view website/issues/extensions/timestamp.py @ 5093:9954a358da18

- allow user to recover account password using an entry in the Alternate E-mail addresses list. See: http://psf.upfronthosting.co.za/roundup/meta/issue564 for description. Merge request at: https://sourceforge.net/p/roundup/code/merge-requests/1/ Patch supplied by kinggreedy. Applied/tested by John Rouillard It makes this work: Click "Lost your login?" link Enter an alternate address in the email address block. Submit. Get an email sent to alternate address with a one time reset url. Go to that url. Before patch, email with new password was sent to the address "E-mail address" for the user and not to the alternate address. After the patch, the email with new password is sent to the "validated" (against the alternate address list) alternate address supplied by the user.
author John Rouillard <rouilj@ieee.org>
date Mon, 20 Jun 2016 22:04:32 -0400
parents c2d0d3e9099d
children 35ea9b1efc14
line wrap: on
line source

import time, struct, base64
from roundup.cgi.actions import RegisterAction
from roundup.cgi.exceptions import *

def timestamp():
    return base64.encodestring(struct.pack("i", time.time())).strip()

def unpack_timestamp(s):
    return struct.unpack("i",base64.decodestring(s))[0]

class Timestamped:
    def check(self):
        try:
            created = unpack_timestamp(self.form['opaque'].value)
        except KeyError:
            raise FormError, "somebody tampered with the form"
        if time.time() - created < 4:
            raise FormError, "responding to the form too quickly"
        return True

class TimestampedRegister(Timestamped, RegisterAction):
    def permission(self):
        self.check()
        RegisterAction.permission(self)

def init(instance):
    instance.registerUtil('timestamp', timestamp)
    instance.registerAction('register', TimestampedRegister)

Roundup Issue Tracker: http://roundup-tracker.org/