From 00837c8ef3582bbb4e8557ce69243f4e856625f7 Mon Sep 17 00:00:00 2001 From: piyush-kr Date: Thu, 1 Jun 2017 20:24:14 +0530 Subject: [PATCH 1/6] password expiration policy --- cloud/endagaweb/celery.py | 4 + cloud/endagaweb/forms/dashboard_forms.py | 13 ++ cloud/endagaweb/models.py | 5 +- cloud/endagaweb/settings/prod.py | 4 + cloud/endagaweb/tasks.py | 16 +- .../endagaweb/templates/dashboard/index.html | 48 ++++++ .../templates/dashboard/password_change.html | 38 +++++ cloud/endagaweb/urls.py | 2 + cloud/endagaweb/views/user.py | 144 +++++++++++++++++- 9 files changed, 265 insertions(+), 9 deletions(-) create mode 100644 cloud/endagaweb/templates/dashboard/password_change.html diff --git a/cloud/endagaweb/celery.py b/cloud/endagaweb/celery.py index 8125f76f..c8731605 100644 --- a/cloud/endagaweb/celery.py +++ b/cloud/endagaweb/celery.py @@ -42,5 +42,9 @@ 'task': 'endagaweb.tasks.usageevents_to_sftp', # Run this at 15:00 UTC (10:00 PDT, 02:00 Papua time) 'schedule': crontab(minute=0, hour=17), + }, 'block-user': { + 'task': 'endagaweb.tasks.block_user', + # Run this at 15:00 UTC (10:00 PDT, 02:00 Papua time) + 'schedule': crontab(minute=0, hour=17), } }) diff --git a/cloud/endagaweb/forms/dashboard_forms.py b/cloud/endagaweb/forms/dashboard_forms.py index 2f9a6ddc..0d09b67f 100644 --- a/cloud/endagaweb/forms/dashboard_forms.py +++ b/cloud/endagaweb/forms/dashboard_forms.py @@ -153,6 +153,19 @@ def __init__(self, *args, **kwargs): class ChangePasswordForm(PasswordChangeForm): """Change password form visible on user profile page.""" + """Updated to show password policy text. """ + old_password = forms.CharField(required=True, label='Old Password', + widget=forms.PasswordInput(attrs={ + 'title': 'Enter Old Password'}), + ) + new_password1 = forms.CharField(required=True, label='New Password', + widget=forms.PasswordInput(attrs={ + 'title': 'Password must contain at least 8 characters,contains ' + 'alphanumeric and one special character.'}), ) + new_password2 = forms.CharField(required=True, label='Confirm Password', + widget=forms.PasswordInput(attrs={ + 'title': 'Confirm Password'}), ) + def __init__(self, *args, **kwargs): super(ChangePasswordForm, self).__init__(*args, **kwargs) self.helper = FormHelper() diff --git a/cloud/endagaweb/models.py b/cloud/endagaweb/models.py index d2429f9d..10eee760 100644 --- a/cloud/endagaweb/models.py +++ b/cloud/endagaweb/models.py @@ -77,7 +77,10 @@ class UserProfile(models.Model): # because a user may have permissions on other Network instances. # For example to get a list of networks the user can view: # >>> get_objects_for_user(user_profile.user, 'view_network', klass=Network) - network = models.ForeignKey('Network', null=True, on_delete=models.SET_NULL) + network = models.ForeignKey('Network', null=True, + on_delete=models.SET_NULL) + # Added for Password Expiry + last_pwd_update = models.DateTimeField(auto_now=True) def __str__(self): return "%s's profile" % self.user diff --git a/cloud/endagaweb/settings/prod.py b/cloud/endagaweb/settings/prod.py index 653f2f0e..933357ea 100644 --- a/cloud/endagaweb/settings/prod.py +++ b/cloud/endagaweb/settings/prod.py @@ -277,6 +277,10 @@ # Enable/disable billing for networks. If false, we ignore what's in the # network's account balance. 'NW_BILLING': os.environ.get("NW_BILLING", "True").lower() == "true", + # Password Expiration day + 'PASSWORD_EXPIRED_DAY': 90, + # Password Expiry Alert + 'PASSSWORD_EXPIRED_LAST_SEVEN_DAYS': 83, } STRIPE_API_KEY = os.environ.get("STRIPE_API_KEY", diff --git a/cloud/endagaweb/tasks.py b/cloud/endagaweb/tasks.py index 405ca698..18f564de 100644 --- a/cloud/endagaweb/tasks.py +++ b/cloud/endagaweb/tasks.py @@ -41,7 +41,7 @@ from endagaweb.models import Subscriber from endagaweb.models import UsageEvent from endagaweb.models import SystemEvent -from endagaweb.models import TimeseriesStat +from endagaweb.models import TimeseriesStat, UserProfile from endagaweb.ic_providers.nexmo