diff --git a/.travis.yml b/.travis.yml index b2527c43..4eca0630 100644 --- a/.travis.yml +++ b/.travis.yml @@ -12,14 +12,14 @@ install: - export PATH=$PATH:$(pwd) - chmod +x chromedriver - pip install -r requirements.txt - - pip install coveralls codeclimate-test-reporter pep8 + - pip install coveralls codeclimate-test-reporter pycodestyle before_script: - export PATH=$PATH:/usr/lib/chromium-browser/ - python manage.py collectstatic --noinput script: - - pep8 . --exclude=migrations,importer* + - pycodestyle . --exclude=migrations,importer* - python manage.py check - python manage.py makemigrations --check --dry-run - coverage run manage.py test --verbosity=2 diff --git a/PyRIGS/settings.py b/PyRIGS/settings.py index 5877ad74..6d2fbbd6 100644 --- a/PyRIGS/settings.py +++ b/PyRIGS/settings.py @@ -12,6 +12,7 @@ https://docs.djangoproject.com/en/1.7/ref/settings/ import os import raven import secrets +import datetime BASE_DIR = os.path.dirname(os.path.dirname(__file__)) @@ -44,12 +45,11 @@ if not DEBUG: INTERNAL_IPS = ['127.0.0.1'] -ADMINS = ( - ('Tom Price', 'tomtom5152@gmail.com') -) +ADMINS = [('Tom Price', 'tomtom5152@gmail.com'), ('IT Manager', 'it@nottinghamtec.co.uk'), ('Arona Jones', 'arona.jones@nottinghamtec.co.uk')] +if DEBUG: + ADMINS.append(('Testing Superuser', 'superuser@example.com')) # Application definition - INSTALLED_APPS = ( 'django.contrib.admin', 'django.contrib.auth', @@ -168,6 +168,8 @@ RECAPTCHA_PUBLIC_KEY = os.environ.get('RECAPTCHA_PUBLIC_KEY', "6LeIxAcTAAAAAJcZV RECAPTCHA_PRIVATE_KEY = os.environ.get('RECAPTCHA_PRIVATE_KEY', "6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe") # If not set, use development key NOCAPTCHA = True +SILENCED_SYSTEM_CHECKS = ['captcha.recaptcha_test_key_error'] + # Email EMAILER_TEST = False if not DEBUG or EMAILER_TEST: @@ -182,6 +184,8 @@ if not DEBUG or EMAILER_TEST: else: EMAIL_BACKEND = 'django.core.mail.backends.console.EmailBackend' +EMAIL_COOLDOWN = datetime.timedelta(minutes=15) + # Internationalization # https://docs.djangoproject.com/en/1.7/topics/i18n/ diff --git a/PyRIGS/tests/base.py b/PyRIGS/tests/base.py index ecdacd21..4beb1eeb 100644 --- a/PyRIGS/tests/base.py +++ b/PyRIGS/tests/base.py @@ -11,7 +11,7 @@ def create_browser(): if os.environ.get('CI', False): options.add_argument("--headless") options.add_argument("--no-sandbox") - driver = webdriver.Chrome(chrome_options=options) + driver = webdriver.Chrome(options=options) return driver diff --git a/PyRIGS/urls.py b/PyRIGS/urls.py index cb78130c..9ef4fa53 100644 --- a/PyRIGS/urls.py +++ b/PyRIGS/urls.py @@ -1,3 +1,4 @@ +from django.urls import path from django.conf.urls import include, url from django.contrib import admin from django.contrib.staticfiles.urls import staticfiles_urlpatterns @@ -15,8 +16,8 @@ urlpatterns = [ url('^assets/', include('assets.urls')), url('^user/register/$', RegistrationView.as_view(form_class=RIGS.forms.ProfileRegistrationFormUniqueEmail), name="registration_register"), - url('^user/', include('django.contrib.auth.urls')), - url('^user/', include('registration.backends.default.urls')), + path('user/', include('django.contrib.auth.urls')), + path('user/', include('registration.backends.default.urls')), url(r'^admin/', admin.site.urls), ] diff --git a/RIGS/admin.py b/RIGS/admin.py index 49b8aa1e..65442968 100644 --- a/RIGS/admin.py +++ b/RIGS/admin.py @@ -1,7 +1,7 @@ from django.contrib import admin from RIGS import models, forms from django.contrib.auth.admin import UserAdmin -from django.utils.translation import ugettext_lazy as _ +from django.utils.translation import gettext_lazy as _ from reversion.admin import