views.py 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384
  1. from urllib.parse import urlparse, urlunparse
  2. from django.conf import settings
  3. # Avoid shadowing the login() and logout() views below.
  4. from django.contrib.auth import REDIRECT_FIELD_NAME, get_user_model
  5. from django.contrib.auth import login as auth_login
  6. from django.contrib.auth import logout as auth_logout
  7. from django.contrib.auth import update_session_auth_hash
  8. from django.contrib.auth.decorators import login_not_required, login_required
  9. from django.contrib.auth.forms import (
  10. AuthenticationForm,
  11. PasswordChangeForm,
  12. PasswordResetForm,
  13. SetPasswordForm,
  14. )
  15. from django.contrib.auth.tokens import default_token_generator
  16. from django.contrib.sites.shortcuts import get_current_site
  17. from django.core.exceptions import ImproperlyConfigured, ValidationError
  18. from django.http import HttpResponseRedirect, QueryDict
  19. from django.shortcuts import resolve_url
  20. from django.urls import reverse_lazy
  21. from django.utils.decorators import method_decorator
  22. from django.utils.http import url_has_allowed_host_and_scheme, urlsafe_base64_decode
  23. from django.utils.translation import gettext_lazy as _
  24. from django.views.decorators.cache import never_cache
  25. from django.views.decorators.csrf import csrf_protect
  26. from django.views.decorators.debug import sensitive_post_parameters
  27. from django.views.generic.base import TemplateView
  28. from django.views.generic.edit import FormView
  29. UserModel = get_user_model()
  30. class RedirectURLMixin:
  31. next_page = None
  32. redirect_field_name = REDIRECT_FIELD_NAME
  33. success_url_allowed_hosts = set()
  34. def get_success_url(self):
  35. return self.get_redirect_url() or self.get_default_redirect_url()
  36. def get_redirect_url(self):
  37. """Return the user-originating redirect URL if it's safe."""
  38. redirect_to = self.request.POST.get(
  39. self.redirect_field_name, self.request.GET.get(self.redirect_field_name)
  40. )
  41. url_is_safe = url_has_allowed_host_and_scheme(
  42. url=redirect_to,
  43. allowed_hosts=self.get_success_url_allowed_hosts(),
  44. require_https=self.request.is_secure(),
  45. )
  46. return redirect_to if url_is_safe else ""
  47. def get_success_url_allowed_hosts(self):
  48. return {self.request.get_host(), *self.success_url_allowed_hosts}
  49. def get_default_redirect_url(self):
  50. """Return the default redirect URL."""
  51. if self.next_page:
  52. return resolve_url(self.next_page)
  53. raise ImproperlyConfigured("No URL to redirect to. Provide a next_page.")
  54. @method_decorator(login_not_required, name="dispatch")
  55. class LoginView(RedirectURLMixin, FormView):
  56. """
  57. Display the login form and handle the login action.
  58. """
  59. form_class = AuthenticationForm
  60. authentication_form = None
  61. template_name = "registration/login.html"
  62. redirect_authenticated_user = False
  63. extra_context = None
  64. @method_decorator(sensitive_post_parameters())
  65. @method_decorator(csrf_protect)
  66. @method_decorator(never_cache)
  67. def dispatch(self, request, *args, **kwargs):
  68. if self.redirect_authenticated_user and self.request.user.is_authenticated:
  69. redirect_to = self.get_success_url()
  70. if redirect_to == self.request.path:
  71. raise ValueError(
  72. "Redirection loop for authenticated user detected. Check that "
  73. "your LOGIN_REDIRECT_URL doesn't point to a login page."
  74. )
  75. return HttpResponseRedirect(redirect_to)
  76. return super().dispatch(request, *args, **kwargs)
  77. def get_default_redirect_url(self):
  78. """Return the default redirect URL."""
  79. if self.next_page:
  80. return resolve_url(self.next_page)
  81. else:
  82. return resolve_url(settings.LOGIN_REDIRECT_URL)
  83. def get_form_class(self):
  84. return self.authentication_form or self.form_class
  85. def get_form_kwargs(self):
  86. kwargs = super().get_form_kwargs()
  87. kwargs["request"] = self.request
  88. return kwargs
  89. def form_valid(self, form):
  90. """Security check complete. Log the user in."""