import NexmoProvider @@ -439,3 +439,17 @@ def req_bts_log(self, obj, retry_delay=60*10, max_retries=432): raise finally: obj.save() + +@app.task(bind=True) +def block_user(self): + """ Block User if User password is not updated + for last 90 days + """ + six_month_ago = (django.utils.timezone.now() - + datetime.timedelta( + days=settings.ENDAGA['PASSWORD_EXPIRED_DAY'])) + user_profiles = UserProfile.objects.filter(last_pwd_update__lte=six_month_ago) + for user_profile in user_profiles: + user_profile.user.is_active = False + print '%s user is Blocked!' % user_profile.user.username + user_profile.user.save() diff --git a/cloud/endagaweb/templates/dashboard/index.html b/cloud/endagaweb/templates/dashboard/index.html index 417197b9..208732d7 100644 --- a/cloud/endagaweb/templates/dashboard/index.html +++ b/cloud/endagaweb/templates/dashboard/index.html @@ -23,6 +23,54 @@ display: none; } + + + + + + +{% if messages %} + + + +{% endif %} + + + {% endblock %} diff --git a/cloud/endagaweb/templates/dashboard/password_change.html b/cloud/endagaweb/templates/dashboard/password_change.html new file mode 100644 index 00000000..5e1be883 --- /dev/null +++ b/cloud/endagaweb/templates/dashboard/password_change.html @@ -0,0 +1,38 @@ +{% extends "dashboard/layout.html" %} +{% comment %} +Copyright (c) 2016-present, Facebook, Inc. +All rights reserved. + +This source code is licensed under the BSD-style license found in the +LICENSE file in the root directory of this source tree. An additional grant +of patent rights can be found in the PATENTS file in the same directory. +{% endcomment %} +{% load apptags %} +{% load crispy_forms_tags %} + +{% block title %} {% tmpl_const "SITENAME" %} | Monitor Usage, Pay Bills {% endblock %} + +{% block content %} + +
+
+

Hi {{ user_profile.display_name }}!

+
+
+ +
+ +
+

Change Password

+ {% crispy change_pass_form %} + + {% for message in messages %} + {% if 'password' in message.tags %} +
{{ message }}
+ {% endif %} + {% endfor %} +
+
+ + +{% endblock %} diff --git a/cloud/endagaweb/urls.py b/cloud/endagaweb/urls.py index 4c7d2469..241541cd 100644 --- a/cloud/endagaweb/urls.py +++ b/cloud/endagaweb/urls.py @@ -83,6 +83,8 @@ url(r'^account/update', endagaweb.views.user.update_contact), url(r'^account/', endagaweb.views.dashboard.dashboard_view), url(r'^logout/$', django.contrib.auth.views.logout, {'next_page': '/'}), + # Added for ExpiredPassword + url(r'^password/change', endagaweb.views.user.change_expired_password), # Dashboard. url(r'^dashboard/card', endagaweb.views.dashboard.addcard), diff --git a/cloud/endagaweb/views/user.py b/cloud/endagaweb/views/user.py index 8d7fc776..2e8e7d54 100644 --- a/cloud/endagaweb/views/user.py +++ b/cloud/endagaweb/views/user.py @@ -27,6 +27,9 @@ from endagaweb.models import UserProfile import logging +from django.utils import timezone +import urlparse +import re logger = logging.getLogger('endagaweb') @@ -103,11 +106,28 @@ def auth_and_login(request): user = authenticate(username=request.POST['email'], password=request.POST['password']) if user: - login(request, user) - next_url = '/dashboard' - if 'next' in request.POST and request.POST['next']: - next_url = request.POST['next'] - return redirect(next_url) + if user.is_active: + login(request, user) + user = User.objects.get(username=user) + today = timezone.now() + user_profile = UserProfile.objects.get(user=user) + next_url = '/dashboard' + if 'next' in request.POST and request.POST['next']: + next_url = request.POST['next'] + if (today - user_profile.last_pwd_update).days >= \ + settings.ENDAGA['PASSSWORD_EXPIRED_LAST_SEVEN_DAYS']: + text = str(user) + ' , your account will be blocked in next '\ + + str(settings.ENDAGA['PASSWORD_EXPIRED_DAY'] - + (today - user_profile.last_pwd_update).days) + messages.error(request, text) + return redirect(next_url) + else: + return redirect(next_url) + else: + # Notification, if blocked user is trying to log in + text = "This