VersionAdmin from django.contrib.admin import helpers @@ -22,13 +22,22 @@ admin.site.register(models.Invoice) admin.site.register(models.Payment) +def approve_user(modeladmin, request, queryset): + queryset.update(is_approved=True) + + +approve_user.short_description = "Approve selected users" + + @admin.register(models.Profile) class ProfileAdmin(UserAdmin): + # Don't know how to add 'is_approved' whilst preserving the default list... + list_filter = ('is_approved', 'is_active', 'is_staff', 'is_superuser', 'groups') fieldsets = ( (None, {'fields': ('username', 'password')}), (_('Personal info'), { 'fields': ('first_name', 'last_name', 'email', 'initials', 'phone')}), - (_('Permissions'), {'fields': ('is_active', 'is_staff', 'is_superuser', + (_('Permissions'), {'fields': ('is_approved', 'is_active', 'is_staff', 'is_superuser', 'groups', 'user_permissions')}), (_('Important dates'), { 'fields': ('last_login', 'date_joined')}), @@ -41,6 +50,7 @@ class ProfileAdmin(UserAdmin): ) form = forms.ProfileChangeForm add_form = forms.ProfileCreationForm + actions = [approve_user] class AssociateAdmin(VersionAdmin): diff --git a/RIGS/finance.py b/RIGS/finance.py index b64b2e71..061c81a8 100644 --- a/RIGS/finance.py +++ b/RIGS/finance.py @@ -11,6 +11,7 @@ from django.template.loader import get_template from django.views import generic from django.db.models import Q from z3c.rml import rml2pdf +from django.db.models import Q from RIGS import models @@ -76,7 +77,7 @@ class InvoicePrint(generic.View): pdfData = buffer.read() - escapedEventName = re.sub('[^a-zA-Z0-9 \n\.]', '', object.name) + escapedEventName = re.sub(r'[^a-zA-Z0-9 \n\.]', '', object.name) response = HttpResponse(content_type='application/pdf') response['Content-Disposition'] = "filename=Invoice %05d - N%05d | %s.pdf" % (invoice.pk, invoice.event.pk, escapedEventName) @@ -122,6 +123,34 @@ class InvoiceArchive(generic.ListView): template_name = 'RIGS/invoice_list_archive.html' paginate_by = 25 + def get_queryset(self): + q = self.request.GET.get('q', "") + + filter = Q(event__name__icontains=q) + + # try and parse an int + try: + val = int(q) + filter = filter | Q(pk=val) + filter = filter | Q(event__pk=val) + except: # noqa + # not an integer + pass + + try: + if q[0] == "N": + val = int(q[1:]) + filter = Q(event__pk=val) # If string is Nxxxxx then filter by event number + elif q[0] == "#": + val = int(q[1:]) + filter = Q(pk=val) # If string is #xxxxx then filter by invoice number + except: # noqa + pass + + object_list = self.model.objects.filter(filter).order_by('-invoice_date') + + return object_list + class InvoiceWaiting(generic.ListView): model = models.Event diff --git a/RIGS/forms.py b/RIGS/forms.py index 47b0f062..a006bc87 100644 --- a/RIGS/forms.py +++ b/RIGS/forms.py @@ -2,8 +2,10 @@ from django import forms from django.utils import formats from django.conf import settings from django.core import serializers +from django.core.mail import EmailMessage, EmailMultiAlternatives from django.contrib.auth.forms import UserCreationForm, UserChangeForm, AuthenticationForm, PasswordResetForm from registration.forms import RegistrationFormUniqueEmail +from django.contrib.auth.forms import AuthenticationForm from captcha.fields import ReCaptchaField import simplejson @@ -33,8 +35,16 @@ class ProfileRegistrationFormUniqueEmail(RegistrationFormUniqueEmail): return self.cleaned_data['initials'] +class CheckApprovedForm(AuthenticationForm): + def confirm_login_allowed(self, user): + if user.is_approved or user.is_superuser: + return AuthenticationForm.confirm_login_allowed(self, user) + else: + raise forms.ValidationError("Your account hasn't been approved by an administrator yet. Please check back in a few minutes!") + + # Embedded Login form - remove the autofocus -class EmbeddedAuthenticationForm(AuthenticationForm): +class EmbeddedAuthenticationForm(CheckApprovedForm): def __init__(self, *args, **kwargs): super().