but without default role """
 164         BaseRegistrationTool.addMember(self, id, password, roles=roles,
 165                                        domains=domains, properties=properties)
 166
 167         if self.getMode() in [MODE_ANONYMOUS, MODE_MANAGER] :
 168             gtool = getToolByName(self, 'portal_groups')
 169             mtool = getToolByName(self, 'portal_membership')
 170             utool = getToolByName(self, 'portal_url')
 171             portal = utool.getPortalObject()
 172             isGrpManager = mtool.checkPermission(ManageGroups, portal) ## TODO : CMF2.1 compat
 173             aclu = self.aq_inner.acl_users
 174
 175             for gid in groups:
 176                 g = gtool.getGroupById(gid)
 177                 if not isGrpManager :
 178                     if gid != DEFAULT_MEMBER_GROUP:
 179                         raise AccessControl_Unauthorized, 'You are not allowed to join arbitrary group.'
 180
 181                 if g is None :
 182                     gtool.addGroup(gid)
 183                 aclu.changeUser(aclu.getGroupPrefix() +gid, roles=['Member', ])
 184                 g = gtool.getGroupById(gid)
 185                 g.addMember(id)
 186
 187
 188     def afterAdd(self, member, id, password, properties):
 189         """ notify member creation """
 190         member.notifyWorkflowCreated()
 191         member.indexObject()
 192
 193
 194     security.declarePublic('requestPasswordReset')
 195     def requestPasswordReset(self, userid):
 196         """ add uuid / (userid, expiration) pair and return uuid """
 197         self.clearExpiredPasswordResetRequests()
 198         mtool = getUtilityByInterfaceName('Products.CMFCore.interfaces.IMembershipTool')
 199         if mtool.getMemberById(userid) :
 200             uuid = str(uuid4())
 201             self._passwordResetRequests[uuid] = (userid, DateTime() + 1)
 202             return uuid
 203
 204     security.declarePrivate('clearExpiredPasswordResetRequests')
 205     def clearExpiredPasswordResetRequests(self):
 206         now = DateTime()
 207         for uuid, record in self._passwordResetRequests.items() :
 208             userid, date = record
 209             if date < now :
 210                 del self._passwordResetRequests[uuid]
 211
 212
 213     security.declarePublic('resetPassword')
 214     def resetPassword(self, userid, uuid, password, confirm) :
 215         record = self._passwordResetRequests.get(uuid)
 216         if not record :
 217             return _('Invalid reset password request.')
 218
 219         recUserid, expiration = record
 220
 221         if recUserid != userid :
 222             return _('Invalid userid.')
 223
 224         if expiration < now :
 225             self.clearExpiredPasswordResetRequests()
 226             return _('Your reset password request has expired. You can ask a new one.')
 227
 228         msg = self.testPasswordValidity(password, confirm=confirm)
 229         if not msg : # None if everything ok. Err message otherwise.
 230             mtool = getUtilityByInterfaceName('Products.CMFCore.interfaces.IMembershipTool')
 231             member = mtool.getMemberById(userid)
 232             if member :
 233                 member.setSecurityProfile(password=password)
 234                 del self._passwordResetRequests[uuid]
 235                 return _('Password successfully resetted.')
 236             else :
 237                 return _('"%s" username not found.') % userid
 238
 239
 240 InitializeClass(RegistrationTool)