user is blocked. Please contact admin." + messages.error(request, text) + return redirect('/login/') else: text = "Sorry, that email / password combination is not valid." messages.error(request, text) @@ -123,13 +143,26 @@ def change_password(request): required_params = ('old_password', 'new_password1', 'new_password2') if not all([param in request.POST for param in required_params]): return HttpResponseBadRequest() - # Validate - redirect_url = '/dashboard/profile' + # Validate url for redirect + if urlparse.urlparse(request.META['HTTP_REFERER']).path != '/dashboard/profile': + redirect_url = '/password/change' + else: + redirect_url = '/dashboard/profile' if not request.user.check_password(request.POST['old_password']): text = 'Error: old password is incorrect.' tags = 'password alert alert-danger' messages.error(request, text, extra_tags=tags) return redirect(redirect_url) + if not validate_password_strength(request.POST['new_password1']): + text = 'Error: password must contain at least 8 characters,contains alphanumeric and one special character..' + tags = 'password alert alert-danger' + messages.info(request, text, extra_tags=tags) + return redirect(redirect_url) + if request.POST['old_password'] == request.POST['new_password1']: + text = 'Error: new password must not be old password.' + tags = 'password alert alert-danger' + messages.error(request, text, extra_tags=tags) + return redirect(redirect_url) if request.POST['new_password1'] != request.POST['new_password2']: text = 'Error: new passwords do not match.' tags = 'password alert alert-danger' @@ -142,10 +175,16 @@ def change_password(request): return redirect(redirect_url) # Everything checks out, change the password. request.user.set_password(request.POST['new_password1']) + user_profile = UserProfile.objects.get(user=request.user) + user_profile.last_pwd_update = timezone.now() + user_profile.save() request.user.save() text = 'Password changed successfully.' tags = 'password alert alert-success' messages.success(request, text, extra_tags=tags) + if urlparse.urlparse(request.META['HTTP_REFERER'] + ).path != '/dashboard/profile': + redirect_url = '/dashboard' return redirect(redirect_url) @@ -219,3 +258,94 @@ def update_notify_numbers(request): return redirect("/dashboard/profile") return HttpResponseBadRequest() + +@login_required(login_url='/login/') +def check_user(request): + if request.method == 'GET': + context = {} + if 'email' in request.GET: + if User.objects.filter(email=request.GET['email']).exists(): + context['email_available'] = False + else: + context['email_available'] = True + elif 'username' in request.GET: + if User.objects.filter(username=request.GET['username']).exists(): + context['username_available'] = False + else: + context['username_available'] = True + + return JsonResponse(context) + return HttpResponseBadRequest() + +# This view handles the password reset. +def reset(request): + return password_reset(request, + email_template_name= + 'dashboard/user_management/reset_email.html', + subject_template_name= + 'dashboard/user_management/reset_subject.txt', + post_reset_redirect=reverse('user-management')) + + +# This view handles the changing password to reset. +def reset_confirm(request, uidb64=None, token=None): + return password_reset_confirm(request, uidb64=uidb64, + template_name= + 'dashboard/user_management/reset_confirm.html', + token=token, post_reset_redirect= + reverse('success')) + + +def success(request): + return render(request, "dashboard/user_management/success.html") + + +@login_required(login_url='/login/') +def role_default_permissions(request): + if request.method == 'GET': + role = request.GET['role'] + permission_set = ['credit', 'graph', 'report', "smsbroadcast", "tower", + "bts", "subscriber", "network", + "notification", "usageevent"] + + business_analyst = ['view_graph', 'view_report', 'view_bts', + 'view_subscriber', 'view_network'] + + loader = ['view_graph', 'view_report', 