__init__(*args, **kwargs) self.fields['username'].widget.attrs.pop('autofocus', None) diff --git a/RIGS/migrations/0036_profile_is_approved.py b/RIGS/migrations/0036_profile_is_approved.py new file mode 100644 index 00000000..3fdb5af7 --- /dev/null +++ b/RIGS/migrations/0036_profile_is_approved.py @@ -0,0 +1,23 @@ +# Generated by Django 2.0.13 on 2020-01-10 14:52 + +from django.db import migrations, models + + +class Migration(migrations.Migration): + + dependencies = [ + ('RIGS', '0035_auto_20191124_1319'), + ] + + operations = [ + migrations.AddField( + model_name='profile', + name='is_approved', + field=models.BooleanField(default=False), + ), + migrations.AddField( + model_name='profile', + name='last_emailed', + field=models.DateTimeField(blank=True, null=True), + ), + ] diff --git a/RIGS/migrations/0037_approve_legacy.py b/RIGS/migrations/0037_approve_legacy.py new file mode 100644 index 00000000..72348b3f --- /dev/null +++ b/RIGS/migrations/0037_approve_legacy.py @@ -0,0 +1,19 @@ +# Generated by Django 2.0.13 on 2020-01-11 18:29 +# This migration ensures that legacy Profiles from before approvals were implemented are automatically approved +from django.db import migrations + +def approve_legacy(apps, schema_editor): + Profile = apps.get_model('RIGS', 'Profile') + for person in Profile.objects.all(): + person.is_approved = True + person.save() + +class Migration(migrations.Migration): + + dependencies = [ + ('RIGS', '0036_profile_is_approved'), + ] + + operations = [ + migrations.RunPython(approve_legacy) + ] diff --git a/RIGS/migrations/0038_auto_20200306_2000.py b/RIGS/migrations/0038_auto_20200306_2000.py new file mode 100644 index 00000000..f1f893e0 --- /dev/null +++ b/RIGS/migrations/0038_auto_20200306_2000.py @@ -0,0 +1,37 @@ +# Generated by Django 2.0.13 on 2020-03-06 20:00 + +from django.db import migrations + + +class Migration(migrations.Migration): + + dependencies = [ + ('RIGS', '0037_approve_legacy'), + ] + + operations = [ + migrations.AlterModelOptions( + name='event', + options={}, + ), + migrations.AlterModelOptions( + name='invoice', + options={'ordering': ['-invoice_date']}, + ), + migrations.AlterModelOptions( + name='organisation', + options={}, + ), + migrations.AlterModelOptions( + name='person', + options={}, + ), + migrations.AlterModelOptions( + name='profile', + options={'verbose_name': 'user', 'verbose_name_plural': 'users'}, + ), + migrations.AlterModelOptions( + name='venue', + options={}, + ), + ] diff --git a/RIGS/models.py b/RIGS/models.py index 937d5354..2b22da05 100644 --- a/RIGS/models.py +++ b/RIGS/models.py @@ -8,7 +8,6 @@ from django.contrib.auth.models import AbstractUser from django.conf import settings from django.utils import timezone from django.utils.functional import cached_property -from django.utils.encoding import python_2_unicode_compatible from reversion import revisions as reversion from reversion.models import Version import string @@ -22,11 +21,12 @@ from django.urls import reverse_lazy # Create your models here. -@python_2_unicode_compatible class Profile(AbstractUser): initials = models.CharField(max_length=5, unique=True, null=True, blank=False) phone = models.CharField(max_length=13, null=True, blank=True) api_key = models.CharField(max_length=40, blank=True, editable=False, null=True) + is_approved = models.BooleanField(default=False) + last_emailed = models.DateTimeField(blank=True, null=True) # Currently only populated by the admin approval email. TODO: Populate it each time we send any email, might need that... @classmethod def make_api_key(cls): @@ -53,14 +53,17 @@ class Profile(AbstractUser): def latest_events(self): return self.event_mic.order_by('-start_date').select_related('person', 'organisation', 'venue', 'mic') + @classmethod + def admins(cls): + return Profile.objects.filter(email__in=[y for x in settings.ADMINS for y in x]) + + @classmethod + def users_awaiting_approval_count(cls): + return Profile.objects.filter(models.Q(is_approved=False)).count() + def __str__(self): return self.name - class Meta: - permissions = ( - ('view_profile', 'Can view Profile'), - ) - class RevisionMixin(object): @property @@ -91,7 +94,6 @@ class RevisionMixin(object): @reversion.register -@python_2_unicode_compatible class Person(models.Model, RevisionMixin): name = models.CharField(max_length=50) phone = models.CharField(max_length=15, blank=True, null=True) @@ -127,14 +129,8 @@ class Person(models.Model, RevisionMixin): def get_absolute_url(self): return reverse_lazy('person_detail', kwargs={'pk': self.pk}) - class Meta: - permissions = ( - ('view_person', 'Can view Persons'), - ) - @reversion.register -@python_2_unicode_compatible class Organisation(models.Model, RevisionMixin): name = models.CharField(max_length=50) phone = models.CharField(max_length=15, blank=True, null=True) @@ -171,11 +167,6 @@ class Organisation(models.Model, RevisionMixin): def get_absolute_url(self): return reverse_lazy('organisation_detail', kwargs={'pk': self.pk}) - class Meta: - permissions = ( - ('view_organisation', 'Can view Organisations'), - ) - class VatManager(models.Manager): def current_rate(self): @@ -192,7 +183,6 @@ class VatManager(models.Manager): @reversion.register -@python_2_unicode_compatible class VatRate(models.Model, RevisionMixin): start_at = models.DateField() rate = models.DecimalField(max_digits=6, decimal_places=6) @@ -213,7 +203,6 @@ class VatRate(models.Model, RevisionMixin): @reversion.register -@python_2_unicode_compatible class Venue(models.Model, RevisionMixin): name = models.CharField(max_length=255) phone = models.CharField(max_length=15, blank=True, null=True) @@ -236,11 +225,6 @@ class Venue(models.Model, RevisionMixin): def get_absolute_url(self): return reverse_lazy('venue_detail', kwargs={'pk': self.pk}) - class Meta: - permissions = ( - ('view_venue', 'Can view Venues'), - ) - class EventManager(models.Manager): def current_events(self): @@ -287,7 +271,6 @@ class EventManager(models.Manager): @reversion.register(follow=['items']) -@python_2_unicode_compatible class Event(models.Model, RevisionMixin): # Done to make it much nicer on the database PROVISIONAL = 0 @@ -481,11 +464,6 @@ class Event(models.Model, RevisionMixin): self.full_clean() super(Event, self).save(*args, **kwargs) - class Meta: - permissions = ( - ('view_event', 'Can view Events'), - ) - class EventItem(models.Model): event = models.ForeignKey('Event', related_name='items', blank=True, on_delete=models.CASCADE) @@ -523,7 +501,7 @@ class EventAuthorisation(models.Model, RevisionMixin): uni_id = models.CharField(max_length=10, blank=True, null=True, verbose_name="University ID") account_code = models.CharField(max_length=50, blank=True, null=True) amount = models.DecimalField(max_digits=10, decimal_places=2, verbose_name="authorisation amount") - sent_by = models.ForeignKey('RIGS.Profile', on_delete=models.CASCADE) + sent_by = models.ForeignKey('Profile', on_delete=models.CASCADE) def