-
Notifications
You must be signed in to change notification settings - Fork 0
/
AccountChange_views.py
389 lines (328 loc) · 17.1 KB
/
AccountChange_views.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
from django.conf import settings
from django.contrib import messages
from django.contrib.auth import get_user_model, logout, signals
from django.contrib.auth.views import (
PasswordChangeView, PasswordChangeDoneView,
PasswordResetView, PasswordResetDoneView, PasswordResetConfirmView,
)
from django.contrib.auth.mixins import LoginRequiredMixin
from django.http import Http404
from django.http.response import HttpResponseRedirect
from django.shortcuts import redirect
from django.urls import reverse, reverse_lazy
from django.utils.decorators import method_decorator
from django.views.decorators.csrf import csrf_protect
from django.views.generic import TemplateView, FormView
from common.lib.axes.utils import reset
from common.lib.axes.handlers.database import AxesDatabaseHandler
from common.scripts.DjangoUtils import (
generate_uuid_hex, grecaptcha_request, RequestUtil,
)
from ..forms import (
OverlapPasswordChangeForm, OverlapSocialloginUserPasswordChangeForm, OverlapSetPasswordForm,
OverlapPasswordResetForm, EmailChangeForm, UserDeleteForm,
)
from ..models import ActivateToken
from ..views.send_mail.send_mail import send_token_for_change_email
User = get_user_model()
# パスワードの変更
class OverlapPasswordChangeView(LoginRequiredMixin, PasswordChangeView):
template_name = 'accounts/PasswordChange/password_change.html'
form_class = OverlapPasswordChangeForm
success_url = reverse_lazy("accounts:password_change_done")
# ソーシャルログインユーザかつパスワード未設定のユーザには表示しない
def get(self, request, *args, **kwargs):
if not (request.user.is_social_login and request.user.date_password_change is None):
return super().get(request, *args, **kwargs)
else:
raise Http404('Page not found')
def get_context_data(self, **kwargs):
context = super().get_context_data()
context.update({
'IS_USE_SIDENAV': True,
})
return context
@method_decorator(csrf_protect)
def post(self, request, *args, **kwargs):
user = self.request.user
old_password = self.request.POST['old_password']
# Axes
# 元のパスワードを規定回数間違えたらアカウントロックする
if user:
if not user.check_password(old_password):
signals.user_login_failed.send(
sender = User,
request = request,
credentials = {
'username': user.email,
},
)
if AxesDatabaseHandler.get_failures(
self,
request = request,
credentials = {
'username': user.email,
},
) >= settings.AXES_FAILURE_LIMIT:
logout(request)
else:
reset(username=user.email) # django-axes リセット
return super().post(request, *args, **kwargs)
# パスワード未設定の場合には、元のパスワードの入力を求めない
class OverlapPasswordChangeOneStepView(LoginRequiredMixin, PasswordChangeView):
template_name = 'accounts/PasswordChange/password_change.html'
form_class = OverlapSocialloginUserPasswordChangeForm
success_url = reverse_lazy("accounts:password_change_done")
# パスワード未設定のユーザのみに表示
def get(self, request, *args, **kwargs):
if request.user.date_password_change is None:
return super().get(request, *args, **kwargs)
else:
raise Http404('Page not found')
def get_context_data(self, **kwargs):
context = super().get_context_data()
context.update({
'IS_USE_SIDENAV': True,
})
return context
class OverlapPasswordChangeDoneView(LoginRequiredMixin, PasswordChangeDoneView):
template_name = 'accounts/PasswordChange/password_change_done.html'
success_url = reverse_lazy('accounts:password_reset_done')
# 想定ルート(crrect_ref)から以外のアクセスを遮断
def get(self, request, *args, **kwargs):
siteurl = request._current_scheme_host
crrect_ref_01 = reverse('accounts:password_change')
crrect_ref_02 = reverse('accounts:password_change_one_step')
referer = RequestUtil.get_request_host_url(self)
if not (siteurl+crrect_ref_01 == referer or siteurl+crrect_ref_02 == referer):
reverse_url = reverse_lazy('home')
return HttpResponseRedirect(reverse_url)
return super().get(request, *args, **kwargs)
def get_context_data(self, **kwargs):
context = super().get_context_data()
context.update({
'IS_USE_SIDENAV': True,
})
return context
