Ticket #148: PermitViewPublic.patch

PyLucid/index.py

@@ -19 +19 @@
 
 import datetime, md5
 
-from django.http import HttpResponse, HttpResponsePermanentRedirect
+from django.http import HttpResponse, HttpResponsePermanentRedirect, HttpResponseRedirect
 from django.template import RequestContext
 from django.core.cache import cache
 from django.core.exceptions import ImproperlyConfigured
@@ -31 +31 @@
 
 from PyLucid.system import plugin_manager
 from PyLucid.system.response import SimpleStringIO
-from PyLucid.system.exceptions import AccessDeny
+from PyLucid.system.exceptions import AccessDenied
 from PyLucid.system.page_msg import PageMessages
 from PyLucid.system.detect_page import get_current_page_obj, \
                                                             get_default_page_id
@@ -209 +209 @@
     setup_debug(request)
 
     # Get the response for the requested cms page:
-    current_page_obj = get_current_page_obj(request, url)
-    context = _get_context(request, current_page_obj)
-    response = _render_cms_page(context)
+    try:
+        current_page_obj = get_current_page_obj(request, url)
+        context = _get_context(request, current_page_obj)
+        response = _render_cms_page(context)
+    except AccessDenied:
+        path = '/'.join(('',settings.COMMAND_URL_PREFIX,'1','auth','login','?next=%s'))
+        return HttpResponseRedirect(path % request.path)
 
     if use_cache:
         # It's a anonymous user -> Cache the cms page.
@@ -267 +271 @@
         output = plugin_manager.handle_command(
             context, local_response, module_name, method_name, url_args
         )
-    except AccessDeny:
-        page_content = "[Permission Deny!]"
+    except AccessDenied:
+        page_content = "[Permission Denied!]"
     else:
         if output == None:
             # Plugin/Module has retuned the locale StringIO response object
@@ -323 +327 @@
     """
     current_page_obj = _get_page(request, page_id)
     url = current_page_obj.get_absolute_url()
-    return redirect(request, url)
- No newline at end of file
+    return redirect(request, url)

PyLucid/plugins_internal/auth/auth.py

@@ -1 +1 @@
 #!/usr/bin/python
-# -*- coding: UTF-8 -*-
+# -*- coding: utf-8 -*-
 
 """
     PyLucid JS-SHA-Login
@@ -26 +26 @@
 
 import datetime
 
+from django.http import HttpResponseRedirect
 from django.core import mail
 from django import newforms as forms
 from django.contrib.auth.models import User
@@ -148 +149 @@
             )
 
         UsernameForm = forms.form_for_model(User, fields=("username",))
+        
+        next_url = self.request.GET.get('next',self.URLs['scriptRoot'])
 
         def get_data(form):
             if DEBUG: self.page_msg(self.request.POST)
@@ -191 +194 @@
                 else:
                     self.page_msg.red("Wrong POST data.")
 
+        if DEBUG: self.page_msg("Next URL: %s" % next_url)
 
         context = {
             "fallback_url": self.URLs.adminLink(""),
             "form": username_form,
+            "next_url": next_url,
         }
         self._render_template("input_username", context)#, debug=True)
 
@@ -209 +214 @@
 
         PasswordForm = forms.form_for_model(User, fields=("password",))
 
+        next_url = self.request.POST.get('next_url',self.URLs['scriptRoot'])
+
         # Change the default TextInput to a PasswordInput
         PasswordForm.base_fields['password'].widget = forms.PasswordInput()
 
         context = {
             "username": user.username,
             "logout_url": self.URLs.methodLink("logout"),
+            "next_url": next_url,
         }
 
         # Delete the default django help text:
@@ -231 +239 @@
                     self._insert_reset_link(context)
                 else:
                     # Login ok
-                    return
+                    return HttpResponseRedirect(next_url)
 
         context["form"] = password_form
         self._render_template("plaintext_login", context)#, debug=True)
@@ -260 +268 @@
         # rebuild the login/logout link:
         add_dynamic_context(self.request, self.context)
 
+        next_url = self.request.POST.get('next_url',self.URLs['scriptRoot'])
+
+        # Redirect to next URL
+        HttpResponseRedirect(next_url)
+
 
     def _sha_login(self, user):
         """
@@ -275 +288 @@
                 msg += " %s" % e
             self.pass_reset(user.username, msg) # Display the pass reset form
             return
-
+        next_url = self.request.POST.get('next_url',self.URLs['scriptRoot'])
         salt = js_login_data.salt
         context = {
             "username": user.username,
             "fallback_url": self.URLs.adminLink(""),
             "salt": salt,
+            "next_url": next_url,
             "PyLucid_media_url": settings.PYLUCID_MEDIA_URL,
         }
 