get_absolute_url(self): return reverse_lazy('event_detail', kwargs={'pk': self.event.pk}) @@ -533,7 +511,6 @@ class EventAuthorisation(models.Model, RevisionMixin): return str("N%05d" % self.event.pk + ' (requested by ' + self.sent_by.initials + ')') -@python_2_unicode_compatible class Invoice(models.Model): event = models.OneToOneField('Event', on_delete=models.CASCADE) invoice_date = models.DateField(auto_now_add=True) @@ -566,13 +543,9 @@ class Invoice(models.Model): return "%i: %s (%.2f)" % (self.pk, self.event, self.balance) class Meta: - permissions = ( - ('view_invoice', 'Can view Invoices'), - ) ordering = ['-invoice_date'] -@python_2_unicode_compatible class Payment(models.Model): CASH = 'C' INTERNAL = 'I' diff --git a/RIGS/rigboard.py b/RIGS/rigboard.py index abb0ed9e..6aeff551 100644 --- a/RIGS/rigboard.py +++ b/RIGS/rigboard.py @@ -110,7 +110,7 @@ class EventCreate(generic.CreateView): context['currentVAT'] = models.VatRate.objects.current_rate() form = context['form'] - if re.search('"-\d+"', form['items_json'].value()): + if re.search(r'"-\d+"', form['items_json'].value()): messages.info(self.request, "Your item changes have been saved. Please fix the errors and save the event.") # Get some other objects to include in the form. Used when there are errors but also nice and quick. @@ -206,7 +206,6 @@ class EventPrint(generic.View): } rml = template.render(context) - buffer = rml2pdf.parseString(rml) merger.append(PdfFileReader(buffer)) buffer.close() @@ -219,17 +218,25 @@ class EventPrint(generic.View): response = HttpResponse(content_type='application/pdf') - escapedEventName = re.sub('[^a-zA-Z0-9 \n\.]', '', object.name) + escapedEventName = re.sub(r'[^a-zA-Z0-9 \n\.]', '', object.name) response['Content-Disposition'] = "filename=N%05d | %s.pdf" % (object.pk, escapedEventName) response.write(merged.getvalue()) return response -class EventArchive(generic.ArchiveIndexView): +class EventArchive(generic.ListView): model = models.Event - date_field = "start_date" paginate_by = 25 + template_name = "RIGS/event_archive.html" + + def get_context_data(self, **kwargs): + # get super context + context = super(EventArchive, self).get_context_data(**kwargs) + + context['start'] = self.request.GET.get('start', None) + context['end'] = self.request.GET.get('end', datetime.date.today().strftime('%Y-%m-%d')) + return context def get_queryset(self): start = self.request.GET.get('start', None) @@ -241,19 +248,34 @@ class EventArchive(generic.ArchiveIndexView): "Muppet! Check the dates, it has been fixed for you.") start, end = end, start # Stop the impending fail - filter = False + filter = Q() if end != "": - filter = Q(start_date__lte=end) + filter &= Q(start_date__lte=end) if start: - if filter: - filter = filter & Q(start_date__gte=start) - else: - filter = Q(start_date__gte=start) + filter &= Q(start_date__gte=start) - if filter: - qs = self.model.objects.filter(filter).order_by('-start_date') - else: - qs = self.model.objects.all().order_by('-start_date') + q = self.request.GET.get('q', "") + + if q is not "": + qfilter = Q(name__icontains=q) | Q(description__icontains=q) | Q(notes__icontains=q) + + # try and parse an int + try: + val = int(q) + qfilter = qfilter | Q(pk=val) + except: # noqa not an integer + pass + + try: + if q[0] == "N": + val = int(q[1:]) + qfilter = Q(pk=val) # If string is N###### then do a simple PK filter + except: # noqa + pass + + filter &= qfilter + + qs = self.model.objects.filter(filter).order_by('-start_date') # Preselect related for efficiency qs.select_related('person', 'organisation', 'venue', 'mic') diff --git a/RIGS/signals.py b/RIGS/signals.py