'view_bts', 'view_subscriber', + 'view_network', 'change_subscriber', 'change_network', + 'add_subscriber', 'add_sms', 'add_credit', 'download_graph'] + + partner = ['view_graph', 'view_report', 'view_bts', 'view_subscriber', + 'view_network', 'edit_subscriber', 'edit_network', + 'add_subscriber', 'add_sms', 'download_graph'] + + content_type = ContentType.objects.filter(app_label='endagaweb', + model__in= + permission_set).values_list('id', flat=True) + permission = Permission.objects.filter( + content_type__in=content_type).values_list('id', flat=True) + role_permission = [] + if role == 'Business Analyst': + role_permission = Permission.objects.filter( + codename__in=business_analyst).values_list('id', flat=True) + elif role == 'Loader': + role_permission = Permission.objects.filter( + codename__in=loader).values_list('id', flat=True) + elif role == 'Partner': + role_permission = Permission.objects.filter( + codename__in=partner).values_list('id', flat=True) + else: + for i in permission: + role_permission.append(i) + + return JsonResponse({'permissions': list(role_permission)}) + return HttpResponseBadRequest() + +def validate_password_strength(value): + """Checks that a submitted value should match regex and return + boolean value + """ + + regex = "(?=.*[a-zA-Z])(?=.*\\d)(?=.*[!@#$%&*()_+=|<>?{}\\[\\]~-]).{8}" + pattern = re.compile(regex) + return bool(pattern.match(value)) From 1703300a21f5862e293ff32d36ecf0c51c6924a9 Mon Sep 17 00:00:00 2001 From: piyush-kr Date: Sat, 3 Jun 2017 01:16:35 +0530 Subject: [PATCH 2/6] review comments incorporated --- cloud/endagaweb/models.py | 3 +- cloud/endagaweb/tasks.py | 6 +- .../endagaweb/templates/dashboard/index.html | 4 +- cloud/endagaweb/tests/test_user_password.py | 230 ++++++++++++++++++ cloud/endagaweb/views/user.py | 145 ++++------- 5 files changed, 283 insertions(+), 105 deletions(-) create mode 100644 cloud/endagaweb/tests/test_user_password.py diff --git a/cloud/endagaweb/models.py b/cloud/endagaweb/models.py index 10eee760..133668c2 100644 --- a/cloud/endagaweb/models.py +++ b/cloud/endagaweb/models.py @@ -1469,8 +1469,7 @@ class ConfigurationKey(models.Model): Can be associated with many things. """ bts = models.ForeignKey(BTS, null=True, blank=True, on_delete=models.CASCADE) - network = models.ForeignKey(Network, null=True, blank=True, - on_delete=models.CASCADE) + network = models.ForeignKey(Network, null=True, blank=True, on_delete=models.CASCADE) category = models.TextField() # "endaga", "openbts", etc.. key = models.TextField() value = models.TextField() diff --git a/cloud/endagaweb/tasks.py b/cloud/endagaweb/tasks.py index 18f564de..18dc1f12 100644 --- a/cloud/endagaweb/tasks.py +++ b/cloud/endagaweb/tasks.py @@ -443,12 +443,12 @@ def req_bts_log(self, obj, retry_delay=60*10, max_retries=432): @app.task(bind=True) def block_user(self): """ Block User if User password is not updated - for last 90 days + for last number of days which is configured in a settings . """ - six_month_ago = (django.utils.timezone.now() - + password_expired_duration = (django.utils.timezone.now() - datetime.timedelta( days=settings.ENDAGA['PASSWORD_EXPIRED_DAY'])) - user_profiles = UserProfile.objects.filter(last_pwd_update__lte=six_month_ago) + user_profiles = UserProfile.objects.filter(last_pwd_update__lte=password_expired_duration) for user_profile in user_profiles: user_profile.user.is_active = False print '%s user is Blocked!' % user_profile.user.username diff --git a/cloud/endagaweb/templates/dashboard/index.html b/cloud/endagaweb/templates/dashboard/index.html index 208732d7..02860334 100644 --- a/cloud/endagaweb/templates/dashboard/index.html +++ b/cloud/endagaweb/templates/dashboard/index.html @@ -50,10 +50,10 @@

{% for message in messages %}

- {% if message.text %} {% endif %} Hi {{ message }} Days. + {% if message.text %} {% endif %} Hi {{ message }} {% endfor %} - Please change your password . + Please change your password.

