users: make AuthUser propert a method, and allow override of params.

rhodecode/api/tests/test_get_repos.py

@@ -1,129 +1,129 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 
 import pytest
 
 from rhodecode.model.repo import RepoModel
 from rhodecode.api.tests.utils import (
     build_data, api_call, assert_ok, assert_error, jsonify)
 from rhodecode.model.db import User
 
 
 @pytest.mark.usefixtures("testuser_api", "app")
 class TestGetRepos(object):
     def test_api_get_repos(self):
         id_, params = build_data(self.apikey, 'get_repos')
         response = api_call(self.app, params)
 
         result = []
         for repo in RepoModel().get_all():
             result.append(repo.get_api_data(include_secrets=True))
         ret = jsonify(result)
 
         expected = ret
         assert_ok(id_, expected, given=response.body)
 
     def test_api_get_repos_only_toplevel(self, user_util):
         repo_group = user_util.create_repo_group(auto_cleanup=True)
         user_util.create_repo(parent=repo_group)
 
         id_, params = build_data(self.apikey, 'get_repos', traverse=0)
         response = api_call(self.app, params)
 
         result = []
         for repo in RepoModel().get_repos_for_root(root=None):
             result.append(repo.get_api_data(include_secrets=True))
         expected = jsonify(result)
 
         assert_ok(id_, expected, given=response.body)
 
     def test_api_get_repos_with_wrong_root(self):
         id_, params = build_data(self.apikey, 'get_repos', root='abracadabra')
         response = api_call(self.app, params)
 
         expected = 'Root repository group `abracadabra` does not exist'
         assert_error(id_, expected, given=response.body)
 
     def test_api_get_repos_with_root(self, user_util):
         repo_group = user_util.create_repo_group(auto_cleanup=True)
         repo_group_name = repo_group.group_name
 
         user_util.create_repo(parent=repo_group)
         user_util.create_repo(parent=repo_group)
 
         # nested, should not show up
         user_util._test_name = '{}/'.format(repo_group_name)
         sub_repo_group = user_util.create_repo_group(auto_cleanup=True)
         user_util.create_repo(parent=sub_repo_group)
 
         id_, params = build_data(self.apikey, 'get_repos',
                                  root=repo_group_name, traverse=0)
         response = api_call(self.app, params)
 
         result = []
         for repo in RepoModel().get_repos_for_root(repo_group):
             result.append(repo.get_api_data(include_secrets=True))
 
         assert len(result) == 2
         expected = jsonify(result)
         assert_ok(id_, expected, given=response.body)
 
     def test_api_get_repos_with_root_and_traverse(self, user_util):
         repo_group = user_util.create_repo_group(auto_cleanup=True)
         repo_group_name = repo_group.group_name
 
         user_util.create_repo(parent=repo_group)
         user_util.create_repo(parent=repo_group)
 
         # nested, should not show up
         user_util._test_name = '{}/'.format(repo_group_name)
         sub_repo_group = user_util.create_repo_group(auto_cleanup=True)
         user_util.create_repo(parent=sub_repo_group)
 
         id_, params = build_data(self.apikey, 'get_repos',
                                  root=repo_group_name, traverse=1)
         response = api_call(self.app, params)
 
         result = []
         for repo in RepoModel().get_repos_for_root(
                 repo_group_name, traverse=True):
             result.append(repo.get_api_data(include_secrets=True))
 
         assert len(result) == 3
         expected = jsonify(result)
         assert_ok(id_, expected, given=response.body)
 
     def test_api_get_repos_non_admin(self):
         id_, params = build_data(self.apikey_regular, 'get_repos')
         response = api_call(self.app, params)
 
         user = User.get_by_username(self.TEST_USER_LOGIN)
-        allowed_repos = user.AuthUser.permissions['repositories']
+        allowed_repos = user.AuthUser().permissions['repositories']
 
         result = []
         for repo in RepoModel().get_all():
             perm = allowed_repos[repo.repo_name]
             if perm in ['repository.read', 'repository.write', 'repository.admin']:
                 result.append(repo.get_api_data())
         ret = jsonify(result)
 
         expected = ret
         assert_ok(id_, expected, given=response.body)

rhodecode/apps/admin/views/permissions.py

@@ -1,369 +1,369 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2016-2017  RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import re
 import logging
 import formencode
 from pyramid.interfaces import IRoutesMapper
 
 from pyramid.view import view_config
 from pyramid.httpexceptions import HTTPFound
 from pyramid.renderers import render
 from pyramid.response import Response
 
 from rhodecode.apps._base import BaseAppView
 
 from rhodecode.lib import helpers as h
 from rhodecode.lib.auth import (
     LoginRequired, HasPermissionAllDecorator, CSRFRequired)
 from rhodecode.lib.utils2 import aslist
 from rhodecode.model.db import User, UserIpMap
 from rhodecode.model.forms import (
     ApplicationPermissionsForm, ObjectPermissionsForm, UserPermissionsForm)
 from rhodecode.model.meta import Session
 from rhodecode.model.permission import PermissionModel
 from rhodecode.model.settings import SettingsModel
 
 
 log = logging.getLogger(__name__)
 
 
 class AdminPermissionsView(BaseAppView):
     def load_default_context(self):
         c = self._get_local_tmpl_context()
 
         self._register_global_c(c)
         PermissionModel().set_global_permission_choices(
             c, gettext_translator=self.request.translate)
         return c
 
     @LoginRequired()
     @HasPermissionAllDecorator('hg.admin')
     @view_config(
         route_name='admin_permissions_application', request_method='GET',
         renderer='rhodecode:templates/admin/permissions/permissions.mako')
     def permissions_application(self):
         c = self.load_default_context()
         c.active = 'application'
 
         c.user = User.get_default_user(refresh=True)
 
         app_settings = SettingsModel().get_all_settings()
         defaults = {
             'anonymous': c.user.active,
             'default_register_message': app_settings.get(
                 'rhodecode_register_message')
         }
         defaults.update(c.user.get_default_perms())
 
         data = render('rhodecode:templates/admin/permissions/permissions.mako',
                       self._get_template_context(c), self.request)
         html = formencode.htmlfill.render(
             data,
             defaults=defaults,
             encoding="UTF-8",
             force_defaults=False
         )
         return Response(html)
 
     @LoginRequired()
     @HasPermissionAllDecorator('hg.admin')
     @CSRFRequired()
     @view_config(
         route_name='admin_permissions_application_update', request_method='POST',
         renderer='rhodecode:templates/admin/permissions/permissions.mako')
     def permissions_application_update(self):
         _ = self.request.translate
         c = self.load_default_context()
         c.active = 'application'
 
         _form = ApplicationPermissionsForm(
             [x[0] for x in c.register_choices],
             [x[0] for x in c.password_reset_choices],
             [x[0] for x in c.extern_activate_choices])()
 
         try:
             form_result = _form.to_python(dict(self.request.POST))
             form_result.update({'perm_user_name': User.DEFAULT_USER})
             PermissionModel().update_application_permissions(form_result)
 
             settings = [
                 ('register_message', 'default_register_message'),
             ]
             for setting, form_key in settings:
                 sett = SettingsModel().create_or_update_setting(
                     setting, form_result[form_key])
                 Session().add(sett)
 
             Session().commit()
             h.flash(_('Application permissions updated successfully'),
                     category='success')
 
         except formencode.Invalid as errors:
             defaults = errors.value
 
             data = render(
                 'rhodecode:templates/admin/permissions/permissions.mako',
                 self._get_template_context(c), self.request)
             html = formencode.htmlfill.render(
                 data,
                 defaults=defaults,
                 errors=errors.error_dict or {},
                 prefix_error=False,
                 encoding="UTF-8",
                 force_defaults=False
             )
             return Response(html)
 
         except Exception:
             log.exception("Exception during update of permissions")
             h.flash(_('Error occurred during update of permissions'),
                     category='error')
 
         raise HTTPFound(h.route_path('admin_permissions_application'))
 
     @LoginRequired()
     @HasPermissionAllDecorator('hg.admin')
     @view_config(
         route_name='admin_permissions_object', request_method='GET',
         renderer='rhodecode:templates/admin/permissions/permissions.mako')
     def permissions_objects(self):
         c = self.load_default_context()
         c.active = 'objects'
 
         c.user = User.get_default_user(refresh=True)
         defaults = {}
         defaults.update(c.user.get_default_perms())
 
         data = render(
             'rhodecode:templates/admin/permissions/permissions.mako',
             self._get_template_context(c), self.request)
         html = formencode.htmlfill.render(
             data,
             defaults=defaults,
             encoding="UTF-8",
             force_defaults=False
         )
         return Response(html)
 
     @LoginRequired()
     @HasPermissionAllDecorator('hg.admin')
     @CSRFRequired()
     @view_config(
         route_name='admin_permissions_object_update', request_method='POST',
         renderer='rhodecode:templates/admin/permissions/permissions.mako')
     def permissions_objects_update(self):
         _ = self.request.translate
         c = self.load_default_context()
         c.active = 'objects'
 
         _form = ObjectPermissionsForm(
             [x[0] for x in c.repo_perms_choices],
             [x[0] for x in c.group_perms_choices],
             [x[0] for x in c.user_group_perms_choices])()
 
         try:
             form_result = _form.to_python(dict(self.request.POST))
             form_result.update({'perm_user_name': User.DEFAULT_USER})
             PermissionModel().update_object_permissions(form_result)
 
             Session().commit()
             h.flash(_('Object permissions updated successfully'),
                     category='success')
 
         except formencode.Invalid as errors:
             defaults = errors.value
 
             data = render(
                 'rhodecode:templates/admin/permissions/permissions.mako',
                 self._get_template_context(c), self.request)
             html = formencode.htmlfill.render(
                 data,
                 defaults=defaults,
                 errors=errors.error_dict or {},
                 prefix_error=False,
                 encoding="UTF-8",
                 force_defaults=False
             )
             return Response(html)
         except Exception:
             log.exception("Exception during update of permissions")
             h.flash(_('Error occurred during update of permissions'),
                     category='error')
 
         raise HTTPFound(h.route_path('admin_permissions_object'))
 
     @LoginRequired()
     @HasPermissionAllDecorator('hg.admin')
     @view_config(
         route_name='admin_permissions_global', request_method='GET',
         renderer='rhodecode:templates/admin/permissions/permissions.mako')
     def permissions_global(self):
         c = self.load_default_context()
         c.active = 'global'
 
         c.user = User.get_default_user(refresh=True)
         defaults = {}
         defaults.update(c.user.get_default_perms())
 
         data = render(
             'rhodecode:templates/admin/permissions/permissions.mako',
             self._get_template_context(c), self.request)
         html = formencode.htmlfill.render(
             data,
             defaults=defaults,
             encoding="UTF-8",
             force_defaults=False
         )
         return Response(html)
 
     @LoginRequired()
     @HasPermissionAllDecorator('hg.admin')
     @CSRFRequired()
     @view_config(
         route_name='admin_permissions_global_update', request_method='POST',
         renderer='rhodecode:templates/admin/permissions/permissions.mako')
     def permissions_global_update(self):
         _ = self.request.translate
         c = self.load_default_context()
         c.active = 'global'
 
         _form = UserPermissionsForm(
             [x[0] for x in c.repo_create_choices],
             [x[0] for x in c.repo_create_on_write_choices],
             [x[0] for x in c.repo_group_create_choices],
             [x[0] for x in c.user_group_create_choices],
             [x[0] for x in c.fork_choices],
             [x[0] for x in c.inherit_default_permission_choices])()
 
         try:
             form_result = _form.to_python(dict(self.request.POST))
             form_result.update({'perm_user_name': User.DEFAULT_USER})
             PermissionModel().update_user_permissions(form_result)
 
             Session().commit()
             h.flash(_('Global permissions updated successfully'),
                     category='success')
 
         except formencode.Invalid as errors:
             defaults = errors.value
 
             data = render(
                 'rhodecode:templates/admin/permissions/permissions.mako',
                 self._get_template_context(c), self.request)
             html = formencode.htmlfill.render(
                 data,
                 defaults=defaults,
                 errors=errors.error_dict or {},
                 prefix_error=False,
                 encoding="UTF-8",
                 force_defaults=False
             )
             return Response(html)
         except Exception:
             log.exception("Exception during update of permissions")
             h.flash(_('Error occurred during update of permissions'),
                     category='error')
 
         raise HTTPFound(h.route_path('admin_permissions_global'))
 