  91. auth_login(self.request, form.get_user())
  92. return HttpResponseRedirect(self.get_success_url())
  93. def get_context_data(self, **kwargs):
  94. context = super().get_context_data(**kwargs)
  95. current_site = get_current_site(self.request)
  96. context.update(
  97. {
  98. self.redirect_field_name: self.get_redirect_url(),
  99. "site": current_site,
  100. "site_name": current_site.name,
  101. **(self.extra_context or {}),
  102. }
  103. )
  104. return context
  105. class LogoutView(RedirectURLMixin, TemplateView):
  106. """
  107. Log out the user and display the 'You are logged out' message.
  108. """
  109. http_method_names = ["post", "options"]
  110. template_name = "registration/logged_out.html"
  111. extra_context = None
  112. @method_decorator(csrf_protect)
  113. @method_decorator(never_cache)
  114. def dispatch(self, request, *args, **kwargs):
  115. return super().dispatch(request, *args, **kwargs)
  116. def post(self, request, *args, **kwargs):
  117. """Logout may be done via POST."""
  118. auth_logout(request)
  119. redirect_to = self.get_success_url()
  120. if redirect_to != request.get_full_path():
  121. # Redirect to target page once the session has been cleared.
  122. return HttpResponseRedirect(redirect_to)
  123. return super().get(request, *args, **kwargs)
  124. def get_default_redirect_url(self):
  125. """Return the default redirect URL."""
  126. if self.next_page:
  127. return resolve_url(self.next_page)
  128. elif settings.LOGOUT_REDIRECT_URL:
  129. return resolve_url(settings.LOGOUT_REDIRECT_URL)
  130. else:
  131. return self.request.path
  132. def get_context_data(self, **kwargs):
  133. context = super().get_context_data(**kwargs)
  134. current_site = get_current_site(self.request)
  135. context.update(
  136. {
  137. "site": current_site,
  138. "site_name": current_site.name,
  139. "title": _("Logged out"),
  140. "subtitle": None,
  141. **(self.extra_context or {}),
  142. }
  143. )
  144. return context
  145. def logout_then_login(request, login_url=None):
  146. """
  147. Log out the user if they are logged in. Then redirect to the login page.
  148. """
  149. login_url = resolve_url(login_url or settings.LOGIN_URL)
  150. return LogoutView.as_view(next_page=login_url)(request)
  151. def redirect_to_login(next, login_url=None, redirect_field_name=REDIRECT_FIELD_NAME):
  152. """
  153. Redirect the user to the login page, passing the given 'next' page.
  154. """
  155. resolved_url = resolve_url(login_url or settings.LOGIN_URL)
  156. login_url_parts = list(urlparse(resolved_url))
  157. if redirect_field_name:
  158. querystring = QueryDict(login_url_parts[4], mutable=True)
  159. querystring[redirect_field_name] = next
  160. login_url_parts[4] = querystring.urlencode(safe="/")
  161. return HttpResponseRedirect(urlunparse(login_url_parts))
  162. # Class-based password reset views
  163. # - PasswordResetView sends the mail
  164. # - PasswordResetDoneView shows a success message for the above
  165. # - PasswordResetConfirmView checks the link the user clicked and
  166. # prompts for a new password
  167. # - PasswordResetCompleteView shows a success message for the above
  168. class PasswordContextMixin:
  169. extra_context = None
  170. def get_context_data(self, **kwargs):
  171. context = super().get_context_data(**kwargs)
  172. context.update(
  173. {"title": self.title, "subtitle": None, **(self.extra_context or {})}
  174. )
  175. return context
  176. @method_decorator(login_not_required, name="dispatch")
  177. class PasswordResetView(PasswordContextMixin, FormView):
  178. email_template_name = "registration/password_reset_email.html"
  179. extra_email_context = None
  180. form_class = PasswordResetForm
  181. from_email = None
  182. html_email_template_name = None
  183. subject_template_name = "registration/password_reset_subject.txt"
  184. success_url = reverse_lazy("password_reset_done")
  185. template_name = "registration/password_reset_form.html"
  186. title = _("Password reset")
  187. token_generator = default_token_generator
  188. @method_decorator(csrf_protect)
  189. def dispatch(self, *args, **kwargs):
  190. return super().dispatch(*args, **kwargs)
  191. def form_valid(self, form):
  192. opts = {
  193. "use_https": self.request.is_secure(),
  194. "token_generator": self.token_generator,
  195. "from_email": self.from_email,
  196. "email_template_name": self.email_template_name,
  197. "subject_template_name": self.subject_template_name,
  198. "request": self.request,
  199. "html_email_template_name": self.html_email_template_name,
  200. "extra_email_context": self.extra_email_context,
  201. }
  202. form.save(**opts)
  203. return super().form_valid(form)
  204. INTERNAL_RESET_SESSION_TOKEN = "_password_reset_token"
  205. @method_decorator(login_not_required, name="dispatch")
  206. class PasswordResetDoneView(PasswordContextMixin, TemplateView):
  207. template_name = "registration/password_reset_done.html"
  208. title = _("Password reset sent")
  209. @method_decorator(login_not_required, name="dispatch")
  210. class PasswordResetConfirmView(PasswordContextMixin, FormView):
  211. form_class = SetPasswordForm
  212. post_reset_login = False
  213. post_reset_login_backend = None
  214. reset_url_token = "set-password"
  215. success_url = reverse_lazy("password_reset_complete")
  216. template_name = "registration/password_reset_confirm.html"
  217. title = _("Enter new password")
  218. token_generator = default_token_generator
  219. @method_decorator(sensitive_post_parameters())
  220. @method_decorator(never_cache)
  221. def dispatch(self, *args, **kwargs):
  222. if "uidb64" not in kwargs or "token" not in kwargs:
  223. raise ImproperlyConfigured(
  224. "The URL path must contain 'uidb64' and 'token' parameters."