# パスワードの再設定
# Referrer
# https://stackoverflow.com/questions/56015855/how-to-perform-additional-actions-on-passwordreset-in-django
# https://www.reddit.com/r/django/comments/q1ao3l/here_is_how_you_add_google_recaptcha_to_password/
class OverlapPasswordResetView(PasswordResetView):
form_class = OverlapPasswordResetForm
from_email = settings.DEFAULT_REPLY_EMAIL
subject_template_name = 'accounts/PasswordReset/mail_template/subject.html'
email_template_name = 'accounts/PasswordReset/mail_template/text_message.html'
html_email_template_name = 'accounts/PasswordReset/mail_template/html_message.html'
extra_email_context = {'TOKEN_EXPIRED' : int(settings.PASSWORD_RESET_TIMEOUT / 60)}
success_url = reverse_lazy("accounts:password_reset_done")
# メール認証を使用しない場合にはパスワードリセットは管理者にて行う
if settings.IS_USE_EMAIL_CERTIFICATION:
template_name = 'accounts/PasswordReset/password_reset.html'
else:
template_name = 'accounts/PasswordReset/password_reset_.html'
def get(self, request, *args, **kwargs):
logout(request)
return super().get(request, *args, **kwargs)
def get_context_data(self, **kwargs):
context = super().get_context_data()
context.update({
'RECAPTCHA_PUBLIC_KEY': settings.RECAPTCHA_PUBLIC_KEY if settings.IS_USE_RECAPTCHA else None,
'IS_USE_RECAPTCHA': settings.IS_USE_RECAPTCHA,
})
return context
@method_decorator(csrf_protect)
def post(self, request, *args, **kwargs):
form = self.get_form()
email = form['email'].value()
user_or_none = User.objects.filter(email=email).first()
# reCaptcha_token の検証▽
if settings.IS_USE_RECAPTCHA:
recaptcha_token = self.request.POST.get('g-recaptcha-response')
if recaptcha_token is None or recaptcha_token == '':
messages.add_message(self.request, messages.WARNING,
f'不正なPOSTです - reCaptcha ERROR',)
reverse_url = reverse_lazy('accounts:password_reset')
return HttpResponseRedirect(reverse_url)
else:
res = grecaptcha_request(recaptcha_token)
if res: # reCaptcha SUCCESS
pass
else: # reCaptcha FALSE
messages.add_message(self.request, messages.WARNING,
f'不正なPOSTです - reCaptcha ERROR',)
reverse_url = reverse_lazy('accounts:password_reset')
return HttpResponseRedirect(reverse_url)
# reCaptcha_token の検証△
# ソーシャルログイン の検証▽
try:
is_social_login = user_or_none.is_social_login
except:
# user が null の場合には入力されたメールアドレスのユーザがいないことを
# 他者に伝えないために判定をスルーする(見かけ上は通常処理されたように見えるが、メールは送信されない)
is_social_login = False
if is_social_login and user_or_none.date_password_change is None:
# ソーシャルログインユーザかつパスワード未設定の場合には、ソーシャル側の認証に遷移させる
reverse_url = reverse_lazy('social:begin', kwargs={'backend': 'google-oauth2'})
return HttpResponseRedirect(reverse_url)
# ソーシャルログイン の検証△
return super().post(request, *args, **kwargs)
def get_success_url(self):
return self.success_url
class OverlapPasswordResetDoneView(PasswordResetDoneView):
template_name = 'accounts/PasswordReset/password_reset_done.html'
# 想定ルート(crrect_ref)から以外のアクセスを遮断
def get(self, request, *args, **kwargs):
siteurl = request._current_scheme_host
crrect_ref = reverse('accounts:password_reset')
referer = RequestUtil.get_request_host_url(self)
if not siteurl+crrect_ref == referer:
reverse_url = reverse_lazy('home')
return HttpResponseRedirect(reverse_url)
return super().get(request, *args, **kwargs)
class OverlapPasswordResetConfirmView(PasswordResetConfirmView):
template_name = 'accounts/PasswordReset/password_reset_confilm.html'
form_class = OverlapSetPasswordForm
success_url = reverse_lazy('accounts:login')
def form_valid(self, form):
user = form.save()
reset(username=user.email) # パスワードリセットで django-axes もリセット
messages.add_message(self.request, messages.INFO,
f'パスワードを変更しました。\n\
新しいパスワードで再度ログインしてください。')
return super().form_valid(form)
# メールアドレスの変更
class EmailChangeView(LoginRequiredMixin, FormView):
model = User
template_name = 'accounts/EmailChange/email_change.html'
form_class = EmailChangeForm
def get_object(self):
return self.request.user
def get_context_data(self, **kwargs):
context = super().get_context_data()
context.update({
'RECAPTCHA_PUBLIC_KEY': settings.RECAPTCHA_PUBLIC_KEY if settings.IS_USE_RECAPTCHA else None,
'IS_USE_RECAPTCHA': settings.IS_USE_RECAPTCHA,
'IS_USE_SIDENAV': True,
})
return context
@method_decorator(csrf_protect)
def post(self, request, *args, **kwargs):