     @LoginRequired()
     @HasPermissionAllDecorator('hg.admin')
     @view_config(
         route_name='admin_permissions_ips', request_method='GET',
         renderer='rhodecode:templates/admin/permissions/permissions.mako')
     def permissions_ips(self):
         c = self.load_default_context()
         c.active = 'ips'
 
         c.user = User.get_default_user(refresh=True)
         c.user_ip_map = (
             UserIpMap.query().filter(UserIpMap.user == c.user).all())
 
         return self._get_template_context(c)
 
     @LoginRequired()
     @HasPermissionAllDecorator('hg.admin')
     @view_config(
         route_name='admin_permissions_overview', request_method='GET',
         renderer='rhodecode:templates/admin/permissions/permissions.mako')
     def permissions_overview(self):
         c = self.load_default_context()
         c.active = 'perms'
 
         c.user = User.get_default_user(refresh=True)
-        c.perm_user = c.user.AuthUser
+        c.perm_user = c.user.AuthUser()
         return self._get_template_context(c)
 
     @LoginRequired()
     @HasPermissionAllDecorator('hg.admin')
     @view_config(
         route_name='admin_permissions_auth_token_access', request_method='GET',
         renderer='rhodecode:templates/admin/permissions/permissions.mako')
     def auth_token_access(self):
         from rhodecode import CONFIG
 
         c = self.load_default_context()
         c.active = 'auth_token_access'
 
         c.user = User.get_default_user(refresh=True)
-        c.perm_user = c.user.AuthUser
+        c.perm_user = c.user.AuthUser()
 
         mapper = self.request.registry.queryUtility(IRoutesMapper)
         c.view_data = []
 
         _argument_prog = re.compile('\{(.*?)\}|:\((.*)\)')
         introspector = self.request.registry.introspector
 
         view_intr = {}
         for view_data in introspector.get_category('views'):
             intr = view_data['introspectable']
 
             if 'route_name' in intr and intr['attr']:
                 view_intr[intr['route_name']] = '{}:{}'.format(
                     str(intr['derived_callable'].func_name), intr['attr']
                 )
 
         c.whitelist_key = 'api_access_controllers_whitelist'
         c.whitelist_file = CONFIG.get('__file__')
         whitelist_views = aslist(
             CONFIG.get(c.whitelist_key), sep=',')
 
         for route_info in mapper.get_routes():
             if not route_info.name.startswith('__'):
                 routepath = route_info.pattern
 
                 def replace(matchobj):
                     if matchobj.group(1):
                         return "{%s}" % matchobj.group(1).split(':')[0]
                     else:
                         return "{%s}" % matchobj.group(2)
 
                 routepath = _argument_prog.sub(replace, routepath)
 
                 if not routepath.startswith('/'):
                     routepath = '/' + routepath
 
                 view_fqn = view_intr.get(route_info.name, 'NOT AVAILABLE')
                 active = view_fqn in whitelist_views
                 c.view_data.append((route_info.name, view_fqn, routepath, active))
 
         c.whitelist_views = whitelist_views
         return self._get_template_context(c)

rhodecode/apps/login/tests/test_register_captcha.py

@@ -1,133 +1,133 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2016-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 
 import mock
 import pytest
 
 from rhodecode.apps.login.views import LoginView, CaptchaData
 from rhodecode.config.routing import ADMIN_PREFIX
 from rhodecode.lib.utils2 import AttributeDict
 from rhodecode.model.settings import SettingsModel
 from rhodecode.tests.utils import AssertResponse
 
 
 class RhodeCodeSetting(object):
     def __init__(self, name, value):
         self.name = name
         self.value = value
 
     def __enter__(self):
         from rhodecode.model.settings import SettingsModel
         model = SettingsModel()
         self.old_setting = model.get_setting_by_name(self.name)
         model.create_or_update_setting(name=self.name, val=self.value)
         return self
 
     def __exit__(self, exc_type, exc_val, exc_tb):
         model = SettingsModel()
         if self.old_setting:
             model.create_or_update_setting(
                 name=self.name, val=self.old_setting.app_settings_value)
         else:
             model.create_or_update_setting(name=self.name)
 
 
 class TestRegisterCaptcha(object):
 
     @pytest.mark.parametrize('private_key, public_key, expected', [
         ('',        '',       CaptchaData(False, '',        '')),
         ('',        'pubkey', CaptchaData(False, '',        'pubkey')),
         ('privkey', '',       CaptchaData(True,  'privkey', '')),
         ('privkey', 'pubkey', CaptchaData(True,  'privkey', 'pubkey')),
     ])
     def test_get_captcha_data(self, private_key, public_key, expected, db,
                               request_stub, user_util):
-        request_stub.user = user_util.create_user().AuthUser
+        request_stub.user = user_util.create_user().AuthUser()
         request_stub.matched_route = AttributeDict({'name': 'login'})
         login_view = LoginView(mock.Mock(), request_stub)
 
         with RhodeCodeSetting('captcha_private_key', private_key):
             with RhodeCodeSetting('captcha_public_key', public_key):
                 captcha = login_view._get_captcha_data()
                 assert captcha == expected
 
     @pytest.mark.parametrize('active', [False, True])
     @mock.patch.object(LoginView, '_get_captcha_data')
     def test_private_key_does_not_leak_to_html(
             self, m_get_captcha_data, active, app):
         captcha = CaptchaData(
             active=active, private_key='PRIVATE_KEY', public_key='PUBLIC_KEY')
         m_get_captcha_data.return_value = captcha
 
         response = app.get(ADMIN_PREFIX + '/register')
         assert 'PRIVATE_KEY' not in response
 
     @pytest.mark.parametrize('active', [False, True])
     @mock.patch.object(LoginView, '_get_captcha_data')
     def test_register_view_renders_captcha(
             self, m_get_captcha_data, active, app):
         captcha = CaptchaData(
             active=active, private_key='PRIVATE_KEY', public_key='PUBLIC_KEY')
         m_get_captcha_data.return_value = captcha
 
         response = app.get(ADMIN_PREFIX + '/register')
 
         assertr = AssertResponse(response)
         if active:
             assertr.one_element_exists('#recaptcha_field')
         else:
             assertr.no_element_exists('#recaptcha_field')
 
     @pytest.mark.parametrize('valid', [False, True])
     @mock.patch('rhodecode.apps.login.views.submit')
     @mock.patch.object(LoginView, '_get_captcha_data')
     def test_register_with_active_captcha(
             self, m_get_captcha_data, m_submit, valid, app, csrf_token):
         captcha = CaptchaData(
             active=True, private_key='PRIVATE_KEY', public_key='PUBLIC_KEY')
         m_get_captcha_data.return_value = captcha
         m_response = mock.Mock()
         m_response.is_valid = valid
         m_submit.return_value = m_response
 
         params = {
             'csrf_token': csrf_token,
             'email': '[e-mail]',
             'firstname': 'pytest-firstname',
             'lastname': 'pytest-lastname',
             'password': 'secret',
             'password_confirmation': 'secret',
             'username': 'pytest',
         }
         response = app.post(ADMIN_PREFIX + '/register', params=params)
 
         if valid:
             # If we provided a valid captcha input we expect a successful
             # registration and redirect to the login page.
             assert response.status_int == 302
             assert 'location' in response.headers
             assert ADMIN_PREFIX + '/login' in response.headers['location']
         else:
             # If captche input is invalid we expect to stay on the registration
             # page with an error message displayed.
             assertr = AssertResponse(response)
             assert response.status_int == 200
             assertr.one_element_exists('#recaptcha_field ~ span.error-message')

rhodecode/apps/login/views.py

@@ -1,425 +1,425 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2016-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import time
 import collections
 import datetime
 import formencode
 import logging
 import urlparse
 
 from pyramid.httpexceptions import HTTPFound
 from pyramid.view import view_config
 from recaptcha.client.captcha import submit
 
 from rhodecode.apps._base import BaseAppView
 from rhodecode.authentication.base import authenticate, HTTP_TYPE
 from rhodecode.events import UserRegistered
 from rhodecode.lib import helpers as h
 from rhodecode.lib import audit_logger
 from rhodecode.lib.auth import (
     AuthUser, HasPermissionAnyDecorator, CSRFRequired)
 from rhodecode.lib.base import get_ip_addr
 from rhodecode.lib.exceptions import UserCreationError
 from rhodecode.lib.utils2 import safe_str
 from rhodecode.model.db import User, UserApiKeys
 from rhodecode.model.forms import LoginForm, RegisterForm, PasswordResetForm
 from rhodecode.model.meta import Session
 from rhodecode.model.auth_token import AuthTokenModel
 from rhodecode.model.settings import SettingsModel
 from rhodecode.model.user import UserModel
 from rhodecode.translation import _
 
 
 log = logging.getLogger(__name__)
 
 CaptchaData = collections.namedtuple(
     'CaptchaData', 'active, private_key, public_key')
 
 
 def _store_user_in_session(session, username, remember=False):
     user = User.get_by_username(username, case_insensitive=True)
     auth_user = AuthUser(user.user_id)
     auth_user.set_authenticated()
     cs = auth_user.get_cookie_store()
     session['rhodecode_user'] = cs
     user.update_lastlogin()
     Session().commit()
 
     # If they want to be remembered, update the cookie
     if remember:
         _year = (datetime.datetime.now() +
                  datetime.timedelta(seconds=60 * 60 * 24 * 365))
         session._set_cookie_expires(_year)
 
     session.save()
 
     safe_cs = cs.copy()
     safe_cs['password'] = '****'
     log.info('user %s is now authenticated and stored in '
              'session, session attrs %s', username, safe_cs)
 
     # dumps session attrs back to cookie
     session._update_cookie_out()
     # we set new cookie
     headers = None
     if session.request['set_cookie']:
         # send set-cookie headers back to response to update cookie
         headers = [('Set-Cookie', session.request['cookie_out'])]
     return headers
 
 
 def get_came_from(request):
     came_from = safe_str(request.GET.get('came_from', ''))
     parsed = urlparse.urlparse(came_from)
     allowed_schemes = ['http', 'https']
     default_came_from = h.route_path('home')
     if parsed.scheme and parsed.scheme not in allowed_schemes:
         log.error('Suspicious URL scheme detected %s for url %s' %
                   (parsed.scheme, parsed))
         came_from = default_came_from
     elif parsed.netloc and request.host != parsed.netloc:
         log.error('Suspicious NETLOC detected %s for url %s server url '
                   'is: %s' % (parsed.netloc, parsed, request.host))
         came_from = default_came_from
     elif any(bad_str in parsed.path for bad_str in ('\r', '\n')):
         log.error('Header injection detected `%s` for url %s server url ' %
                   (parsed.path, parsed))
         came_from = default_came_from
 
     return came_from or default_came_from
 
 
 class LoginView(BaseAppView):
 
     def load_default_context(self):
         c = self._get_local_tmpl_context()
         c.came_from = get_came_from(self.request)
         self._register_global_c(c)
         return c
 
     def _get_captcha_data(self):
         settings = SettingsModel().get_all_settings()
         private_key = settings.get('rhodecode_captcha_private_key')
         public_key = settings.get('rhodecode_captcha_public_key')
         active = bool(private_key)
         return CaptchaData(
             active=active, private_key=private_key, public_key=public_key)
 
     @view_config(
         route_name='login', request_method='GET',
         renderer='rhodecode:templates/login.mako')
     def login(self):
         c = self.load_default_context()
         auth_user = self._rhodecode_user
 
         # redirect if already logged in
         if (auth_user.is_authenticated and
                 not auth_user.is_default and auth_user.ip_allowed):
             raise HTTPFound(c.came_from)
 
         # check if we use headers plugin, and try to login using it.
         try:
             log.debug('Running PRE-AUTH for headers based authentication')
             auth_info = authenticate(
                 '', '', self.request.environ, HTTP_TYPE, skip_missing=True)
             if auth_info:
                 headers = _store_user_in_session(
                     self.session, auth_info.get('username'))
                 raise HTTPFound(c.came_from, headers=headers)
         except UserCreationError as e:
             log.error(e)
             self.session.flash(e, queue='error')
 
         return self._get_template_context(c)
 
