Source Code for Module django.contrib.admin.views.decorators

  1  import base64 
  2  import md5 
  3  import cPickle as pickle 
  4  try: 
  5      from functools import wraps 
  6  except ImportError: 
  7      from django.utils.functional import wraps  # Python 2.3, 2.4 fallback. 
  8   
  9  from django import http, template 
 10  from django.conf import settings 
 11  from django.contrib.auth.models import User 
 12  from django.contrib.auth import authenticate, login 
 13  from django.shortcuts import render_to_response 
 14  from django.utils.translation import ugettext_lazy, ugettext as _ 
 15  from django.utils.safestring import mark_safe 
 16   
 17  ERROR_MESSAGE = ugettext_lazy("Please enter a correct username and password. Note that both fields are case-sensitive.") 
 18  LOGIN_FORM_KEY = 'this_is_the_login_form' 
 19   
 20 -def _display_login_form(request, error_message=''): 
 21      request.session.set_test_cookie() 
 22      if request.POST and 'post_data' in request.POST: 
 23          # User has failed login BUT has previously saved post data. 
 24          post_data = request.POST['post_data'] 
 25      elif request.POST: 
 26          # User's session must have expired; save their post data. 
 27          post_data = _encode_post_data(request.POST) 
 28      else: 
 29          post_data = _encode_post_data({}) 
 30      return render_to_response('admin/login.html', { 
 31          'title': _('Log in'), 
 32          'app_path': mark_safe(request.path), 
 33          'post_data': post_data, 
 34          'error_message': error_message 
 35      }, context_instance=template.RequestContext(request)) 
 36   
 37 -def _encode_post_data(post_data): 
 38      pickled = pickle.dumps(post_data) 
 39      pickled_md5 = md5.new(pickled + settings.SECRET_KEY).hexdigest() 
 40      return base64.encodestring(pickled + pickled_md5) 
 41   
 42 -def _decode_post_data(encoded_data): 
 43      encoded_data = base64.decodestring(encoded_data) 
 44      pickled, tamper_check = encoded_data[:-32], encoded_data[-32:] 
 45      if md5.new(pickled + settings.SECRET_KEY).hexdigest() != tamper_check: 
 46          from django.core.exceptions import SuspiciousOperation 
 47          raise SuspiciousOperation, "User may have tampered with session cookie." 
 48      return pickle.loads(pickled) 
 49   
 50 -def staff_member_required(view_func): 
 51      """ 
 52      Decorator for views that checks that the user is logged in and is a staff 
 53      member, displaying the login page if necessary. 
 54      """ 
 55      def _checklogin(request, *args, **kwargs): 
 56          if request.user.is_authenticated() and request.user.is_staff: 
 57              # The user is valid. Continue to the admin page. 
 58              if 'post_data' in request.POST: 
 59                  # User must have re-authenticated through a different window 
 60                  # or tab. 
 61                  request.POST = _decode_post_data(request.POST['post_data']) 
 62              return view_func(request, *args, **kwargs) 
 63   
 64          assert hasattr(request, 'session'), "The Django admin requires session middleware to be installed. Edit your MIDDLEWARE_CLASSES setting to insert 'django.contrib.sessions.middleware.SessionMiddleware'." 
 65   
 66          # If this isn't already the login page, display it. 
 67          if LOGIN_FORM_KEY not in request.POST: 
 68              if request.POST: 
 69                  message = _("Please log in again, because your session has expired. Don't worry: Your submission has been saved.") 
 70              else: 
 71                  message = "" 
 72              return _display_login_form(request, message) 
 73   
 74          # Check that the user accepts cookies. 
 75          if not request.session.test_cookie_worked(): 
 76              message = _("Looks like your browser isn't configured to accept cookies. Please enable cookies, reload this page, and try again.") 
 77              return _display_login_form(request, message) 
 78   
 79          # Check the password. 
 80          username = request.POST.get('username', None) 
 81          password = request.POST.get('password', None) 
 82          user = authenticate(username=username, password=password) 
 83          if user is None: 
 84              message = ERROR_MESSAGE 
 85              if '@' in username: 
 86                  # Mistakenly entered e-mail address instead of username? Look it up. 
 87                  try: 
 88                      user = User.objects.get(email=username) 
 89                  except User.DoesNotExist: 
 90                      message = _("Usernames cannot contain the '@' character.") 
 91                  else: 
 92                      message = _("Your e-mail address is not your username. Try '%s' instead.") % user.username 
 93              return _display_login_form(request, message) 
 94   
 95          # The user data is correct; log in the user in and continue. 
 96          else: 
 97              if user.is_active and user.is_staff: 
 98                  login(request, user) 
 99                  # TODO: set last_login with an event. 
100                  if 'post_data' in request.POST: 
101                      post_data = _decode_post_data(request.POST['post_data']) 
102                      if post_data and LOGIN_FORM_KEY not in post_data: 
103                          # overwrite request.POST with the saved post_data, and continue 
104                          request.POST = post_data 
105                          request.user = user 
106                          return view_func(request, *args, **kwargs) 
107                      else: 
108                          request.session.delete_test_cookie() 
109                          return http.HttpResponseRedirect(request.path) 
110              else: 
111                  return _display_login_form(request, ERROR_MESSAGE) 
112   
113      return wraps(view_func)(_checklogin) 
114