diff --git a/cloud/endagaweb/tests/test_user_password.py b/cloud/endagaweb/tests/test_user_password.py new file mode 100644 index 00000000..cd1041e2 --- /dev/null +++ b/cloud/endagaweb/tests/test_user_password.py @@ -0,0 +1,230 @@ +"""Tests for models.Users password + +Copyright (c) 2016-present, Facebook, Inc. +All rights reserved. + +This source code is licensed under the BSD-style license found in the +LICENSE file in the root directory of this source tree. An additional grant +of patent rights can be found in the PATENTS file in the same directory. +""" + +from __future__ import absolute_import +from __future__ import division +from __future__ import print_function +from __future__ import unicode_literals + +from django import test + + +from django.test import TestCase + +from endagaweb import models + + +class TestBase(TestCase): + + + @classmethod + def setUpClass(cls): + cls.username = 'testuser' + cls.password = 'testuser' + cls.user = models.User(username=cls.username, email='y@l.com') + cls.user.set_password(cls.password) + cls.user.save() + cls.error_tag = 'password alert alert-danger error' + cls.success_tag = 'password alert alert-success success' + + # Create a test client. + cls.client = test.Client() + + @classmethod + def tearDownClass(cls): + cls.user.delete() + + def tearDown(self): + self.logout() + + def login(self): + """Log the client in.""" + data = { + 'email': self.username, + 'password': self.password, + } + self.client.post('/auth/', data) + + def logout(self): + """Log the client out.""" + self.client.get('/logout') + + @classmethod + def getmessage(cls, response): + """Helper method to return message from response """ + for c in response.context: + message = [m for m in c.get('messages')][0] + if message: + return message + + +class UserPasswordStrengthTests(TestBase): + """Testing strength of new password.""" + + + def test_old_password(self): + """validate invalid old password.""" + self.login() + data = { + 'old_password': 'testuser1', + 'new_password1': 'Admin_123', + 'new_password2': 'Admin_123' + } + response = self.client.post('/account/password/change/', data , + follow=True, HTTP_REFERER='/password/change') + message = self.getmessage(response) + self.assertEqual(message.tags, self.error_tag) + + def test_new_password_case1(self): + """validate new password must contain 8 length.""" + self.login() + data = { + 'old_password': 'testuser', + 'new_password1': 'test_12', + 'new_password2': 'test_12' + } + response = self.client.post('/account/password/change/', data, + follow=True,HTTP_REFERER='/password/change') + message = self.getmessage(response) + self.assertEqual(message.tags, self.error_tag) + + def test_new_password_case2(self): + """validate new password must contain alphanumeric.""" + self.login() + data = { + 'old_password': 'testuser', + 'new_password1': 'user_abcde', + 'new_password2': 'user_abcde' + } + response = self.client.post('/account/password/change/', data, + follow=True, HTTP_REFERER='/password/change') + message = self.getmessage(response) + self.assertEqual(message.tags, self.error_tag) + + def test_new_password_case3(self): + """validate new password must contain alphanumeric.""" + self.login() + data = { + 'old_password': 'testuser', + 'new_password1': '1988@1999', + 'new_password2': '1988@1999' + } + response = self.client.post('/account/password/change/', data, + follow=True, HTTP_REFERER='/password/change') + message = self.getmessage(response) + self.assertEqual(message.tags,self.error_tag) + + + def test_new_password_case4(self): + """validate new password must contain special character.""" + self.login() + data = { + 'old_password': 'testuser', + 'new_password1': '1988abcd', + 'new_password2': '1988abcd' + } + response = self.client.post('/account/password/change/', data, + follow=True, HTTP_REFERER='/password/change') + message = self.getmessage(response) + self.assertEqual(message.tags, self.error_tag) + + def test_new_password_case5(self): + """validate new password must be minimum length of 8 character.""" + self.login() + data = { + 'old_password': 'testuser', + 'new_password1': 'sinha_1', + 'new_password2': 'sinha_1' + } + response = self.client.post('/account/password/change', data, + follow=True, HTTP_REFERER='/password/change') + message = self.getmessage(response) + self.assertEqual(message.tags, self.error_tag) + + def test_new_password_case6(self): + """validate new password must have alhanumeric and special character.""" + self.login() + data = { + 'old_password': 'testuser', + 'new_password1': 'userA_183', + 'new_password2': 'userA_183' + } + response = self.client.post('/account/password/change', data, + follow=True, HTTP_REFERER='/password/change') + message = self.getmessage(response) + self.assertEqual(message.tags, self.success_tag) + + def