     @view_config(
         route_name='login', request_method='POST',
         renderer='rhodecode:templates/login.mako')
     def login_post(self):
         c = self.load_default_context()
 
         login_form = LoginForm()()
 
         try:
             self.session.invalidate()
             form_result = login_form.to_python(self.request.params)
             # form checks for username/password, now we're authenticated
             headers = _store_user_in_session(
                 self.session,
                 username=form_result['username'],
                 remember=form_result['remember'])
             log.debug('Redirecting to "%s" after login.', c.came_from)
 
             audit_user = audit_logger.UserWrap(
                 username=self.request.params.get('username'),
                 ip_addr=self.request.remote_addr)
             action_data = {'user_agent': self.request.user_agent}
             audit_logger.store_web(
                 'user.login.success', action_data=action_data,
                 user=audit_user, commit=True)
 
             raise HTTPFound(c.came_from, headers=headers)
         except formencode.Invalid as errors:
             defaults = errors.value
             # remove password from filling in form again
             defaults.pop('password', None)
             render_ctx = self._get_template_context(c)
             render_ctx.update({
                 'errors': errors.error_dict,
                 'defaults': defaults,
             })
 
             audit_user = audit_logger.UserWrap(
                 username=self.request.params.get('username'),
                 ip_addr=self.request.remote_addr)
             action_data = {'user_agent': self.request.user_agent}
             audit_logger.store_web(
                 'user.login.failure', action_data=action_data,
                 user=audit_user, commit=True)
             return render_ctx
 
         except UserCreationError as e:
             # headers auth or other auth functions that create users on
             # the fly can throw this exception signaling that there's issue
             # with user creation, explanation should be provided in
             # Exception itself
             self.session.flash(e, queue='error')
             return self._get_template_context(c)
 
     @CSRFRequired()
     @view_config(route_name='logout', request_method='POST')
     def logout(self):
         auth_user = self._rhodecode_user
         log.info('Deleting session for user: `%s`', auth_user)
 
         action_data = {'user_agent': self.request.user_agent}
         audit_logger.store_web(
             'user.logout', action_data=action_data,
             user=auth_user, commit=True)
         self.session.delete()
         return HTTPFound(h.route_path('home'))
 
     @HasPermissionAnyDecorator(
         'hg.admin', 'hg.register.auto_activate', 'hg.register.manual_activate')
     @view_config(
         route_name='register', request_method='GET',
         renderer='rhodecode:templates/register.mako',)
     def register(self, defaults=None, errors=None):
         c = self.load_default_context()
         defaults = defaults or {}
         errors = errors or {}
 
         settings = SettingsModel().get_all_settings()
         register_message = settings.get('rhodecode_register_message') or ''
         captcha = self._get_captcha_data()
         auto_active = 'hg.register.auto_activate' in User.get_default_user()\
-            .AuthUser.permissions['global']
+            .AuthUser().permissions['global']
 
         render_ctx = self._get_template_context(c)
         render_ctx.update({
             'defaults': defaults,
             'errors': errors,
             'auto_active': auto_active,
             'captcha_active': captcha.active,
             'captcha_public_key': captcha.public_key,
             'register_message': register_message,
         })
         return render_ctx
 
     @HasPermissionAnyDecorator(
         'hg.admin', 'hg.register.auto_activate', 'hg.register.manual_activate')
     @view_config(
         route_name='register', request_method='POST',
         renderer='rhodecode:templates/register.mako')
     def register_post(self):
         captcha = self._get_captcha_data()
         auto_active = 'hg.register.auto_activate' in User.get_default_user()\
-            .AuthUser.permissions['global']
+            .AuthUser().permissions['global']
 
         register_form = RegisterForm()()
         try:
             form_result = register_form.to_python(self.request.params)
             form_result['active'] = auto_active
 
             if captcha.active:
                 response = submit(
                     self.request.params.get('recaptcha_challenge_field'),
                     self.request.params.get('recaptcha_response_field'),
                     private_key=captcha.private_key,
                     remoteip=get_ip_addr(self.request.environ))
                 if not response.is_valid:
                     _value = form_result
                     _msg = _('Bad captcha')
                     error_dict = {'recaptcha_field': _msg}
                     raise formencode.Invalid(_msg, _value, None,
                                              error_dict=error_dict)
 
             new_user = UserModel().create_registration(form_result)
             event = UserRegistered(user=new_user, session=self.session)
             self.request.registry.notify(event)
             self.session.flash(
                 _('You have successfully registered with RhodeCode'),
                 queue='success')
             Session().commit()
 
             redirect_ro = self.request.route_path('login')
             raise HTTPFound(redirect_ro)
 
         except formencode.Invalid as errors:
             errors.value.pop('password', None)
             errors.value.pop('password_confirmation', None)
             return self.register(
                 defaults=errors.value, errors=errors.error_dict)
 
         except UserCreationError as e:
             # container auth or other auth functions that create users on
             # the fly can throw this exception signaling that there's issue
             # with user creation, explanation should be provided in
             # Exception itself
             self.session.flash(e, queue='error')
             return self.register()
 
     @view_config(
         route_name='reset_password', request_method=('GET', 'POST'),
         renderer='rhodecode:templates/password_reset.mako')
     def password_reset(self):
         captcha = self._get_captcha_data()
 
         render_ctx = {
             'captcha_active': captcha.active,
             'captcha_public_key': captcha.public_key,
             'defaults': {},
             'errors': {},
         }
 
         # always send implicit message to prevent from discovery of
         # matching emails
         msg = _('If such email exists, a password reset link was sent to it.')
 
         if self.request.POST:
             if h.HasPermissionAny('hg.password_reset.disabled')():
                 _email = self.request.POST.get('email', '')
                 log.error('Failed attempt to reset password for `%s`.', _email)
                 self.session.flash(_('Password reset has been disabled.'),
                                    queue='error')
                 return HTTPFound(self.request.route_path('reset_password'))
 
             password_reset_form = PasswordResetForm()()
             try:
                 form_result = password_reset_form.to_python(
                     self.request.params)
                 user_email = form_result['email']
 
                 if captcha.active:
                     response = submit(
                         self.request.params.get('recaptcha_challenge_field'),
                         self.request.params.get('recaptcha_response_field'),
                         private_key=captcha.private_key,
                         remoteip=get_ip_addr(self.request.environ))
                     if not response.is_valid:
                         _value = form_result
                         _msg = _('Bad captcha')
                         error_dict = {'recaptcha_field': _msg}
                         raise formencode.Invalid(
                             _msg, _value, None, error_dict=error_dict)
 
                 # Generate reset URL and send mail.
                 user = User.get_by_email(user_email)
 
                 # generate password reset token that expires in 10minutes
                 desc = 'Generated token for password reset from {}'.format(
                     datetime.datetime.now().isoformat())
                 reset_token = AuthTokenModel().create(
                     user, lifetime=10,
                     description=desc,
                     role=UserApiKeys.ROLE_PASSWORD_RESET)
                 Session().commit()
 
                 log.debug('Successfully created password recovery token')
                 password_reset_url = self.request.route_url(
                     'reset_password_confirmation',
                     _query={'key': reset_token.api_key})
                 UserModel().reset_password_link(
                     form_result, password_reset_url)
                 # Display success message and redirect.
                 self.session.flash(msg, queue='success')
 
                 action_data = {'email': user_email,
                                'user_agent': self.request.user_agent}
                 audit_logger.store_web(
                     'user.password.reset_request', action_data=action_data,
                     user=self._rhodecode_user, commit=True)
                 return HTTPFound(self.request.route_path('reset_password'))
 
             except formencode.Invalid as errors:
                 render_ctx.update({
                     'defaults': errors.value,
                     'errors': errors.error_dict,
                 })
                 if not self.request.params.get('email'):
                     # case of empty email, we want to report that
                     return render_ctx
 
                 if 'recaptcha_field' in errors.error_dict:
                     # case of failed captcha
                     return render_ctx
 
             log.debug('faking response on invalid password reset')
             # make this take 2s, to prevent brute forcing.
             time.sleep(2)
             self.session.flash(msg, queue='success')
             return HTTPFound(self.request.route_path('reset_password'))
 
         return render_ctx
 
     @view_config(route_name='reset_password_confirmation',
                  request_method='GET')
     def password_reset_confirmation(self):
 
         if self.request.GET and self.request.GET.get('key'):
             # make this take 2s, to prevent brute forcing.
             time.sleep(2)
 
             token = AuthTokenModel().get_auth_token(
                 self.request.GET.get('key'))
 
             # verify token is the correct role
             if token is None or token.role != UserApiKeys.ROLE_PASSWORD_RESET:
                 log.debug('Got token with role:%s expected is %s',
                           getattr(token, 'role', 'EMPTY_TOKEN'),
                           UserApiKeys.ROLE_PASSWORD_RESET)
                 self.session.flash(
                     _('Given reset token is invalid'), queue='error')
                 return HTTPFound(self.request.route_path('reset_password'))
 
             try:
                 owner = token.user
                 data = {'email': owner.email, 'token': token.api_key}
                 UserModel().reset_password(data)
                 self.session.flash(
                     _('Your password reset was successful, '
                       'a new password has been sent to your email'),
                     queue='success')
             except Exception as e:
                 log.error(e)
                 return HTTPFound(self.request.route_path('reset_password'))
 
         return HTTPFound(self.request.route_path('login'))

rhodecode/apps/repository/tests/test_repo_summary.py

@@ -1,523 +1,523 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import re
 
 import mock
 import pytest
 
 from rhodecode.apps.repository.views.repo_summary import RepoSummaryView
 from rhodecode.lib import helpers as h
 from rhodecode.lib.compat import OrderedDict
 from rhodecode.lib.utils2 import AttributeDict, safe_str
 from rhodecode.lib.vcs.exceptions import RepositoryRequirementError
 from rhodecode.model.db import Repository
 from rhodecode.model.meta import Session
 from rhodecode.model.repo import RepoModel
 from rhodecode.model.scm import ScmModel
 from rhodecode.tests import assert_session_flash
 from rhodecode.tests.fixture import Fixture
 from rhodecode.tests.utils import AssertResponse, repo_on_filesystem
 
 
 fixture = Fixture()
 
 
 def route_path(name, params=None, **kwargs):
     import urllib
 
     base_url = {
         'repo_summary': '/{repo_name}',
         'repo_stats': '/{repo_name}/repo_stats/{commit_id}',
         'repo_refs_data': '/{repo_name}/refs-data',
         'repo_refs_changelog_data': '/{repo_name}/refs-data-changelog',
         'repo_creating_check': '/{repo_name}/repo_creating_check',
     }[name].format(**kwargs)
 
     if params:
         base_url = '{}?{}'.format(base_url, urllib.urlencode(params))
     return base_url
 
 
 @pytest.mark.usefixtures('app')
 class TestSummaryView(object):
     def test_index(self, autologin_user, backend, http_host_only_stub):
         repo_id = backend.repo.repo_id
         repo_name = backend.repo_name
         with mock.patch('rhodecode.lib.helpers.is_svn_without_proxy',
                         return_value=False):
             response = self.app.get(
                 route_path('repo_summary', repo_name=repo_name))
 
         # repo type
         response.mustcontain(
             '<i class="icon-%s">' % (backend.alias, )
         )
         # public/private
         response.mustcontain(
             """<i class="icon-unlock-alt">"""
         )
 
         # clone url...
         response.mustcontain(
             'id="clone_url" readonly="readonly"'
             ' value="http://test_admin@%s/%s"' % (http_host_only_stub, repo_name, ))
         response.mustcontain(
             'id="clone_url_id" readonly="readonly"'
             ' value="http://test_admin@%s/_%s"' % (http_host_only_stub, repo_id, ))
 
     def test_index_svn_without_proxy(
             self, autologin_user, backend_svn, http_host_only_stub):
         repo_id = backend_svn.repo.repo_id
         repo_name = backend_svn.repo_name
         response = self.app.get(route_path('repo_summary', repo_name=repo_name))
         # clone url...
         response.mustcontain(
             'id="clone_url" disabled'
             ' value="http://test_admin@%s/%s"' % (http_host_only_stub, repo_name, ))
         response.mustcontain(
             'id="clone_url_id" disabled'
             ' value="http://test_admin@%s/_%s"' % (http_host_only_stub, repo_id, ))
 
     def test_index_with_trailing_slash(
             self, autologin_user, backend, http_host_only_stub):
 
         repo_id = backend.repo.repo_id
         repo_name = backend.repo_name
         with mock.patch('rhodecode.lib.helpers.is_svn_without_proxy',
                         return_value=False):
             response = self.app.get(
                 route_path('repo_summary', repo_name=repo_name) + '/',
                 status=200)
 
         # clone url...
         response.mustcontain(
             'id="clone_url" readonly="readonly"'
             ' value="http://test_admin@%s/%s"' % (http_host_only_stub, repo_name, ))
         response.mustcontain(
             'id="clone_url_id" readonly="readonly"'
             ' value="http://test_admin@%s/_%s"' % (http_host_only_stub, repo_id, ))
 
     def test_index_by_id(self, autologin_user, backend):
         repo_id = backend.repo.repo_id
         response = self.app.get(
             route_path('repo_summary', repo_name='_%s' % (repo_id,)))
 