# reCaptcha_token の検証▽
if settings.IS_USE_RECAPTCHA:
recaptcha_token = self.request.POST.get('g-recaptcha-response')
if recaptcha_token is None or recaptcha_token == '':
messages.add_message(self.request, messages.WARNING,
f'不正なPOSTです - reCaptcha ERROR',)
reverse_url = reverse_lazy('accounts:email_change')
return HttpResponseRedirect(reverse_url)
else:
res = grecaptcha_request(recaptcha_token)
if res: # reCaptcha SUCCESS
pass
else: # reCaptcha FALSE
messages.add_message(self.request, messages.WARNING,
f'不正なPOSTです - reCaptcha ERROR',)
reverse_url = reverse_lazy('accounts:email_change')
return HttpResponseRedirect(reverse_url)
# reCaptcha_token の検証△
# ソーシャルログイン の検証▽
user = self.request.user
change_email = self.request.POST['change_email']
if user.is_social_login and user.date_password_change is None:
messages.add_message(self.request, messages.WARNING,
f'ソーシャルIDで作成されたユーザーのメールアドレスをするには、先にパスワードを設定してください。',)
reverse_url = reverse_lazy('accounts:password_change_OneStep')
return HttpResponseRedirect(reverse_url)
# ソーシャルログイン の検証△
if User.objects.filter(email=change_email).exists():
# 既に登録済みのアドレスのため、処理を行わずに完了画面へ遷移(登録されているメールアドレスを隠す)
reverse_url = reverse_lazy('accounts:email_change_tmp_recept')
return HttpResponseRedirect(reverse_url)
else: # SUCCESS
return super().post(request, *args, **kwargs)
def form_valid(self, form):
user = self.request.user
change_email = self.request.POST['change_email']
# メール認証を行う場合と行わない場合
if settings.IS_USE_EMAIL_CERTIFICATION:
user.is_change_email_request = True
user.change_email = change_email
user.save()
send_token_for_change_email(user) # 変更要求されたメールアドレスにメールを送信して認証
else:
user.is_change_email_request = False
user.email = change_email # emailを変更
user.change_email = 'dummy@mail.com' # ダミーデータの設定
user.save()
return super().form_valid(form)
def get_success_url(self):
# メール認証する場合としない場合のサインアップ後のページ遷移の分岐
if settings.IS_USE_EMAIL_CERTIFICATION:
success_url = reverse_lazy('accounts:email_change_tmp_recept')
else:
messages.add_message(self.request, messages.INFO,
f'メールアドレスの変更が完了しました',)
success_url = reverse_lazy('accounts:email_change')
return success_url
class EmailChangeTmpReceptView(LoginRequiredMixin, TemplateView):
template_name='accounts/EmailChange/email_change_tmp_recept.html'
# メールアドレスの変更をしていないユーザからのアクセスを遮断
def get(self, request, *args, **kwargs):
user = self.request.user
if not user.is_change_email_request:
reverse_url = reverse_lazy('accounts:email_change')
return HttpResponseRedirect(reverse_url)
return super().get(request, *args, **kwargs)
def get_context_data(self, **kwargs):
context = super().get_context_data()
context.update({
'IS_USE_SIDENAV': True,
})
return context
def ActivateEmailView(request, token):
res, msg = ActivateToken.objects.activate_change_email_by_token(token)
if res:
logout(request)
messages.add_message(request, messages.INFO, msg)
reverse_url = reverse_lazy('accounts:login')
else:
messages.add_message(request, messages.WARNING, msg)
reverse_url = reverse_lazy('home')
return HttpResponseRedirect(reverse_url)
# アカウント削除
class UserDeleteView(LoginRequiredMixin, FormView):
model = User
template_name = 'accounts/AccountDelete/delete.html'
form_class = UserDeleteForm
success_url = reverse_lazy('accounts:login')
def get_object(self):
return self.request.user
def get_context_data(self, **kwargs):
context = super().get_context_data()
context.update({
'IS_USE_SIDENAV': True,
})
return context
@method_decorator(csrf_protect)
def post(self, request, *args, **kwargs):
check_text = self.request.POST['check_text']
if check_text != 'delete':
messages.add_message(self.request, messages.WARNING,
f'チェックテキストエラー',)
reverse_url = reverse_lazy('accounts:delete')
return HttpResponseRedirect(reverse_url)
return super().post(request, *args, **kwargs)
def form_valid(self, form):
# データは残してログイン不可とする
# 削除後に再度その人が登録する場合に備えてメールをダミーに変更
user = self.request.user
user.is_active = False
user.email = generate_uuid_hex()+'@'+generate_uuid_hex()+'.com'
user.save()
messages.add_message(self.request, messages.INFO,
f'アカウントを削除しました。\n\
ご利用いただきましてありがとうございました。',)
return redirect(self.get_success_url())
def get_success_url(self):
return self.success_url