test_redirect_url_for_dashbboard_profile(self): + """validate if change password page come from /dashboard/profile , + redirect to /dashboard/profile.""" + self.login() + data = { + 'old_password': 'testuser', + 'new_password1': 'userA_184', + 'new_password2': 'userA_184' + } + response = self.client.post('/account/password/change/', data, + HTTP_REFERER='/dashboard/profile') + self.assertEqual(response.url, '/dashboard/profile') + self.assertEqual(response.status_code,302) + + def test_redirect_url_for_password_change(self): + """validate if change password page come from /password/change , + redirect to /password/change.""" + self.login() + data = { + 'old_password': 'testuser', + 'new_password1': 'userA%185', + 'new_password2': 'userA%184' + } + response = self.client.post('/account/password/change', data, + + HTTP_REFERER='/password/change') + self.assertEqual(response.url, '/password/change') + self.assertEqual(response.status_code, 302) + + def test_new_password_case7(self): + """validate new password with special character.""" + self.login() + data = { + 'old_password': 'testuser', + 'new_password1': '185@auser1', + 'new_password2': '185@auser1' + } + response = self.client.post('/account/password/change', data,follow=True, + HTTP_REFERER='/password/change' ) + message = self.getmessage(response) + self.assertEqual(message.tags, self.success_tag) + + def test_new_password_case8(self): + """validate new password with special character.""" + self.login() + data = { + 'old_password': 'testuser', + 'new_password1': 'User*#4As', + 'new_password2': 'User*#4As' + } + response = self.client.post('/account/password/change', data,follow=True, + HTTP_REFERER='/password/change' ) + message = self.getmessage(response) + self.assertEqual(message.tags, self.success_tag) + + def test_new_password_case9(self): + """validate new password with special character.""" + self.login() + data = { + 'old_password': 'testuser', + 'new_password1': '4as8trtaabb^', + 'new_password2': '4as8trtaabb^' + } + response = self.client.post('/account/password/change', data,follow=True, + HTTP_REFERER='/password/change' ) + message = self.getmessage(response) + self.assertEqual(message.tags, self.success_tag) diff --git a/cloud/endagaweb/views/user.py b/cloud/endagaweb/views/user.py index 2e8e7d54..385149c7 100644 --- a/cloud/endagaweb/views/user.py +++ b/cloud/endagaweb/views/user.py @@ -30,6 +30,9 @@ from django.utils import timezone import urlparse import re +from guardian.shortcuts import get_objects_for_user +from endagaweb.forms import dashboard_forms as dform +from endagaweb import models logger = logging.getLogger('endagaweb') @@ -116,9 +119,10 @@ def auth_and_login(request): next_url = request.POST['next'] if (today - user_profile.last_pwd_update).days >= \ settings.ENDAGA['PASSSWORD_EXPIRED_LAST_SEVEN_DAYS']: - text = str(user) + ' , your account will be blocked in next '\ - + str(settings.ENDAGA['PASSWORD_EXPIRED_DAY'] - - (today - user_profile.last_pwd_update).days) + password_expired_day_left = str(settings.ENDAGA['PASSWORD_EXPIRED_DAY'] + - (today - user_profile.last_pwd_update).days) + text = '%s, your account will be blocked in next %s days unless' \ + ' change your password' %(user, password_expired_day_left) messages.error(request, text) return redirect(next_url) else: @@ -144,7 +148,8 @@ def change_password(request): if not all([param in request.POST for param in required_params]): return HttpResponseBadRequest() # Validate url for redirect - if urlparse.urlparse(request.META['HTTP_REFERER']).path != '/dashboard/profile': + if urlparse.urlparse(request.META['HTTP_REFERER'] + ).path != '/dashboard/profile': redirect_url = '/password/change' else: redirect_url = '/dashboard/profile' @@ -154,9 +159,10 @@ def change_password(request): messages.error(request, text, extra_tags=tags) return redirect(redirect_url) if not validate_password_strength(request.POST['new_password1']): - text = 'Error: password must contain at least 8 characters,contains alphanumeric and one special character..' - tags = 'password alert alert-danger' - messages.info(request, text, extra_tags=tags) + text = 'Error: password must contain at least 8 characters,contains ' \ + 'alphanumeric and one special character.' + tags = 'password alert alert-danger' + messages.error(request, text, extra_tags=tags) return redirect(redirect_url) if request.POST['old_password'] == request.POST['new_password1']: text = 'Error: new password must not be old password.' @@ -187,6 +193,24 @@ def change_password(request): redirect_url = '/dashboard' return redirect(redirect_url) +@login_required(login_url='/login/') +def change_expired_password(request): + """Render password change template to change + password + """ + user_profile = UserProfile.objects.get(user=request.user) + network = user_profile.network + context = { + 'networks': get_objects_for_user(request.user, 'view_network', klass=models.Network), + 'user_profile': user_profile, + 'network': network, + 'user_profile': user_profile, + 'change_pass_form': dform.ChangePasswordForm(request.user), + + } + template = get_template("dashboard/password_change.html") + html = template.render(context, request) + return HttpResponse(html) @login_required(login_url='/login/') def update_contact(request): @@ -258,94 +282,19 @@ def update_notify_numbers(request): return redirect("/dashboard/profile") return HttpResponseBadRequest() - -@login_required(login_url='/login/') -def check_user(request): - if request.method == 'GET': - context = {} - if 'email' in request.GET: - if User.objects.filter(email=request.GET['email']).exists(): - context['email_available'] = False - else: - context['email_available'] = True - elif 'username' in request.GET: - if User.objects.filter(username=request.GET['username']).exists(): - context['username_available'] = False - else: - context['username_available'] = True - - return JsonResponse(context) - return HttpResponseBadRequest() - -# This view handles the password reset. -def reset(request): - return password_reset(request, - email_template_name= - 'dashboard/user_management/reset_email.html', - subject_template_name= - 'dashboard/user_management/reset_subject.txt', - post_reset_redirect=reverse('user-management')) - - -# This view handles the changing password to reset. -def reset_confirm(request, uidb64=None, token=None): - return password_reset_confirm(request, uidb64=uidb64, - template_name= - 'dashboard/user_management/reset_confirm.html', - token=token, post_reset_redirect= - reverse('success')) - - -def success(request): - return render(request, "dashboard/user_management/success.html") - - -@login_required(login_url='/login/') -def role_default_permissions(request): - if request.method == 'GET': - role = request.GET['role'] - permission_set = ['credit', 'graph', 'report', "smsbroadcast", "tower", - "bts", "subscriber", "network", - "notification", "usageevent"] - - business_analyst = ['view_graph', 'view_report', 'view_bts', - 'view_subscriber', 'view_network'] - - loader = ['view_graph', 'view_report', 'view_bts', 'view_subscriber', - 'view_network', 'change_subscriber', 'change_network', - 'add_subscriber', 'add_sms', 'add_credit', 'download_graph'] - - partner = ['view_graph', 'view_report', 'view_bts', 'view_subscriber', - 'view_network', 'edit_subscriber', 'edit_network', - 'add_subscriber', 'add_sms', 'download_graph'] - - content_type = ContentType.objects.filter(app_label='endagaweb', - model__in= - permission_set).values_list('id', flat=True) - permission = Permission.objects.filter( - content_type__in=content_type).values_list('id', flat=True) - role_permission = [] - if role == 'Business Analyst': - role_permission = Permission.objects.filter( - codename__in=business_analyst).values_list('id', flat=True) - elif role == 'Loader': - role_permission = Permission.objects.filter( - codename__in=loader).values_list('id', flat=True) - elif role == 'Partner': - role_permission = Permission.objects.filter( - codename__in=partner).values_list('id', flat=True) - else: - for i in permission: - role_permission.append(i) - - return JsonResponse({'permissions': list(role_permission)}) - return HttpResponseBadRequest() - -def validate_password_strength(value): - """Checks that a submitted value should match regex and return - boolean value - """ - - regex = "(?=.*[a-zA-Z])(?=.*\\d)(?=.*[!@#$%&*()_+=|<>?{}\\[\\]~-]).{8}" - pattern = re.compile(regex) - return bool(pattern.match(value)) +def validate_password_strength(password): + """validate password strength and return boolean value.""" + + length_regex = re.compile(r'.{8,}') + length_validate = True if (length_regex.match(password) is not None) else False + alphabet_regex = re.compile(r'(?=.*[a-zA-Z])') + aplhabet_validate = True if (alphabet_regex.match(password) is not None) else False + digit_regex = re.compile(r'(?=.*\d)') + digit_validate = True if (digit_regex.match(password) is not None) else False + special_charcter_validate = True if (re.search(r"[!