         # repo type
         response.mustcontain(
             '<i class="icon-%s">' % (backend.alias, )
         )
         # public/private
         response.mustcontain(
             """<i class="icon-unlock-alt">"""
         )
 
     def test_index_by_repo_having_id_path_in_name_hg(self, autologin_user):
         fixture.create_repo(name='repo_1')
         response = self.app.get(route_path('repo_summary', repo_name='repo_1'))
 
         try:
             response.mustcontain("repo_1")
         finally:
             RepoModel().delete(Repository.get_by_repo_name('repo_1'))
             Session().commit()
 
     def test_index_with_anonymous_access_disabled(
             self, backend, disable_anonymous_user):
         response = self.app.get(
             route_path('repo_summary', repo_name=backend.repo_name), status=302)
         assert 'login' in response.location
 
     def _enable_stats(self, repo):
         r = Repository.get_by_repo_name(repo)
         r.enable_statistics = True
         Session().add(r)
         Session().commit()
 
     expected_trending = {
         'hg': {
             "py": {"count": 68, "desc": ["Python"]},
             "rst": {"count": 16, "desc": ["Rst"]},
             "css": {"count": 2, "desc": ["Css"]},
             "sh": {"count": 2, "desc": ["Bash"]},
             "bat": {"count": 1, "desc": ["Batch"]},
             "cfg": {"count": 1, "desc": ["Ini"]},
             "html": {"count": 1, "desc": ["EvoqueHtml", "Html"]},
             "ini": {"count": 1, "desc": ["Ini"]},
             "js": {"count": 1, "desc": ["Javascript"]},
             "makefile": {"count": 1, "desc": ["Makefile", "Makefile"]}
         },
         'git': {
             "py": {"count": 68, "desc": ["Python"]},
             "rst": {"count": 16, "desc": ["Rst"]},
             "css": {"count": 2, "desc": ["Css"]},
             "sh": {"count": 2, "desc": ["Bash"]},
             "bat": {"count": 1, "desc": ["Batch"]},
             "cfg": {"count": 1, "desc": ["Ini"]},
             "html": {"count": 1, "desc": ["EvoqueHtml", "Html"]},
             "ini": {"count": 1, "desc": ["Ini"]},
             "js": {"count": 1, "desc": ["Javascript"]},
             "makefile": {"count": 1, "desc": ["Makefile", "Makefile"]}
         },
         'svn': {
             "py": {"count": 75, "desc": ["Python"]},
             "rst": {"count": 16, "desc": ["Rst"]},
             "html": {"count": 11, "desc": ["EvoqueHtml", "Html"]},
             "css": {"count": 2, "desc": ["Css"]},
             "bat": {"count": 1, "desc": ["Batch"]},
             "cfg": {"count": 1, "desc": ["Ini"]},
             "ini": {"count": 1, "desc": ["Ini"]},
             "js": {"count": 1, "desc": ["Javascript"]},
             "makefile": {"count": 1, "desc": ["Makefile", "Makefile"]},
             "sh": {"count": 1, "desc": ["Bash"]}
         },
     }
 
     def test_repo_stats(self, autologin_user, backend, xhr_header):
         response = self.app.get(
             route_path(
                 'repo_stats', repo_name=backend.repo_name, commit_id='tip'),
             extra_environ=xhr_header,
             status=200)
         assert re.match(r'6[\d\.]+ KiB', response.json['size'])
 
     def test_repo_stats_code_stats_enabled(self, autologin_user, backend, xhr_header):
         repo_name = backend.repo_name
 
         # codes stats
         self._enable_stats(repo_name)
         ScmModel().mark_for_invalidation(repo_name)
 
         response = self.app.get(
             route_path(
                 'repo_stats', repo_name=backend.repo_name, commit_id='tip'),
             extra_environ=xhr_header,
             status=200)
 
         expected_data = self.expected_trending[backend.alias]
         returned_stats = response.json['code_stats']
         for k, v in expected_data.items():
             assert v == returned_stats[k]
 
     def test_repo_refs_data(self, backend):
         response = self.app.get(
             route_path('repo_refs_data', repo_name=backend.repo_name),
             status=200)
 
         # Ensure that there is the correct amount of items in the result
         repo = backend.repo.scm_instance()
         data = response.json['results']
         items = sum(len(section['children']) for section in data)
         repo_refs = len(repo.branches) + len(repo.tags) + len(repo.bookmarks)
         assert items == repo_refs
 
     def test_index_shows_missing_requirements_message(
             self, backend, autologin_user):
         repo_name = backend.repo_name
         scm_patcher = mock.patch.object(
             Repository, 'scm_instance', side_effect=RepositoryRequirementError)
 
         with scm_patcher:
             response = self.app.get(route_path('repo_summary', repo_name=repo_name))
         assert_response = AssertResponse(response)
         assert_response.element_contains(
             '.main .alert-warning strong', 'Missing requirements')
         assert_response.element_contains(
             '.main .alert-warning',
             'Commits cannot be displayed, because this repository '
             'uses one or more extensions, which was not enabled.')
 
     def test_missing_requirements_page_does_not_contains_switch_to(
             self, autologin_user, backend):
         repo_name = backend.repo_name
         scm_patcher = mock.patch.object(
             Repository, 'scm_instance', side_effect=RepositoryRequirementError)
 
         with scm_patcher:
             response = self.app.get(route_path('repo_summary', repo_name=repo_name))
         response.mustcontain(no='Switch To')
 
 
 @pytest.mark.usefixtures('app')
 class TestRepoLocation(object):
 
     @pytest.mark.parametrize("suffix", [u'', u'ąęł'], ids=['', 'non-ascii'])
     def test_missing_filesystem_repo(
             self, autologin_user, backend, suffix, csrf_token):
         repo = backend.create_repo(name_suffix=suffix)
         repo_name = repo.repo_name
 
         # delete from file system
         RepoModel()._delete_filesystem_repo(repo)
 
         # test if the repo is still in the database
         new_repo = RepoModel().get_by_repo_name(repo_name)
         assert new_repo.repo_name == repo_name
 
         # check if repo is not in the filesystem
         assert not repo_on_filesystem(repo_name)
 
         response = self.app.get(
             route_path('repo_summary', repo_name=safe_str(repo_name)), status=302)
 
         msg = 'The repository `%s` cannot be loaded in filesystem. ' \
               'Please check if it exist, or is not damaged.' % repo_name
         assert_session_flash(response, msg)
 
     @pytest.mark.parametrize("suffix", [u'', u'ąęł'], ids=['', 'non-ascii'])
     def test_missing_filesystem_repo_on_repo_check(
             self, autologin_user, backend, suffix, csrf_token):
         repo = backend.create_repo(name_suffix=suffix)
         repo_name = repo.repo_name
 
         # delete from file system
         RepoModel()._delete_filesystem_repo(repo)
 
         # test if the repo is still in the database
         new_repo = RepoModel().get_by_repo_name(repo_name)
         assert new_repo.repo_name == repo_name
 
         # check if repo is not in the filesystem
         assert not repo_on_filesystem(repo_name)
 
         # flush the session
         self.app.get(
             route_path('repo_summary', repo_name=safe_str(repo_name)),
             status=302)
 
         response = self.app.get(
             route_path('repo_creating_check', repo_name=safe_str(repo_name)),
             status=200)
         msg = 'The repository `%s` cannot be loaded in filesystem. ' \
               'Please check if it exist, or is not damaged.' % repo_name
         assert_session_flash(response, msg )
 
 
 @pytest.fixture()
 def summary_view(context_stub, request_stub, user_util):
     """
     Bootstrap view to test the view functions
     """
     request_stub.matched_route = AttributeDict(name='test_view')
 
-    request_stub.user = user_util.create_user().AuthUser
+    request_stub.user = user_util.create_user().AuthUser()
     request_stub.db_repo = user_util.create_repo()
 
     view = RepoSummaryView(context=context_stub, request=request_stub)
     return view
 
 
 @pytest.mark.usefixtures('app')
 class TestCreateReferenceData(object):
 
     @pytest.fixture
     def example_refs(self):
         section_1_refs = OrderedDict((('a', 'a_id'), ('b', 'b_id')))
         example_refs = [
             ('section_1', section_1_refs, 't1'),
             ('section_2', {'c': 'c_id'}, 't2'),
         ]
         return example_refs
 
     def test_generates_refs_based_on_commit_ids(self, example_refs, summary_view):
         repo = mock.Mock()
         repo.name = 'test-repo'
         repo.alias = 'git'
         full_repo_name = 'pytest-repo-group/' + repo.name
 
         result = summary_view._create_reference_data(
             repo, full_repo_name, example_refs)
 
         expected_files_url = '/{}/files/'.format(full_repo_name)
         expected_result = [
             {
                 'children': [
                     {
                         'id': 'a', 'raw_id': 'a_id', 'text': 'a', 'type': 't1',
                         'files_url': expected_files_url + 'a/?at=a',
                     },
                     {
                         'id': 'b', 'raw_id': 'b_id', 'text': 'b', 'type': 't1',
                         'files_url': expected_files_url + 'b/?at=b',
                     }
                 ],
                 'text': 'section_1'
             },
             {
                 'children': [
                     {
                         'id': 'c', 'raw_id': 'c_id', 'text': 'c', 'type': 't2',
                         'files_url': expected_files_url + 'c/?at=c',
                     }
                 ],
                 'text': 'section_2'
             }]
         assert result == expected_result
 
     def test_generates_refs_with_path_for_svn(self, example_refs, summary_view):
         repo = mock.Mock()
         repo.name = 'test-repo'
         repo.alias = 'svn'
         full_repo_name = 'pytest-repo-group/' + repo.name
 
         result = summary_view._create_reference_data(
             repo, full_repo_name, example_refs)
 
         expected_files_url = '/{}/files/'.format(full_repo_name)
         expected_result = [
             {
                 'children': [
                     {
                         'id': 'a@a_id', 'raw_id': 'a_id',
                         'text': 'a', 'type': 't1',
                         'files_url': expected_files_url + 'a_id/a?at=a',
                     },
                     {
                         'id': 'b@b_id', 'raw_id': 'b_id',
                         'text': 'b', 'type': 't1',
                         'files_url': expected_files_url + 'b_id/b?at=b',
                     }
                 ],
                 'text': 'section_1'
             },
             {
                 'children': [
                     {
                         'id': 'c@c_id', 'raw_id': 'c_id',
                         'text': 'c', 'type': 't2',
                         'files_url': expected_files_url + 'c_id/c?at=c',
                     }
                 ],
                 'text': 'section_2'
             }
         ]
         assert result == expected_result
 
 
 class TestCreateFilesUrl(object):
 
     def test_creates_non_svn_url(self, app, summary_view):
         repo = mock.Mock()
         repo.name = 'abcde'
         full_repo_name = 'test-repo-group/' + repo.name
         ref_name = 'branch1'
         raw_id = 'deadbeef0123456789'
         is_svn = False
 
         with mock.patch('rhodecode.lib.helpers.route_path') as url_mock:
             result = summary_view._create_files_url(
                 repo, full_repo_name, ref_name, raw_id, is_svn)
         url_mock.assert_called_once_with(
             'repo_files', repo_name=full_repo_name, commit_id=ref_name,
             f_path='', _query=dict(at=ref_name))
         assert result == url_mock.return_value
 
     def test_creates_svn_url(self, app, summary_view):
         repo = mock.Mock()
         repo.name = 'abcde'
         full_repo_name = 'test-repo-group/' + repo.name
         ref_name = 'branch1'
         raw_id = 'deadbeef0123456789'
         is_svn = True
 
         with mock.patch('rhodecode.lib.helpers.route_path') as url_mock:
             result = summary_view._create_files_url(
                 repo, full_repo_name, ref_name, raw_id, is_svn)
         url_mock.assert_called_once_with(
             'repo_files', repo_name=full_repo_name, f_path=ref_name,
             commit_id=raw_id, _query=dict(at=ref_name))
         assert result == url_mock.return_value
 
     def test_name_has_slashes(self, app, summary_view):
         repo = mock.Mock()
         repo.name = 'abcde'
         full_repo_name = 'test-repo-group/' + repo.name
         ref_name = 'branch1/branch2'
         raw_id = 'deadbeef0123456789'
         is_svn = False
 
         with mock.patch('rhodecode.lib.helpers.route_path') as url_mock:
             result = summary_view._create_files_url(
                 repo, full_repo_name, ref_name, raw_id, is_svn)
         url_mock.assert_called_once_with(
             'repo_files', repo_name=full_repo_name, commit_id=raw_id,
             f_path='', _query=dict(at=ref_name))
         assert result == url_mock.return_value
 
 
 class TestReferenceItems(object):
     repo = mock.Mock()
     repo.name = 'pytest-repo'
     repo_full_name = 'pytest-repo-group/' + repo.name
     ref_type = 'branch'
     fake_url = '/abcde/'
 