@@ -326 +340 @@
                 else:
                     if user:
                         self._login_user(user)
-                        return
+                        return HttpResponseRedirect(next_url)
                 self._insert_reset_link(context)
                 self.page_msg.red(msg)
 
@@ -349 +363 @@
                 password = password_form.cleaned_data["password"]
                 self.page_msg("password:", password)
                 self.page_msg("SHA-1 - Not implemented completly, yet :(")
-                return
+                return HttpResponseRedirect(next_url)
         else:
             password_form = PasswordForm()
 
@@ -372 +386 @@
         add_dynamic_context(self.request, self.context)
 
         self.page_msg.green("You logged out.")
+        return HttpResponseRedirect(self.URLs['scriptRoot'])
 
     #__________________________________________________________________________
     # Password reset

PyLucid/plugins_internal/auth/internal_pages/input_password.html

@@ -5 +5 @@
 <form method="post" action="" name="login" onsubmit="check();">
   <input type="hidden" name="username" value="{{ username }}" />
   <input type="hidden" name="sha_login" value="little secure sha login" />
+  <input type="hidden" name="next_url" value="{{ next_url }}" />
 
   <label for="plaintext_pass">{% trans 'Password' %}:</label>
   <input id="plaintext_pass" type="password" maxlength="128" />
@@ -34 +35 @@
     submit_url = '.';
     focus_id = 'plaintext_pass';
     init();
-</script>
- No newline at end of file
+</script>

PyLucid/plugins_internal/auth/internal_pages/input_username.html

@@ -11 +11 @@
   {% trans 'Log in' %}:
   <input type="submit" id="sha_button" name="sha_login" value="SHA-1 login" />
   <input type="submit" id="plaintext_button" name="plaintext_login" value="unsecure plaintext login" onclick="return confirm('Do you realy want to send your password in plaintext?')"/>
+  <input type="hidden" name="next_url" value="{{ next_url }}" />
 </form>
 </fieldset>
 
-<script type="text/javascript">document.getElementById("id_username").focus();</script>
- No newline at end of file
+<script type="text/javascript">document.getElementById("id_username").focus();</script>

PyLucid/plugins_internal/auth/internal_pages/plaintext_login.html

@@ -3 +3 @@
 <form method="post" action=".">
   <input type="hidden" name="username" value="{{ username }}" />
   <input type="hidden" name="plaintext_login" value="unsecure plaintext login" />
+  <input type="hidden" name="next_url" value="{{ next_url }}" />
   {{ form }}
   <input type="submit" value="{% trans 'Log in' %}" />
 </form>
@@ -11 +12 @@
 {% endif %}
 </fieldset>
 
-<script type="text/javascript">document.getElementById("id_password").focus();</script>
- No newline at end of file
+<script type="text/javascript">document.getElementById("id_password").focus();</script>

PyLucid/system/detect_page.py

@@ -17 +17 @@
 """
 
 from PyLucid.models import Page, Preference, Template
+from PyLucid.system.exceptions import AccessDenied
 
 from django.utils.translation import ugettext as _
 from django.core.exceptions import ImproperlyConfigured
@@ -83 +84 @@
 
     shortcuts.reverse()
     wrong_shutcuts = []
+    user = request.user
     for shortcut in shortcuts:
         try:
-            return Page.objects.get(shortcut__exact=shortcut)
+            page = Page.objects.get(shortcut__exact=shortcut)
+            if user.is_anonymous() and not page.permitViewPublic:
+                raise AccessDenied
+            else:
+                return page
         except Page.DoesNotExist:
             raise Http404(_("Page '%s' doesn't exists.") % shortcut)

PyLucid/system/exceptions.py

@@ -1 +1 @@
 #!/usr/bin/python
-# -*- coding: UTF-8 -*-
+# -*- coding: utf-8 -*-
 
 """
     PyLucid own Exception's
@@ -8 +8 @@
 http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html
 """
 
-class AccessDeny(Exception):
+class AccessDenied(Exception):
     pass
 
 class PluginError(Exception):
@@ -16 +16 @@
     For every error in a Plugin how should be displayed into the cms page.
     TODO: Catch this error in the plugin manager!
     """
-    pass
- No newline at end of file
+    pass

PyLucid/system/plugin_manager.py

@@ -141 +141 @@
                 # e.g. admin_menu
                 return ""
             else:
-                raise AccessDeny
+                raise AccessDenied
 
     if method_cfg["must_admin"]:
         # The User must be an admin to use this method
         if not (request.user.is_superuser or request.user.is_staff):
-            raise AccessDeny
+            raise AccessDenied
 
     URLs = context["URLs"]
     URLs.current_plugin = plugin_name