index ea0395d7..e1772e07 100644 --- a/RIGS/signals.py +++ b/RIGS/signals.py @@ -1,3 +1,4 @@ +import datetime import re import urllib.request import urllib.error @@ -10,6 +11,9 @@ from django.conf import settings from django.contrib.staticfiles.storage import staticfiles_storage from django.core.mail import EmailMessage, EmailMultiAlternatives from django.template.loader import get_template +from django.urls import reverse +from django.utils import timezone +from registration.signals import user_activated from premailer import Premailer from z3c.rml import rml2pdf @@ -69,7 +73,7 @@ def send_eventauthorisation_success_email(instance): external_styles=css).transform() client_email.attach_alternative(html, 'text/html') - escapedEventName = re.sub('[^a-zA-Z0-9 \n\.]', '', instance.event.name) + escapedEventName = re.sub(r'[^a-zA-Z0-9 \n\.]', '', instance.event.name) client_email.attach('N%05d - %s - CONFIRMATION.pdf' % (instance.event.pk, escapedEventName), merged.getvalue(), @@ -102,3 +106,35 @@ def on_revision_commit(sender, instance, created, **kwargs): post_save.connect(on_revision_commit, sender=models.EventAuthorisation) + + +def send_admin_awaiting_approval_email(user, request, **kwargs): + # Bit more controlled than just emailing all superusers + for admin in models.Profile.admins(): + # Check we've ever emailed them before and if so, if cooldown has passed. + if admin.last_emailed is None or admin.last_emailed + settings.EMAIL_COOLDOWN <= timezone.now(): + context = { + 'request': request, + 'link_suffix': reverse("admin:RIGS_profile_changelist") + '?is_approved__exact=0', + 'number_of_users': models.Profile.users_awaiting_approval_count(), + 'to_name': admin.first_name + } + + email = EmailMultiAlternatives( + "%s new users awaiting approval on RIGS" % (context['number_of_users']), + get_template("RIGS/admin_awaiting_approval.txt").render(context), + to=[admin.email], + reply_to=[user.email], + ) + css = staticfiles_storage.path('css/email.css') + html = Premailer(get_template("RIGS/admin_awaiting_approval.html").render(context), + external_styles=css).transform() + email.attach_alternative(html, 'text/html') + email.send() + + # Update last sent + admin.last_emailed = timezone.now() + admin.save() + + +user_activated.connect(send_admin_awaiting_approval_email) diff --git a/RIGS/templates/RIGS/admin_awaiting_approval.html b/RIGS/templates/RIGS/admin_awaiting_approval.html new file mode 100644 index 00000000..8db5433c --- /dev/null +++ b/RIGS/templates/RIGS/admin_awaiting_approval.html @@ -0,0 +1,9 @@ +{% extends 'base_client_email.html' %} + +{% block content %} +

Hi {{ to_name|default_if_none:"Administrator" }},

+ +

{{ number_of_users|default_if_none:"Some" }} new users are awaiting administrator approval on RIGS. Click here to approve them.

+ +

TEC PA & Lighting

+{% endblock %} diff --git a/RIGS/templates/RIGS/admin_awaiting_approval.txt b/RIGS/templates/RIGS/admin_awaiting_approval.txt new file mode 100644 index 00000000..e89785ee --- /dev/null +++ b/RIGS/templates/RIGS/admin_awaiting_approval.txt @@ -0,0 +1,5 @@ +Hi {{ to_name|default_if_none:"Administrator" }}, + +{{ number_of_users|default_if_none:"Some" }} new users are awaiting administrator approval on RIGS. Use this link to approve them: {{ request.scheme }}://{{ request.get_host }}/{{ link_suffix }} + +TEC PA & Lighting diff --git a/RIGS/templates/RIGS/event_archive.html b/RIGS/templates/RIGS/event_archive.html index 4fc5642e..18459073 100644 --- a/RIGS/templates/RIGS/event_archive.html +++ b/RIGS/templates/RIGS/event_archive.html @@ -5,34 +5,49 @@ {% block content %}
-

Event Archive

- -