     @staticmethod
     def _format_function(name, id_):
         return 'format_function_{}_{}'.format(name, id_)
 
     def test_creates_required_amount_of_items(self, summary_view):
         amount = 100
         refs = {
             'ref{}'.format(i): '{0:040d}'.format(i)
             for i in range(amount)
         }
 
         url_patcher = mock.patch.object(summary_view, '_create_files_url')
         svn_patcher = mock.patch('rhodecode.lib.helpers.is_svn',
                                  return_value=False)
 
         with url_patcher as url_mock, svn_patcher:
             result = summary_view._create_reference_items(
                 self.repo, self.repo_full_name, refs, self.ref_type,
                 self._format_function)
         assert len(result) == amount
         assert url_mock.call_count == amount
 
     def test_single_item_details(self, summary_view):
         ref_name = 'ref1'
         ref_id = 'deadbeef'
         refs = {
             ref_name: ref_id
         }
 
         svn_patcher = mock.patch('rhodecode.lib.helpers.is_svn',
                                  return_value=False)
 
         url_patcher = mock.patch.object(
             summary_view, '_create_files_url', return_value=self.fake_url)
 
         with url_patcher as url_mock, svn_patcher:
             result = summary_view._create_reference_items(
                 self.repo, self.repo_full_name, refs, self.ref_type,
                 self._format_function)
 
         url_mock.assert_called_once_with(
             self.repo, self.repo_full_name, ref_name, ref_id, False)
         expected_result = [
             {
                 'text': ref_name,
                 'id': self._format_function(ref_name, ref_id),
                 'raw_id': ref_id,
                 'type': self.ref_type,
                 'files_url': self.fake_url
             }
         ]
         assert result == expected_result

rhodecode/authentication/plugins/auth_crowd.py

@@ -1,284 +1,284 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2012-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 RhodeCode authentication plugin for Atlassian CROWD
 """
 
 
 import colander
 import base64
 import logging
 import urllib2
 
 from rhodecode.translation import _
 from rhodecode.authentication.base import (
     RhodeCodeExternalAuthPlugin, hybrid_property)
 from rhodecode.authentication.schema import AuthnPluginSettingsSchemaBase
 from rhodecode.authentication.routes import AuthnPluginResourceBase
 from rhodecode.lib.colander_utils import strip_whitespace
 from rhodecode.lib.ext_json import json, formatted_json
 from rhodecode.model.db import User
 
 log = logging.getLogger(__name__)
 
 
 def plugin_factory(plugin_id, *args, **kwds):
     """
     Factory function that is called during plugin discovery.
     It returns the plugin instance.
     """
     plugin = RhodeCodeAuthPlugin(plugin_id)
     return plugin
 
 
 class CrowdAuthnResource(AuthnPluginResourceBase):
     pass
 
 
 class CrowdSettingsSchema(AuthnPluginSettingsSchemaBase):
     host = colander.SchemaNode(
         colander.String(),
         default='127.0.0.1',
         description=_('The FQDN or IP of the Atlassian CROWD Server'),
         preparer=strip_whitespace,
         title=_('Host'),
         widget='string')
     port = colander.SchemaNode(
         colander.Int(),
         default=8095,
         description=_('The Port in use by the Atlassian CROWD Server'),
         preparer=strip_whitespace,
         title=_('Port'),
         validator=colander.Range(min=0, max=65536),
         widget='int')
     app_name = colander.SchemaNode(
         colander.String(),
         default='',
         description=_('The Application Name to authenticate to CROWD'),
         preparer=strip_whitespace,
         title=_('Application Name'),
         widget='string')
     app_password = colander.SchemaNode(
         colander.String(),
         default='',
         description=_('The password to authenticate to CROWD'),
         preparer=strip_whitespace,
         title=_('Application Password'),
         widget='password')
     admin_groups = colander.SchemaNode(
         colander.String(),
         default='',
         description=_('A comma separated list of group names that identify '
                       'users as RhodeCode Administrators'),
         missing='',
         preparer=strip_whitespace,
         title=_('Admin Groups'),
         widget='string')
 
 
 class CrowdServer(object):
     def __init__(self, *args, **kwargs):
         """
         Create a new CrowdServer object that points to IP/Address 'host',
         on the given port, and using the given method (https/http). user and
         passwd can be set here or with set_credentials. If unspecified,
         "version" defaults to "latest".
 
         example::
 
             cserver = CrowdServer(host="127.0.0.1",
                                   port="8095",
                                   user="some_app",
                                   passwd="some_passwd",
                                   version="1")
         """
         if not "port" in kwargs:
             kwargs["port"] = "8095"
         self._logger = kwargs.get("logger", logging.getLogger(__name__))
         self._uri = "%s://%s:%s/crowd" % (kwargs.get("method", "http"),
                                     kwargs.get("host", "127.0.0.1"),
                                     kwargs.get("port", "8095"))
         self.set_credentials(kwargs.get("user", ""),
                              kwargs.get("passwd", ""))
         self._version = kwargs.get("version", "latest")
         self._url_list = None
         self._appname = "crowd"
 
     def set_credentials(self, user, passwd):
         self.user = user
         self.passwd = passwd
         self._make_opener()
 
     def _make_opener(self):
         mgr = urllib2.HTTPPasswordMgrWithDefaultRealm()
         mgr.add_password(None, self._uri, self.user, self.passwd)
         handler = urllib2.HTTPBasicAuthHandler(mgr)
         self.opener = urllib2.build_opener(handler)
 
     def _request(self, url, body=None, headers=None,
                  method=None, noformat=False,
                  empty_response_ok=False):
         _headers = {"Content-type": "application/json",
                     "Accept": "application/json"}
         if self.user and self.passwd:
             authstring = base64.b64encode("%s:%s" % (self.user, self.passwd))
             _headers["Authorization"] = "Basic %s" % authstring
         if headers:
             _headers.update(headers)
         log.debug("Sent crowd: \n%s"
                   % (formatted_json({"url": url, "body": body,
                                            "headers": _headers})))
         request = urllib2.Request(url, body, _headers)
         if method:
             request.get_method = lambda: method
 
         global msg
         msg = ""
         try:
             rdoc = self.opener.open(request)
             msg = "".join(rdoc.readlines())
             if not msg and empty_response_ok:
                 rval = {}
                 rval["status"] = True
                 rval["error"] = "Response body was empty"
             elif not noformat:
                 rval = json.loads(msg)
                 rval["status"] = True
             else:
                 rval = "".join(rdoc.readlines())
         except Exception as e:
             if not noformat:
                 rval = {"status": False,
                         "body": body,
                         "error": str(e) + "\n" + msg}
             else:
                 rval = None
         return rval
 
     def user_auth(self, username, password):
         """Authenticate a user against crowd. Returns brief information about
         the user."""
         url = ("%s/rest/usermanagement/%s/authentication?username=%s"
                % (self._uri, self._version, username))
         body = json.dumps({"value": password})
         return self._request(url, body)
 
     def user_groups(self, username):
         """Retrieve a list of groups to which this user belongs."""
         url = ("%s/rest/usermanagement/%s/user/group/nested?username=%s"
                % (self._uri, self._version, username))
         return self._request(url)
 
 
 class RhodeCodeAuthPlugin(RhodeCodeExternalAuthPlugin):
     _settings_unsafe_keys = ['app_password']
 
     def includeme(self, config):
         config.add_authn_plugin(self)
         config.add_authn_resource(self.get_id(), CrowdAuthnResource(self))
         config.add_view(
             'rhodecode.authentication.views.AuthnPluginViewBase',
             attr='settings_get',
             renderer='rhodecode:templates/admin/auth/plugin_settings.mako',
             request_method='GET',
             route_name='auth_home',
             context=CrowdAuthnResource)
         config.add_view(
             'rhodecode.authentication.views.AuthnPluginViewBase',
             attr='settings_post',
             renderer='rhodecode:templates/admin/auth/plugin_settings.mako',
             request_method='POST',
             route_name='auth_home',
             context=CrowdAuthnResource)
 
     def get_settings_schema(self):
         return CrowdSettingsSchema()
 
     def get_display_name(self):
         return _('CROWD')
 
     @hybrid_property
     def name(self):
         return "crowd"
 
     def use_fake_password(self):
         return True
 
     def user_activation_state(self):
-        def_user_perms = User.get_default_user().AuthUser.permissions['global']
+        def_user_perms = User.get_default_user().AuthUser().permissions['global']
         return 'hg.extern_activate.auto' in def_user_perms
 
     def auth(self, userobj, username, password, settings, **kwargs):
         """
         Given a user object (which may be null), username, a plaintext password,
         and a settings object (containing all the keys needed as listed in settings()),
         authenticate this user's login attempt.
 
         Return None on failure. On success, return a dictionary of the form:
 
             see: RhodeCodeAuthPluginBase.auth_func_attrs
         This is later validated for correctness
         """
         if not username or not password:
             log.debug('Empty username or password skipping...')
             return None
 
         log.debug("Crowd settings: \n%s" % (formatted_json(settings)))
         server = CrowdServer(**settings)
         server.set_credentials(settings["app_name"], settings["app_password"])
         crowd_user = server.user_auth(username, password)
         log.debug("Crowd returned: \n%s" % (formatted_json(crowd_user)))
         if not crowd_user["status"]:
             return None
 
         res = server.user_groups(crowd_user["name"])
         log.debug("Crowd groups: \n%s" % (formatted_json(res)))
         crowd_user["groups"] = [x["name"] for x in res["groups"]]
 
         # old attrs fetched from RhodeCode database
         admin = getattr(userobj, 'admin', False)
         active = getattr(userobj, 'active', True)
         email = getattr(userobj, 'email', '')
         username = getattr(userobj, 'username', username)
         firstname = getattr(userobj, 'firstname', '')
         lastname = getattr(userobj, 'lastname', '')
         extern_type = getattr(userobj, 'extern_type', '')
 
         user_attrs = {
             'username': username,
             'firstname': crowd_user["first-name"] or firstname,
             'lastname': crowd_user["last-name"] or lastname,
             'groups': crowd_user["groups"],
             'email': crowd_user["email"] or email,
             'admin': admin,
             'active': active,
             'active_from_extern': crowd_user.get('active'),
             'extern_name': crowd_user["name"],
             'extern_type': extern_type,
         }
 
         # set an admin if we're in admin_groups of crowd
         for group in settings["admin_groups"]:
             if group in user_attrs["groups"]:
                 user_attrs["admin"] = True
         log.debug("Final crowd user object: \n%s" % (formatted_json(user_attrs)))
         log.info('user %s authenticated correctly' % user_attrs['username'])
         return user_attrs

rhodecode/authentication/plugins/auth_headers.py

@@ -1,224 +1,224 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2012-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 import colander
 import logging
 
 from rhodecode.translation import _
 from rhodecode.authentication.base import (
     RhodeCodeExternalAuthPlugin, hybrid_property)
 from rhodecode.authentication.schema import AuthnPluginSettingsSchemaBase
 from rhodecode.authentication.routes import AuthnPluginResourceBase
 from rhodecode.lib.colander_utils import strip_whitespace
 from rhodecode.lib.utils2 import str2bool, safe_unicode
 from rhodecode.model.db import User
 
 
 log = logging.getLogger(__name__)
 
 
 def plugin_factory(plugin_id, *args, **kwds):
     """
     Factory function that is called during plugin discovery.
     It returns the plugin instance.
     """
     plugin = RhodeCodeAuthPlugin(plugin_id)
     return plugin
 
 
 class HeadersAuthnResource(AuthnPluginResourceBase):
     pass
 
 
 class HeadersSettingsSchema(AuthnPluginSettingsSchemaBase):
     header = colander.SchemaNode(
         colander.String(),
         default='REMOTE_USER',
         description=_('Header to extract the user from'),
         preparer=strip_whitespace,
         title=_('Header'),
         widget='string')
     fallback_header = colander.SchemaNode(
         colander.String(),
         default='HTTP_X_FORWARDED_USER',
         description=_('Header to extract the user from when main one fails'),
         preparer=strip_whitespace,
         title=_('Fallback header'),
         widget='string')
     clean_username = colander.SchemaNode(
         colander.Boolean(),
         default=True,
         description=_('Perform cleaning of user, if passed user has @ in '
                       'username then first part before @ is taken. '
                       'If there\'s \\ in the username only the part after '
                       ' \\ is taken'),
         missing=False,
         title=_('Clean username'),
         widget='bool')
 
 
 class RhodeCodeAuthPlugin(RhodeCodeExternalAuthPlugin):
 
     def includeme(self, config):
         config.add_authn_plugin(self)
         config.add_authn_resource(self.get_id(), HeadersAuthnResource(self))
         config.add_view(
             'rhodecode.authentication.views.AuthnPluginViewBase',
             attr='settings_get',
             renderer='rhodecode:templates/admin/auth/plugin_settings.mako',
             request_method='GET',
             route_name='auth_home',
             context=HeadersAuthnResource)
         config.add_view(
             'rhodecode.authentication.views.AuthnPluginViewBase',
             attr='settings_post',
             renderer='rhodecode:templates/admin/auth/plugin_settings.mako',
             request_method='POST',
             route_name='auth_home',
             context=HeadersAuthnResource)
 
     def get_display_name(self):
         return _('Headers')
 
     def get_settings_schema(self):
         return HeadersSettingsSchema()
 