@#$%&'()*+,-./[\\\]^_`{|}~" + r'"]', password) + is not None) else False + if digit_validate and special_charcter_validate and length_validate \ + and aplhabet_validate == True: + return True + else: + return False From 1df451068d98c8151b6ce5ef0d53cd74c37d8625 Mon Sep 17 00:00:00 2001 From: Aricent Group Date: Mon, 5 Jun 2017 12:49:03 +0530 Subject: [PATCH 3/6] Update test_user_password.py removed spaces. --- cloud/endagaweb/tests/test_user_password.py | 7 ------- 1 file changed, 7 deletions(-) diff --git a/cloud/endagaweb/tests/test_user_password.py b/cloud/endagaweb/tests/test_user_password.py index cd1041e2..4e93b8b3 100644 --- a/cloud/endagaweb/tests/test_user_password.py +++ b/cloud/endagaweb/tests/test_user_password.py @@ -12,18 +12,13 @@ from __future__ import division from __future__ import print_function from __future__ import unicode_literals - from django import test - - from django.test import TestCase - from endagaweb import models class TestBase(TestCase): - @classmethod def setUpClass(cls): cls.username = 'testuser' @@ -33,7 +28,6 @@ def setUpClass(cls): cls.user.save() cls.error_tag = 'password alert alert-danger error' cls.success_tag = 'password alert alert-success success' - # Create a test client. cls.client = test.Client() @@ -68,7 +62,6 @@ def getmessage(cls, response): class UserPasswordStrengthTests(TestBase): """Testing strength of new password.""" - def test_old_password(self): """validate invalid old password.""" self.login() From 1f9e597e4ffae62e4e54c4447c02bc4e7f3a1232 Mon Sep 17 00:00:00 2001 From: piyush-kr Date: Wed, 7 Jun 2017 22:45:31 +0530 Subject: [PATCH 4/6] added custom password_validators and review comments incorporated --- cloud/endagaweb/forms/dashboard_forms.py | 34 ++++++---- cloud/endagaweb/settings/prod.py | 8 +++ .../endagaweb/templates/dashboard/index.html | 6 +- .../templates/dashboard/password_change.html | 1 - cloud/endagaweb/tests/test_user_password.py | 26 ++++---- .../util/Custom_password_validators.py | 24 +++++++ cloud/endagaweb/views/user.py | 66 +++++++++---------- 7 files changed, 104 insertions(+), 61 deletions(-) create mode 100644 cloud/endagaweb/util/Custom_password_validators.py diff --git a/cloud/endagaweb/forms/dashboard_forms.py b/cloud/endagaweb/forms/dashboard_forms.py index 0d09b67f..50749e54 100644 --- a/cloud/endagaweb/forms/dashboard_forms.py +++ b/cloud/endagaweb/forms/dashboard_forms.py @@ -23,6 +23,7 @@ from ccm.common.currency import CURRENCIES from endagaweb import models from endagaweb.templatetags import apptags +from django.contrib.auth import password_validation class UpdateContactForm(forms.Form): @@ -153,18 +154,9 @@ def __init__(self, *args, **kwargs): class ChangePasswordForm(PasswordChangeForm): """Change password form visible on user profile page.""" - """Updated to show password policy text. """ - old_password = forms.CharField(required=True, label='Old Password', - widget=forms.PasswordInput(attrs={ - 'title': 'Enter Old Password'}), - ) - new_password1 = forms.CharField(required=True, label='New Password', - widget=forms.PasswordInput(attrs={ - 'title': 'Password must contain at least 8 characters,contains ' - 'alphanumeric and one special character.'}), ) - new_password2 = forms.CharField(required=True, label='Confirm Password', - widget=forms.PasswordInput(attrs={ - 'title': 'Confirm Password'}), ) + """Updated for password validation. """ + + error_message = '' def __init__(self, *args, **kwargs): super(ChangePasswordForm, self).__init__(*args, **kwargs) @@ -173,8 +165,26 @@ def __init__(self, *args, **kwargs): self.helper.form_method = 'post' self.helper.form_action = '/account/password/change' self.helper.form_class = 'profile-form' + self.error_message = '' self.helper.add_input(Submit('submit', 'Save')) + def clean_password1(self): + old_password = self.cleaned_data.get("old_password") + new_password1 = self.cleaned_data.get("new_password1") + if new_password1 and old_password and old_password == new_password1: + self.error_message = 'Error: new password must not be old password.' + raise forms.ValidationError(self.error_message) + password_validation.validate_password(new_password1) + return new_password1 + + def clean_new_password2(self): + password1 = self.cleaned_data.get('new_password1') + password2 = self.cleaned_data.get('new_password2') + if password1 and password2: + if password1 != password2: + self.error_message = 'Error:conform password does not match.' + raise forms.ValidationError(self.error_message) + return password2 class NotifyEmailsForm(forms.Form): notify_emails = forms.CharField(required=False, label="", diff --git a/cloud/endagaweb/settings/prod.py b/cloud/endagaweb/settings/prod.py index 933357ea..b57134a7 100644 --- a/cloud/endagaweb/settings/prod.py +++ b/cloud/endagaweb/settings/prod.py @@ -321,3 +321,11 @@ # Security middleware settings SECURE_CONTENT_TYPE_NOSNIFF = True + +# Password validation +AUTH_PASSWORD_VALIDATORS = [ + + { 'NAME': 'endagaweb.util.Custom_password_validators.CustomPasswortValidator', + }, + +] \ No newline at end of file diff --git a/cloud/endagaweb/templates/dashboard/index.html b/cloud/endagaweb/templates/dashboard/index.html index 02860334..45fb034b 100644 --- a/cloud/endagaweb/templates/dashboard/index.html +++ b/cloud/endagaweb/templates/dashboard/index.html @@ -25,7 +25,7 @@ - +