  225. )
  226. self.validlink = False
  227. self.user = self.get_user(kwargs["uidb64"])
  228. if self.user is not None:
  229. token = kwargs["token"]
  230. if token == self.reset_url_token:
  231. session_token = self.request.session.get(INTERNAL_RESET_SESSION_TOKEN)
  232. if self.token_generator.check_token(self.user, session_token):
  233. # If the token is valid, display the password reset form.
  234. self.validlink = True
  235. return super().dispatch(*args, **kwargs)
  236. else:
  237. if self.token_generator.check_token(self.user, token):
  238. # Store the token in the session and redirect to the
  239. # password reset form at a URL without the token. That
  240. # avoids the possibility of leaking the token in the
  241. # HTTP Referer header.
  242. self.request.session[INTERNAL_RESET_SESSION_TOKEN] = token
  243. redirect_url = self.request.path.replace(
  244. token, self.reset_url_token
  245. )
  246. return HttpResponseRedirect(redirect_url)
  247. # Display the "Password reset unsuccessful" page.
  248. return self.render_to_response(self.get_context_data())
  249. def get_user(self, uidb64):
  250. try:
  251. # urlsafe_base64_decode() decodes to bytestring
  252. uid = urlsafe_base64_decode(uidb64).decode()
  253. user = UserModel._default_manager.get(pk=uid)
  254. except (
  255. TypeError,
  256. ValueError,
  257. OverflowError,
  258. UserModel.DoesNotExist,
  259. ValidationError,
  260. ):
  261. user = None
  262. return user
  263. def get_form_kwargs(self):
  264. kwargs = super().get_form_kwargs()
  265. kwargs["user"] = self.user
  266. return kwargs
  267. def form_valid(self, form):
  268. user = form.save()
  269. del self.request.session[INTERNAL_RESET_SESSION_TOKEN]
  270. if self.post_reset_login:
  271. auth_login(self.request, user, self.post_reset_login_backend)
  272. return super().form_valid(form)
  273. def get_context_data(self, **kwargs):
  274. context = super().get_context_data(**kwargs)
  275. if self.validlink:
  276. context["validlink"] = True
  277. else:
  278. context.update(
  279. {
  280. "form": None,
  281. "title": _("Password reset unsuccessful"),
  282. "validlink": False,
  283. }
  284. )
  285. return context
  286. @method_decorator(login_not_required, name="dispatch")
  287. class PasswordResetCompleteView(PasswordContextMixin, TemplateView):
  288. template_name = "registration/password_reset_complete.html"
  289. title = _("Password reset complete")
  290. def get_context_data(self, **kwargs):
  291. context = super().get_context_data(**kwargs)
  292. context["login_url"] = resolve_url(settings.LOGIN_URL)
  293. return context
  294. class PasswordChangeView(PasswordContextMixin, FormView):
  295. form_class = PasswordChangeForm
  296. success_url = reverse_lazy("password_change_done")
  297. template_name = "registration/password_change_form.html"
  298. title = _("Password change")
  299. @method_decorator(sensitive_post_parameters())
  300. @method_decorator(csrf_protect)
  301. @method_decorator(login_required)
  302. def dispatch(self, *args, **kwargs):
  303. return super().dispatch(*args, **kwargs)
  304. def get_form_kwargs(self):
  305. kwargs = super().get_form_kwargs()
  306. kwargs["user"] = self.request.user
  307. return kwargs
  308. def form_valid(self, form):
  309. form.save()
  310. # Updating the password logs out all other sessions for the user
  311. # except the current one.
  312. update_session_auth_hash(self.request, form.user)
  313. return super().form_valid(form)
  314. class PasswordChangeDoneView(PasswordContextMixin, TemplateView):
  315. template_name = "registration/password_change_done.html"
  316. title = _("Password change successful")
  317. @method_decorator(login_required)
  318. def dispatch(self, *args, **kwargs):
  319. return super().dispatch(*args, **kwargs)