     @hybrid_property
     def name(self):
         return 'headers'
 
     @property
     def is_headers_auth(self):
         return True
 
     def use_fake_password(self):
         return True
 
     def user_activation_state(self):
-        def_user_perms = User.get_default_user().AuthUser.permissions['global']
+        def_user_perms = User.get_default_user().AuthUser().permissions['global']
         return 'hg.extern_activate.auto' in def_user_perms
 
     def _clean_username(self, username):
         # Removing realm and domain from username
         username = username.split('@')[0]
         username = username.rsplit('\\')[-1]
         return username
 
     def _get_username(self, environ, settings):
         username = None
         environ = environ or {}
         if not environ:
             log.debug('got empty environ: %s' % environ)
 
         settings = settings or {}
         if settings.get('header'):
             header = settings.get('header')
             username = environ.get(header)
             log.debug('extracted %s:%s' % (header, username))
 
         # fallback mode
         if not username and settings.get('fallback_header'):
             header = settings.get('fallback_header')
             username = environ.get(header)
             log.debug('extracted %s:%s' % (header, username))
 
         if username and str2bool(settings.get('clean_username')):
             log.debug('Received username `%s` from headers' % username)
             username = self._clean_username(username)
             log.debug('New cleanup user is:%s' % username)
         return username
 
     def get_user(self, username=None, **kwargs):
         """
         Helper method for user fetching in plugins, by default it's using
         simple fetch by username, but this method can be custimized in plugins
         eg. headers auth plugin to fetch user by environ params
         :param username: username if given to fetch
         :param kwargs: extra arguments needed for user fetching.
         """
         environ = kwargs.get('environ') or {}
         settings = kwargs.get('settings') or {}
         username = self._get_username(environ, settings)
         # we got the username, so use default method now
         return super(RhodeCodeAuthPlugin, self).get_user(username)
 
     def auth(self, userobj, username, password, settings, **kwargs):
         """
         Get's the headers_auth username (or email). It tries to get username
         from REMOTE_USER if this plugin is enabled, if that fails
         it tries to get username from HTTP_X_FORWARDED_USER if fallback header
         is set. clean_username extracts the username from this data if it's
         having @ in it.
         Return None on failure. On success, return a dictionary of the form:
 
             see: RhodeCodeAuthPluginBase.auth_func_attrs
 
         :param userobj:
         :param username:
         :param password:
         :param settings:
         :param kwargs:
         """
         environ = kwargs.get('environ')
         if not environ:
             log.debug('Empty environ data skipping...')
             return None
 
         if not userobj:
             userobj = self.get_user('', environ=environ, settings=settings)
 
         # we don't care passed username/password for headers auth plugins.
         # only way to log in is using environ
         username = None
         if userobj:
             username = getattr(userobj, 'username')
 
         if not username:
             # we don't have any objects in DB user doesn't exist extract
             # username from environ based on the settings
             username = self._get_username(environ, settings)
 
         # if cannot fetch username, it's a no-go for this plugin to proceed
         if not username:
             return None
 
         # old attrs fetched from RhodeCode database
         admin = getattr(userobj, 'admin', False)
         active = getattr(userobj, 'active', True)
         email = getattr(userobj, 'email', '')
         firstname = getattr(userobj, 'firstname', '')
         lastname = getattr(userobj, 'lastname', '')
         extern_type = getattr(userobj, 'extern_type', '')
 
         user_attrs = {
             'username': username,
             'firstname': safe_unicode(firstname or username),
             'lastname': safe_unicode(lastname or ''),
             'groups': [],
             'email': email or '',
             'admin': admin or False,
             'active': active,
             'active_from_extern': True,
             'extern_name': username,
             'extern_type': extern_type,
         }
 
         log.info('user `%s` authenticated correctly' % user_attrs['username'])
         return user_attrs

rhodecode/authentication/plugins/auth_jasig_cas.py

@@ -1,166 +1,166 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2012-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 RhodeCode authentication plugin for Jasig CAS
 http://www.jasig.org/cas
 """
 
 
 import colander
 import logging
 import rhodecode
 import urllib
 import urllib2
 
 from rhodecode.translation import _
 from rhodecode.authentication.base import (
     RhodeCodeExternalAuthPlugin, hybrid_property)
 from rhodecode.authentication.schema import AuthnPluginSettingsSchemaBase
 from rhodecode.authentication.routes import AuthnPluginResourceBase
 from rhodecode.lib.colander_utils import strip_whitespace
 from rhodecode.lib.utils2 import safe_unicode
 from rhodecode.model.db import User
 
 log = logging.getLogger(__name__)
 
 
 def plugin_factory(plugin_id, *args, **kwds):
     """
     Factory function that is called during plugin discovery.
     It returns the plugin instance.
     """
     plugin = RhodeCodeAuthPlugin(plugin_id)
     return plugin
 
 
 class JasigCasAuthnResource(AuthnPluginResourceBase):
     pass
 
 
 class JasigCasSettingsSchema(AuthnPluginSettingsSchemaBase):
     service_url = colander.SchemaNode(
         colander.String(),
         default='https://domain.com/cas/v1/tickets',
         description=_('The url of the Jasig CAS REST service'),
         preparer=strip_whitespace,
         title=_('URL'),
         widget='string')
 
 
 class RhodeCodeAuthPlugin(RhodeCodeExternalAuthPlugin):
 
     def includeme(self, config):
         config.add_authn_plugin(self)
         config.add_authn_resource(self.get_id(), JasigCasAuthnResource(self))
         config.add_view(
             'rhodecode.authentication.views.AuthnPluginViewBase',
             attr='settings_get',
             renderer='rhodecode:templates/admin/auth/plugin_settings.mako',
             request_method='GET',
             route_name='auth_home',
             context=JasigCasAuthnResource)
         config.add_view(
             'rhodecode.authentication.views.AuthnPluginViewBase',
             attr='settings_post',
             renderer='rhodecode:templates/admin/auth/plugin_settings.mako',
             request_method='POST',
             route_name='auth_home',
             context=JasigCasAuthnResource)
 
     def get_settings_schema(self):
         return JasigCasSettingsSchema()
 
     def get_display_name(self):
         return _('Jasig-CAS')
 
     @hybrid_property
     def name(self):
         return "jasig-cas"
 
     @property
     def is_headers_auth(self):
         return True
 
     def use_fake_password(self):
         return True
 
     def user_activation_state(self):
-        def_user_perms = User.get_default_user().AuthUser.permissions['global']
+        def_user_perms = User.get_default_user().AuthUser().permissions['global']
         return 'hg.extern_activate.auto' in def_user_perms
 
     def auth(self, userobj, username, password, settings, **kwargs):
         """
         Given a user object (which may be null), username, a plaintext password,
         and a settings object (containing all the keys needed as listed in settings()),
         authenticate this user's login attempt.
 
         Return None on failure. On success, return a dictionary of the form:
 
             see: RhodeCodeAuthPluginBase.auth_func_attrs
         This is later validated for correctness
         """
         if not username or not password:
             log.debug('Empty username or password skipping...')
             return None
 
         log.debug("Jasig CAS settings: %s", settings)
         params = urllib.urlencode({'username': username, 'password': password})
         headers = {"Content-type": "application/x-www-form-urlencoded",
                    "Accept": "text/plain",
                    "User-Agent": "RhodeCode-auth-%s" % rhodecode.__version__}
         url = settings["service_url"]
 
         log.debug("Sent Jasig CAS: \n%s",
                   {"url": url, "body": params, "headers": headers})
         request = urllib2.Request(url, params, headers)
         try:
             response = urllib2.urlopen(request)
         except urllib2.HTTPError as e:
             log.debug("HTTPError when requesting Jasig CAS (status code: %d)" % e.code)
             return None
         except urllib2.URLError as e:
             log.debug("URLError when requesting Jasig CAS url: %s " % url)
             return None
 
         # old attrs fetched from RhodeCode database
         admin = getattr(userobj, 'admin', False)
         active = getattr(userobj, 'active', True)
         email = getattr(userobj, 'email', '')
         username = getattr(userobj, 'username', username)
         firstname = getattr(userobj, 'firstname', '')
         lastname = getattr(userobj, 'lastname', '')
         extern_type = getattr(userobj, 'extern_type', '')
 
         user_attrs = {
             'username': username,
             'firstname': safe_unicode(firstname or username),
             'lastname': safe_unicode(lastname or ''),
             'groups': [],
             'email': email or '',
             'admin': admin or False,
             'active': active,
             'active_from_extern': True,
             'extern_name': username,
             'extern_type': extern_type,
         }
 
         log.info('user %s authenticated correctly' % user_attrs['username'])
         return user_attrs

rhodecode/authentication/plugins/auth_ldap.py

@@ -1,480 +1,480 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 RhodeCode authentication plugin for LDAP
 """
 
 
 import colander
 import logging
 import traceback
 
 from rhodecode.translation import _
 from rhodecode.authentication.base import (
     RhodeCodeExternalAuthPlugin, chop_at, hybrid_property)
 from rhodecode.authentication.schema import AuthnPluginSettingsSchemaBase
 from rhodecode.authentication.routes import AuthnPluginResourceBase
 from rhodecode.lib.colander_utils import strip_whitespace
 from rhodecode.lib.exceptions import (
     LdapConnectionError, LdapUsernameError, LdapPasswordError, LdapImportError
 )
 from rhodecode.lib.utils2 import safe_unicode, safe_str
 from rhodecode.model.db import User
 from rhodecode.model.validators import Missing
 
 log = logging.getLogger(__name__)
 
 try:
     import ldap
 except ImportError:
     # means that python-ldap is not installed, we use Missing object to mark
     # ldap lib is Missing
     ldap = Missing
 
 
 def plugin_factory(plugin_id, *args, **kwds):
     """
     Factory function that is called during plugin discovery.
     It returns the plugin instance.
     """
     plugin = RhodeCodeAuthPlugin(plugin_id)
     return plugin
 
 
 class LdapAuthnResource(AuthnPluginResourceBase):
     pass
 
 
 class LdapSettingsSchema(AuthnPluginSettingsSchemaBase):
     tls_kind_choices = ['PLAIN', 'LDAPS', 'START_TLS']
     tls_reqcert_choices = ['NEVER', 'ALLOW', 'TRY', 'DEMAND', 'HARD']
     search_scope_choices = ['BASE', 'ONELEVEL', 'SUBTREE']
 
