浏览代码

HUE-2229 [useradmin] Ask for previous password when changing it

Romain Rigaux 11 年之前
父节点
当前提交
0d7a2e7

+ 9 - 0
apps/useradmin/src/useradmin/forms.py

@@ -72,6 +72,7 @@ class UserChangeForm(django.contrib.auth.forms.UserChangeForm):
       error_messages = {'invalid': _t("Whitespaces and ':' not allowed") })
   password1 = forms.CharField(label=_t("Password"), widget=forms.PasswordInput, required=False)
   password2 = forms.CharField(label=_t("Password confirmation"), widget=forms.PasswordInput, required=False)
+  password_old = forms.CharField(label=_t("Previous Password"), widget=forms.PasswordInput, required=False)
   ensure_home_directory = forms.BooleanField(label=_t("Create home directory"),
                                             help_text=_t("Create home directory if one doesn't already exist."),
                                             initial=True,
@@ -102,6 +103,14 @@ class UserChangeForm(django.contrib.auth.forms.UserChangeForm):
       raise forms.ValidationError(_("You must specify a password when creating a new user."))
     return self.cleaned_data.get("password1", "")
 
+  def clean_password_old(self):
+    if self.instance.id is not None:
+      password1 = self.cleaned_data.get("password1", "")
+      password_old = self.cleaned_data.get("password_old", "")
+      if password1 != '' and not self.instance.check_password(password_old):
+        raise forms.ValidationError(_("The old password does not match the current password."))
+    return self.cleaned_data.get("password_old", "")
+
   def save(self, commit=True):
     """
     Update password if it's set.

+ 12 - 3
apps/useradmin/src/useradmin/templates/edit_user.mako

@@ -35,7 +35,13 @@ ${ layout.menubar(section='users') }
     <form id="editForm" method="POST" class="form form-horizontal" autocomplete="off">
     <div id="properties" class="section">
       <ul class="nav nav-tabs" style="margin-bottom: 0">
-        <li class="active"><a href="#step1" class="step">${ _('Step 1: Credentials (required)') }</a></li>
+        <li class="active">
+          <a href="#step1" class="step">${ _('Step 1: Credentials') }
+          % if not username:
+            ${ _('(required)') }
+          % endif
+          </a>
+        </li>
         <li><a href="#step2" class="step">${ user.is_superuser and _('Step 2: Names and Groups') or _('Step 2: Names') }</a>
         </li>
         % if user.is_superuser:
@@ -47,8 +53,11 @@ ${ layout.menubar(section='users') }
       <div id="step1" class="stepDetails">
         ${layout.render_field(form["username"], extra_attrs={'validate':'true'})}
         % if "password1" in form.fields:
-        ${layout.render_field(form["password1"], extra_attrs=username is None and {'validate':'true'} or {})}
-        ${layout.render_field(form["password2"], extra_attrs=username is None and {'validate':'true'} or {})}
+          ${layout.render_field(form["password1"], extra_attrs=username is None and {'validate':'true'} or {})}
+          ${layout.render_field(form["password2"], extra_attrs=username is None and {'validate':'true'} or {})}
+          % if username:
+            ${layout.render_field(form["password_old"], extra_attrs=username is None and {'validate':'true'} or {})}
+          % endif
         % endif
         ${layout.render_field(form["ensure_home_directory"])}
         </div>

+ 8 - 5
apps/useradmin/src/useradmin/tests.py

@@ -416,14 +416,17 @@ def test_user_admin():
   # Let's try changing the password
   response = c.post('/useradmin/users/edit/test', dict(username="test", first_name="Tom", last_name="Tester", is_superuser=True, password1="foo", password2="foobar"))
   assert_equal(["Passwords do not match."], response.context["form"]["password2"].errors, "Should have complained about mismatched password")
+  # Old password not confirmed
   response = c.post('/useradmin/users/edit/test', dict(username="test", first_name="Tom", last_name="Tester", password1="foo", password2="foo", is_active=True, is_superuser=True))
+  assert_equal(["The old password does not match the current password."], response.context["form"]["password_old"].errors, "Should have complained about old password")
+  # Good now
+  response = c.post('/useradmin/users/edit/test', dict(username="test", first_name="Tom", last_name="Tester", password1="foo", password2="foo", password_old="test", is_active=True, is_superuser=True))
   assert_true(User.objects.get(username="test").is_superuser)
   assert_true(User.objects.get(username="test").check_password("foo"))
   # Change it back!
-  response = c.post('/useradmin/users/edit/test', dict(username="test", first_name="Tom", last_name="Tester", password1="test", password2="test", is_active="True", is_superuser="True"))
+  response = c.post('/useradmin/users/edit/test', dict(username="test", first_name="Tom", last_name="Tester", password1="test", password2="test", password_old="foo", is_active="True", is_superuser="True"))
   assert_true(User.objects.get(username="test").check_password("test"))
-  assert_true(make_logged_in_client(username = "test", password = "test"),
-              "Check that we can still login.")
+  assert_true(make_logged_in_client(username = "test", password = "test"), "Check that we can still login.")
 
   # Check new user form for default group
   group = get_default_user_group()
@@ -456,7 +459,7 @@ def test_user_admin():
   response = c.post('/useradmin/users/new', dict(username="group_member", password1="test", password2="test", groups=[group.pk]))
   User.objects.get(username='group_member')
   assert_true(User.objects.get(username='group_member').groups.filter(name='test-group').exists())
-  response = c.post('/useradmin/users/edit/group_member', dict(username="group_member", password1="test", password2="test", groups=[]))
+  response = c.post('/useradmin/users/edit/group_member', dict(username="group_member", groups=[]))
   assert_false(User.objects.get(username='group_member').groups.filter(name='test-group').exists())
 
   # Check permissions by logging in as the new user
@@ -540,7 +543,7 @@ def test_ensure_home_directory():
   assert_false(cluster.fs.exists('/user/test2'))
   response = c.post('/useradmin/users/new', dict(username="test2", password1='test', password2='test'))
   assert_false(cluster.fs.exists('/user/test2'))
-  response = c.post('/useradmin/users/edit/%s' % "test2", dict(username="test2", password1='test', password2='test', ensure_home_directory=True))
+  response = c.post('/useradmin/users/edit/%s' % "test2", dict(username="test2", password1='test', password2='test', password_old="test", ensure_home_directory=True))
   assert_true(cluster.fs.exists('/user/test2'))
   dir_stat = cluster.fs.stats('/user/test2')
   assert_equal('test2', dir_stat.user)