     host = colander.SchemaNode(
         colander.String(),
         default='',
         description=_('Host[s] of the LDAP Server \n'
                       '(e.g., 192.168.2.154, or ldap-server.domain.com.\n '
                       'Multiple servers can be specified using commas'),
         preparer=strip_whitespace,
         title=_('LDAP Host'),
         widget='string')
     port = colander.SchemaNode(
         colander.Int(),
         default=389,
         description=_('Custom port that the LDAP server is listening on. '
                       'Default value is: 389'),
         preparer=strip_whitespace,
         title=_('Port'),
         validator=colander.Range(min=0, max=65536),
         widget='int')
     dn_user = colander.SchemaNode(
         colander.String(),
         default='',
         description=_('Optional user DN/account to connect to LDAP if authentication is required. \n'
                       'e.g., cn=admin,dc=mydomain,dc=com, or '
                       'uid=root,cn=users,dc=mydomain,dc=com, or [e-mail]'),
         missing='',
         preparer=strip_whitespace,
         title=_('Account'),
         widget='string')
     dn_pass = colander.SchemaNode(
         colander.String(),
         default='',
         description=_('Password to authenticate for given user DN.'),
         missing='',
         preparer=strip_whitespace,
         title=_('Password'),
         widget='password')
     tls_kind = colander.SchemaNode(
         colander.String(),
         default=tls_kind_choices[0],
         description=_('TLS Type'),
         title=_('Connection Security'),
         validator=colander.OneOf(tls_kind_choices),
         widget='select')
     tls_reqcert = colander.SchemaNode(
         colander.String(),
         default=tls_reqcert_choices[0],
         description=_('Require Cert over TLS?. Self-signed and custom '
                       'certificates can be used when\n `RhodeCode Certificate` '
                       'found in admin > settings > system info page is extended.'),
         title=_('Certificate Checks'),
         validator=colander.OneOf(tls_reqcert_choices),
         widget='select')
     base_dn = colander.SchemaNode(
         colander.String(),
         default='',
         description=_('Base DN to search. Dynamic bind is supported. Add `$login` marker '
                       'in it to be replaced with current user credentials \n'
                       '(e.g., dc=mydomain,dc=com, or ou=Users,dc=mydomain,dc=com)'),
         missing='',
         preparer=strip_whitespace,
         title=_('Base DN'),
         widget='string')
     filter = colander.SchemaNode(
         colander.String(),
         default='',
         description=_('Filter to narrow results \n'
                       '(e.g., (&(objectCategory=Person)(objectClass=user)), or \n'
                       '(memberof=cn=rc-login,ou=groups,ou=company,dc=mydomain,dc=com)))'),
         missing='',
         preparer=strip_whitespace,
         title=_('LDAP Search Filter'),
         widget='string')
 
     search_scope = colander.SchemaNode(
         colander.String(),
         default=search_scope_choices[2],
         description=_('How deep to search LDAP. If unsure set to SUBTREE'),
         title=_('LDAP Search Scope'),
         validator=colander.OneOf(search_scope_choices),
         widget='select')
     attr_login = colander.SchemaNode(
         colander.String(),
         default='uid',
         description=_('LDAP Attribute to map to user name (e.g., uid, or sAMAccountName)'),
         preparer=strip_whitespace,
         title=_('Login Attribute'),
         missing_msg=_('The LDAP Login attribute of the CN must be specified'),
         widget='string')
     attr_firstname = colander.SchemaNode(
         colander.String(),
         default='',
         description=_('LDAP Attribute to map to first name (e.g., givenName)'),
         missing='',
         preparer=strip_whitespace,
         title=_('First Name Attribute'),
         widget='string')
     attr_lastname = colander.SchemaNode(
         colander.String(),
         default='',
         description=_('LDAP Attribute to map to last name (e.g., sn)'),
         missing='',
         preparer=strip_whitespace,
         title=_('Last Name Attribute'),
         widget='string')
     attr_email = colander.SchemaNode(
         colander.String(),
         default='',
         description=_('LDAP Attribute to map to email address (e.g., mail).\n'
                       'Emails are a crucial part of RhodeCode. \n'
                       'If possible add a valid email attribute to ldap users.'),
         missing='',
         preparer=strip_whitespace,
         title=_('Email Attribute'),
         widget='string')
 
 
 class AuthLdap(object):
 
     def _build_servers(self):
         return ', '.join(
             ["{}://{}:{}".format(
                 self.ldap_server_type, host.strip(), self.LDAP_SERVER_PORT)
              for host in self.SERVER_ADDRESSES])
 
     def __init__(self, server, base_dn, port=389, bind_dn='', bind_pass='',
                  tls_kind='PLAIN', tls_reqcert='DEMAND', ldap_version=3,
                  search_scope='SUBTREE', attr_login='uid',
                  ldap_filter=None):
         if ldap == Missing:
             raise LdapImportError("Missing or incompatible ldap library")
 
         self.debug = False
         self.ldap_version = ldap_version
         self.ldap_server_type = 'ldap'
 
         self.TLS_KIND = tls_kind
 
         if self.TLS_KIND == 'LDAPS':
             port = port or 689
             self.ldap_server_type += 's'
 
         OPT_X_TLS_DEMAND = 2
         self.TLS_REQCERT = getattr(ldap, 'OPT_X_TLS_%s' % tls_reqcert,
                                    OPT_X_TLS_DEMAND)
         # split server into list
         self.SERVER_ADDRESSES = server.split(',')
         self.LDAP_SERVER_PORT = port
 
         # USE FOR READ ONLY BIND TO LDAP SERVER
         self.attr_login = attr_login
 
         self.LDAP_BIND_DN = safe_str(bind_dn)
         self.LDAP_BIND_PASS = safe_str(bind_pass)
         self.LDAP_SERVER = self._build_servers()
         self.SEARCH_SCOPE = getattr(ldap, 'SCOPE_%s' % search_scope)
         self.BASE_DN = safe_str(base_dn)
         self.LDAP_FILTER = safe_str(ldap_filter)
 
     def _get_ldap_server(self):
         if self.debug:
             ldap.set_option(ldap.OPT_DEBUG_LEVEL, 255)
         if hasattr(ldap, 'OPT_X_TLS_CACERTDIR'):
             ldap.set_option(ldap.OPT_X_TLS_CACERTDIR,
                             '/etc/openldap/cacerts')
         ldap.set_option(ldap.OPT_REFERRALS, ldap.OPT_OFF)
         ldap.set_option(ldap.OPT_RESTART, ldap.OPT_ON)
         ldap.set_option(ldap.OPT_TIMEOUT, 20)
         ldap.set_option(ldap.OPT_NETWORK_TIMEOUT, 10)
         ldap.set_option(ldap.OPT_TIMELIMIT, 15)
         if self.TLS_KIND != 'PLAIN':
             ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, self.TLS_REQCERT)
         server = ldap.initialize(self.LDAP_SERVER)
         if self.ldap_version == 2:
             server.protocol = ldap.VERSION2
         else:
             server.protocol = ldap.VERSION3
 
         if self.TLS_KIND == 'START_TLS':
             server.start_tls_s()
 
         if self.LDAP_BIND_DN and self.LDAP_BIND_PASS:
             log.debug('Trying simple_bind with password and given login DN: %s',
                       self.LDAP_BIND_DN)
             server.simple_bind_s(self.LDAP_BIND_DN, self.LDAP_BIND_PASS)
 
         return server
 
     def get_uid(self, username):
         uid = username
         for server_addr in self.SERVER_ADDRESSES:
             uid = chop_at(username, "@%s" % server_addr)
         return uid
 
     def fetch_attrs_from_simple_bind(self, server, dn, username, password):
         try:
             log.debug('Trying simple bind with %s', dn)
             server.simple_bind_s(dn, safe_str(password))
             user = server.search_ext_s(
                 dn, ldap.SCOPE_BASE, '(objectClass=*)', )[0]
             _, attrs = user
             return attrs
 
         except ldap.INVALID_CREDENTIALS:
             log.debug(
                 "LDAP rejected password for user '%s': %s, org_exc:",
                 username, dn, exc_info=True)
 
     def authenticate_ldap(self, username, password):
         """
         Authenticate a user via LDAP and return his/her LDAP properties.
 
         Raises AuthenticationError if the credentials are rejected, or
         EnvironmentError if the LDAP server can't be reached.
 
         :param username: username
         :param password: password
         """
 
         uid = self.get_uid(username)
 
         if not password:
             msg = "Authenticating user %s with blank password not allowed"
             log.warning(msg, username)
             raise LdapPasswordError(msg)
         if "," in username:
             raise LdapUsernameError(
                 "invalid character `,` in username: `{}`".format(username))
         try:
             server = self._get_ldap_server()
             filter_ = '(&%s(%s=%s))' % (
                 self.LDAP_FILTER, self.attr_login, username)
             log.debug("Authenticating %r filter %s at %s", self.BASE_DN,
                       filter_, self.LDAP_SERVER)
             lobjects = server.search_ext_s(
                 self.BASE_DN, self.SEARCH_SCOPE, filter_)
 
             if not lobjects:
                 log.debug("No matching LDAP objects for authentication "
                           "of UID:'%s' username:(%s)", uid, username)
                 raise ldap.NO_SUCH_OBJECT()
 
             log.debug('Found matching ldap object, trying to authenticate')
             for (dn, _attrs) in lobjects:
                 if dn is None:
                     continue
 
                 user_attrs = self.fetch_attrs_from_simple_bind(
                     server, dn, username, password)
                 if user_attrs:
                     break
 
             else:
                 raise LdapPasswordError(
                     'Failed to authenticate user `{}`'
                     'with given password'.format(username))
 
         except ldap.NO_SUCH_OBJECT:
             log.debug("LDAP says no such user '%s' (%s), org_exc:",
                       uid, username, exc_info=True)
             raise LdapUsernameError('Unable to find user')
         except ldap.SERVER_DOWN:
             org_exc = traceback.format_exc()
             raise LdapConnectionError(
                 "LDAP can't access authentication "
                 "server, org_exc:%s" % org_exc)
 
         return dn, user_attrs
 
 
 class RhodeCodeAuthPlugin(RhodeCodeExternalAuthPlugin):
     # used to define dynamic binding in the
     DYNAMIC_BIND_VAR = '$login'
     _settings_unsafe_keys = ['dn_pass']
 
     def includeme(self, config):
         config.add_authn_plugin(self)
         config.add_authn_resource(self.get_id(), LdapAuthnResource(self))
         config.add_view(
             'rhodecode.authentication.views.AuthnPluginViewBase',
             attr='settings_get',
             renderer='rhodecode:templates/admin/auth/plugin_settings.mako',
             request_method='GET',
             route_name='auth_home',
             context=LdapAuthnResource)
         config.add_view(
             'rhodecode.authentication.views.AuthnPluginViewBase',
             attr='settings_post',
             renderer='rhodecode:templates/admin/auth/plugin_settings.mako',
             request_method='POST',
             route_name='auth_home',
             context=LdapAuthnResource)
 
     def get_settings_schema(self):
         return LdapSettingsSchema()
 
     def get_display_name(self):
         return _('LDAP')
 
     @hybrid_property
     def name(self):
         return "ldap"
 
     def use_fake_password(self):
         return True
 
     def user_activation_state(self):
-        def_user_perms = User.get_default_user().AuthUser.permissions['global']
+        def_user_perms = User.get_default_user().AuthUser().permissions['global']
         return 'hg.extern_activate.auto' in def_user_perms
 
     def try_dynamic_binding(self, username, password, current_args):
         """
         Detects marker inside our original bind, and uses dynamic auth if
         present
         """
 
         org_bind = current_args['bind_dn']
         passwd = current_args['bind_pass']
 
         def has_bind_marker(username):
             if self.DYNAMIC_BIND_VAR in username:
                 return True
 
         # we only passed in user with "special" variable
         if org_bind and has_bind_marker(org_bind) and not passwd:
             log.debug('Using dynamic user/password binding for ldap '
                       'authentication. Replacing `%s` with username',
                       self.DYNAMIC_BIND_VAR)
             current_args['bind_dn'] = org_bind.replace(
                 self.DYNAMIC_BIND_VAR, username)
             current_args['bind_pass'] = password
 
         return current_args
 
     def auth(self, userobj, username, password, settings, **kwargs):
         """
         Given a user object (which may be null), username, a plaintext password,
         and a settings object (containing all the keys needed as listed in
         settings()), authenticate this user's login attempt.
 
         Return None on failure. On success, return a dictionary of the form:
 
             see: RhodeCodeAuthPluginBase.auth_func_attrs
         This is later validated for correctness
         """
 
         if not username or not password:
             log.debug('Empty username or password skipping...')
             return None
 
         ldap_args = {
             'server': settings.get('host', ''),
             'base_dn': settings.get('base_dn', ''),
             'port': settings.get('port'),
             'bind_dn': settings.get('dn_user'),
             'bind_pass': settings.get('dn_pass'),
             'tls_kind': settings.get('tls_kind'),
             'tls_reqcert': settings.get('tls_reqcert'),
             'search_scope': settings.get('search_scope'),
             'attr_login': settings.get('attr_login'),
             'ldap_version': 3,
             'ldap_filter': settings.get('filter'),
         }
 
         ldap_attrs = self.try_dynamic_binding(username, password, ldap_args)
 
         log.debug('Checking for ldap authentication.')
 
         try:
             aldap = AuthLdap(**ldap_args)
             (user_dn, ldap_attrs) = aldap.authenticate_ldap(username, password)
             log.debug('Got ldap DN response %s', user_dn)
 
             def get_ldap_attr(k):
                 return ldap_attrs.get(settings.get(k), [''])[0]
 
             # old attrs fetched from RhodeCode database
             admin = getattr(userobj, 'admin', False)
             active = getattr(userobj, 'active', True)
             email = getattr(userobj, 'email', '')
             username = getattr(userobj, 'username', username)
             firstname = getattr(userobj, 'firstname', '')
             lastname = getattr(userobj, 'lastname', '')
             extern_type = getattr(userobj, 'extern_type', '')
 
             groups = []
             user_attrs = {
                 'username': username,
                 'firstname': safe_unicode(
                     get_ldap_attr('attr_firstname') or firstname),
                 'lastname': safe_unicode(
                     get_ldap_attr('attr_lastname') or lastname),
                 'groups': groups,
                 'email': get_ldap_attr('attr_email') or email,
                 'admin': admin,
                 'active': active,
                 'active_from_extern': None,
                 'extern_name': user_dn,
                 'extern_type': extern_type,
             }
             log.debug('ldap user: %s', user_attrs)
             log.info('user %s authenticated correctly', user_attrs['username'])
 
             return user_attrs
 
         except (LdapUsernameError, LdapPasswordError, LdapImportError):
             log.exception("LDAP related exception")
             return None
         except (Exception,):
             log.exception("Other exception")
             return None

rhodecode/authentication/plugins/auth_rhodecode.py

@@ -1,142 +1,142 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2012-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 RhodeCode authentication plugin for built in internal auth
 """
 
 import logging
 
 from pylons.i18n.translation import lazy_ugettext as _
 
 from rhodecode.authentication.base import RhodeCodeAuthPluginBase, hybrid_property
 from rhodecode.authentication.routes import AuthnPluginResourceBase
 from rhodecode.lib.utils2 import safe_str
 from rhodecode.model.db import User
 
 log = logging.getLogger(__name__)
 
 
 def plugin_factory(plugin_id, *args, **kwds):
     plugin = RhodeCodeAuthPlugin(plugin_id)
     return plugin
 
 
 class RhodecodeAuthnResource(AuthnPluginResourceBase):
     pass
 
 
 class RhodeCodeAuthPlugin(RhodeCodeAuthPluginBase):
 
     def includeme(self, config):
         config.add_authn_plugin(self)
         config.add_authn_resource(self.get_id(), RhodecodeAuthnResource(self))
         config.add_view(
             'rhodecode.authentication.views.AuthnPluginViewBase',
             attr='settings_get',
             renderer='rhodecode:templates/admin/auth/plugin_settings.mako',
             request_method='GET',
             route_name='auth_home',
             context=RhodecodeAuthnResource)
         config.add_view(
             'rhodecode.authentication.views.AuthnPluginViewBase',
             attr='settings_post',
             renderer='rhodecode:templates/admin/auth/plugin_settings.mako',
             request_method='POST',
             route_name='auth_home',
             context=RhodecodeAuthnResource)
 
     def get_display_name(self):
         return _('Rhodecode')
 
     @hybrid_property
     def name(self):
         return "rhodecode"
 
     def user_activation_state(self):
-        def_user_perms = User.get_default_user().AuthUser.permissions['global']
+        def_user_perms = User.get_default_user().AuthUser().permissions['global']
         return 'hg.register.auto_activate' in def_user_perms
 
     def allows_authentication_from(
             self, user, allows_non_existing_user=True,
             allowed_auth_plugins=None, allowed_auth_sources=None):
         """
         Custom method for this auth that doesn't accept non existing users.
         We know that user exists in our database.
         """
         allows_non_existing_user = False
         return super(RhodeCodeAuthPlugin, self).allows_authentication_from(
             user, allows_non_existing_user=allows_non_existing_user)
 
     def auth(self, userobj, username, password, settings, **kwargs):
         if not userobj:
             log.debug('userobj was:%s skipping' % (userobj, ))
             return None
         if userobj.extern_type != self.name:
             log.warning(
                 "userobj:%s extern_type mismatch got:`%s` expected:`%s`" %
                 (userobj, userobj.extern_type, self.name))
             return None
 
         user_attrs = {
             "username": userobj.username,
             "firstname": userobj.firstname,
             "lastname": userobj.lastname,
             "groups": [],
             "email": userobj.email,
             "admin": userobj.admin,
             "active": userobj.active,
             "active_from_extern": userobj.active,
             "extern_name": userobj.user_id,
             "extern_type": userobj.extern_type,
         }
 
         log.debug("User attributes:%s" % (user_attrs, ))
         if userobj.active:
             from rhodecode.lib import auth
             crypto_backend = auth.crypto_backend()
             password_encoded = safe_str(password)
             password_match, new_hash = crypto_backend.hash_check_with_upgrade(
                 password_encoded, userobj.password)
 
             if password_match and new_hash:
                 log.debug('user %s properly authenticated, but '
                           'requires hash change to bcrypt', userobj)
                 # if password match, and we use OLD deprecated hash,
                 # we should migrate this user hash password to the new hash
                 # we store the new returned by hash_check_with_upgrade function
                 user_attrs['_hash_migrate'] = new_hash
 
             if userobj.username == User.DEFAULT_USER and userobj.active:
                 log.info(
                     'user %s authenticated correctly as anonymous user', userobj)
                 return user_attrs
 
             elif userobj.username == username and password_match:
                 log.info('user %s authenticated correctly', userobj)
                 return user_attrs
             log.info("user %s had a bad password when "
                      "authenticating on this plugin", userobj)
             return None
         else:
             log.warning(
                 'user `%s` failed to authenticate via %s, reason: account not '
                 'active.', username, self.name)
             return None

rhodecode/authentication/plugins/auth_token.py

@@ -1,146 +1,146 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2016-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 RhodeCode authentication token plugin for built in internal auth
 """
 
 import logging
 
 from rhodecode.translation import _
 from rhodecode.authentication.base import (
     RhodeCodeAuthPluginBase, VCS_TYPE, hybrid_property)
 from rhodecode.authentication.routes import AuthnPluginResourceBase
 from rhodecode.model.db import User, UserApiKeys, Repository
 
 
 log = logging.getLogger(__name__)
 
 
 def plugin_factory(plugin_id, *args, **kwds):
     plugin = RhodeCodeAuthPlugin(plugin_id)
     return plugin
 
 
 class RhodecodeAuthnResource(AuthnPluginResourceBase):
     pass
 
 
 class RhodeCodeAuthPlugin(RhodeCodeAuthPluginBase):
     """
     Enables usage of authentication tokens for vcs operations.
     """
 
     def includeme(self, config):
         config.add_authn_plugin(self)
         config.add_authn_resource(self.get_id(), RhodecodeAuthnResource(self))
         config.add_view(
             'rhodecode.authentication.views.AuthnPluginViewBase',
             attr='settings_get',
             renderer='rhodecode:templates/admin/auth/plugin_settings.mako',
             request_method='GET',
             route_name='auth_home',
             context=RhodecodeAuthnResource)
         config.add_view(
             'rhodecode.authentication.views.AuthnPluginViewBase',
             attr='settings_post',
             renderer='rhodecode:templates/admin/auth/plugin_settings.mako',
             request_method='POST',
             route_name='auth_home',
             context=RhodecodeAuthnResource)
 
     def get_display_name(self):
         return _('Rhodecode Token Auth')
 
     @hybrid_property
     def name(self):
         return "authtoken"
 
     def user_activation_state(self):
-        def_user_perms = User.get_default_user().AuthUser.permissions['global']
+        def_user_perms = User.get_default_user().AuthUser().permissions['global']
         return 'hg.register.auto_activate' in def_user_perms
 
     def allows_authentication_from(
             self, user, allows_non_existing_user=True,
             allowed_auth_plugins=None, allowed_auth_sources=None):
         """
         Custom method for this auth that doesn't accept empty users. And also
         allows users from all other active plugins to use it and also
         authenticate against it. But only via vcs mode
         """
         from rhodecode.authentication.base import get_authn_registry
         authn_registry = get_authn_registry()
 
         active_plugins = set(
             [x.name for x in authn_registry.get_plugins_for_authentication()])
         active_plugins.discard(self.name)
 
         allowed_auth_plugins = [self.name] + list(active_plugins)
         # only for vcs operations
         allowed_auth_sources = [VCS_TYPE]
 
         return super(RhodeCodeAuthPlugin, self).allows_authentication_from(
             user, allows_non_existing_user=False,
             allowed_auth_plugins=allowed_auth_plugins,
             allowed_auth_sources=allowed_auth_sources)
 
     def auth(self, userobj, username, password, settings, **kwargs):
         if not userobj:
             log.debug('userobj was:%s skipping' % (userobj, ))
             return None
 
         user_attrs = {
             "username": userobj.username,
             "firstname": userobj.firstname,
             "lastname": userobj.lastname,
             "groups": [],
             "email": userobj.email,
             "admin": userobj.admin,
             "active": userobj.active,
             "active_from_extern": userobj.active,
             "extern_name": userobj.user_id,
             "extern_type": userobj.extern_type,
         }
 
         log.debug('Authenticating user with args %s', user_attrs)
         if userobj.active:
             # calling context repo for token scopes
             scope_repo_id = None
             if self.acl_repo_name:
                 repo = Repository.get_by_repo_name(self.acl_repo_name)
                 scope_repo_id = repo.repo_id if repo else None
 
             token_match = userobj.authenticate_by_token(
                 password, roles=[UserApiKeys.ROLE_VCS],
                 scope_repo_id=scope_repo_id)
 
             if userobj.username == username and token_match:
                 log.info(
                     'user `%s` successfully authenticated via %s',
                     user_attrs['username'], self.name)
                 return user_attrs
             log.error(
                 'user `%s` failed to authenticate via %s, reason: bad or '
                 'inactive token.', username, self.name)
         else:
             log.warning(
                 'user `%s` failed to authenticate via %s, reason: account not '
                 'active.', username, self.name)
         return None

rhodecode/tests/auth_external_test.py

@@ -1,109 +1,109 b''
 # -*- coding: utf-8 -*-
 
 # Copyright (C) 2010-2017 RhodeCode GmbH
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License, version 3
 # (only), as published by the Free Software Foundation.
 #
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY; without even the implied warranty of
 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 # GNU General Public License for more details.
 #
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #
 # This program is dual-licensed. If you wish to learn more about the
 # RhodeCode Enterprise Edition, including its added features, Support services,
 # and proprietary license terms, please see https://rhodecode.com/licenses/
 
 """
 External module for testing plugins
 
 rhodecode.tests.auth_external_test
 
 """
 import logging
 import traceback
 
 from rhodecode.authentication.base import (
     RhodeCodeExternalAuthPlugin, hybrid_property)
 from rhodecode.model.db import User
 from rhodecode.lib.ext_json import formatted_json
 
 log = logging.getLogger(__name__)
 
 
 class RhodeCodeAuthPlugin(RhodeCodeExternalAuthPlugin):
     def __init__(self):
         self._logger = logging.getLogger(__name__)
 
     @hybrid_property
     def allows_creating_users(self):
         return True
 
     @hybrid_property
     def name(self):
         return "external_test"
 
     def settings(self):
         settings = [
         ]
         return settings
 
     def use_fake_password(self):
         return True
 
     def user_activation_state(self):
-        def_user_perms = User.get_default_user().AuthUser.permissions['global']
+        def_user_perms = User.get_default_user().AuthUser().permissions['global']
         return 'hg.extern_activate.auto' in def_user_perms
 
     def auth(self, userobj, username, password, settings, **kwargs):
         """
         Given a user object (which may be null), username, a plaintext password,
         and a settings object (containing all the keys needed as listed in settings()),
         authenticate this user's login attempt.
 
         Return None on failure. On success, return a dictionary of the form:
 
             see: RhodeCodeAuthPluginBase.auth_func_attrs
         This is later validated for correctness
         """
 
         if not username or not password:
             log.debug('Empty username or password skipping...')
             return None
 
         try:
             user_dn = username
 
             # # old attrs fetched from RhodeCode database
             admin = getattr(userobj, 'admin', False)
             active = getattr(userobj, 'active', True)
             email = getattr(userobj, 'email', '')
             firstname = getattr(userobj, 'firstname', '')
             lastname = getattr(userobj, 'lastname', '')
             extern_type = getattr(userobj, 'extern_type', '')
             #
             user_attrs = {
                 'username': username,
                 'firstname': firstname,
                 'lastname': lastname,
                 'groups': [],
                 'email': '[e-mail]' % username,
                 'admin': admin,
                 'active': active,
                 "active_from_extern": None,
                 'extern_name': user_dn,
                 'extern_type': extern_type,
             }
 
             log.debug('EXTERNAL user: \n%s' % formatted_json(user_attrs))
             log.info('user %s authenticated correctly' % user_attrs['username'])
 
             return user_attrs
 
         except (Exception,):
             log.error(traceback.format_exc())
             return None