import datetime import email.message import logging import os import smtplib import psycopg import psycopg.rows from flask import ( Flask, session, redirect, url_for, request, render_template, g, abort ) import config logging.basicConfig(format="%(asctime)s %(levelname)s %(name)s %(lineno)d | %(message)s", level=logging.DEBUG) app = Flask(__name__) app.secret_key = config.secret_key app.config["PERMANENT_SESSION_LIFETIME"] = datetime.timedelta(days=92) log = logging.getLogger(__name__) @app.route("/") def home(): log.debug("in home") log.debug("session = %s", session) if "user" not in session: return redirect(url_for('register')) return render_template("home.html") @app.route("/register", methods=["GET", "POST"]) def register(): log.debug("in register") if request.method == "GET": return render_template("register.html") email_address = request.form.get("email", "") if "@" not in email_address: flash("Das schaut nicht wie eine E-Mail-Adresse aus") csr = get_cursor() csr.execute("select * from bod where email = %s", (email_address,)) r = csr.fetchone() if r: if r.key: key = r.key else: key = os.urandom(8).hex() csr.execute( "update bod set key = %s, keychange = now() where email = %s", (key, email_address,)) else: key = os.urandom(8).hex() csr.execute( "insert into bod(email, key, keychange) values(%s, %s, now())", (email_address, key,)) confirmation_url = url_for("confirm", target=request.form["target"], key=key) send_mail(email_address, confirmation_url) return render_template("wait_for_confirmation.html") @app.route("/confirm") def confirm(): csr = get_cursor() csr.execute("select * from bod where key = %s", (request.args["key"],)) bod = csr.fetchone() if not bod: return render_template("wrong_key.html") session["user"] = { "id": bod.id, "email": bod.email} return redirect(request.args["target"]) @app.route("/vote/") def vote(key): log.debug("session = %s", session) csr = get_cursor() csr.execute("select * from meet where key = %s", (key,)) meet = csr.fetchone() if not meet: abort(404) csr.execute( """ select d.id, d.date, d.display, position from date d left join date_vote v on d.id = v.date and v.bod = %s where meet = %s order by position, d.date """, (session["user"]["id"], meet.id,)) dates = csr.fetchall() csr.execute( """ select d.id, d.time, d.display, position from time d left join time_vote v on d.id = v.time and v.bod = %s where meet = %s order by position, d.time """, (session["user"]["id"], meet.id,)) times = csr.fetchall() csr.execute( """ select d.id, d.name, position from place d left join place_vote v on d.id = v.place and v.bod = %s where meet = %s order by position, d.name """, (session["user"]["id"], meet.id,)) places = csr.fetchall() return render_template("vote.html", meet=meet, dates=dates, times=times, places=places) @app.post("/vote/date") def vote_date(): log.debug("form = %s", request.form) date_ids = request.form.getlist("date") csr = get_cursor() # Retrieve the meet.id from the date ids. This also ensures that all the # dates refer to the same meet. csr.execute("select distinct meet from date where id = any (%s)", (date_ids,)) r = csr.fetchall() if len(r) != 1: # this should never happen. Is the client messing around? log.warning("Date ids %s map to meets %s", date_ids, r) abort(400) meet_id = r[0].meet csr.execute("delete from date_vote where date = any (%s)", (date_ids,)) for pos, date_id in enumerate(date_ids): csr.execute( "insert into date_vote(date, bod, position) values(%s, %s, %s)", (date_id, session["user"]["id"], pos) ) # XXX - (almost) duplicate csr.execute( """ select d.id, d.date, d.display, position from date d left join date_vote v on d.id = v.date and v.bod = %s where meet = %s order by position, d.date """, (session["user"]["id"], meet_id,)) dates = csr.fetchall() return render_template("date_vote_fragment.html", dates=dates) @app.post("/vote/time") def vote_time(): log.debug("form = %s", request.form) time_ids = request.form.getlist("time") csr = get_cursor() # Retrieve the meet.id from the time ids. This also ensures that all the # times refer to the same meet. csr.execute("select distinct meet from time where id = any (%s)", (time_ids,)) r = csr.fetchall() if len(r) != 1: # this should never happen. Is the client messing around? log.warning("Time ids %s map to meets %s", time_ids, r) abort(400) meet_id = r[0].meet csr.execute("delete from time_vote where time = any (%s)", (time_ids,)) for pos, time_id in enumerate(time_ids): csr.execute( "insert into time_vote(time, bod, position) values(%s, %s, %s)", (time_id, session["user"]["id"], pos) ) # XXX - (almost) duplicate csr.execute( """ select d.id, d.time, d.display, position from time d left join time_vote v on d.id = v.time and v.bod = %s where meet = %s order by position, d.time """, (session["user"]["id"], meet_id,)) times = csr.fetchall() return render_template("time_vote_fragment.html", times=times) @app.post("/vote/place") def vote_place(): log.debug("form = %s", request.form) place_ids = request.form.getlist("place") csr = get_cursor() # Retrieve the meet.id from the place ids. This also ensures that all the # places refer to the same meet. csr.execute("select distinct meet from place where id = any (%s)", (place_ids,)) r = csr.fetchall() if len(r) != 1: # this should never happen. Is the client messing around? log.warning("Place ids %s map to meets %s", place_ids, r) abort(400) meet_id = r[0].meet csr.execute("delete from place_vote where place = any (%s)", (place_ids,)) for pos, place_id in enumerate(place_ids): csr.execute( "insert into place_vote(place, bod, position) values(%s, %s, %s)", (place_id, session["user"]["id"], pos) ) # XXX - (almost) duplicate csr.execute( """ select d.id, d.name, position from place d left join place_vote v on d.id = v.place and v.bod = %s where meet = %s order by position, d.name """, (session["user"]["id"], meet_id,)) places = csr.fetchall() return render_template("place_vote_fragment.html", places=places) def send_mail(email_address, confirmation_url): msg = email.message.EmailMessage() msg["From"] ="noreply@hjp.at" msg["To"] = email_address msg["Subject"] = "MEEAT confirmation" body = confirmation_url # Really minimalistic msg.set_content(body) mta = smtplib.SMTP(host="localhost") mta.send_message(msg) def get_cursor(): db = get_db() csr = db.cursor(row_factory=psycopg.rows.namedtuple_row) return csr def get_db(): if "db" not in g: g.db = psycopg.connect(dbname=config.dbname) return g.db @app.teardown_appcontext def teardown_db(exception): log.debug("in teardown_db: exception = %s", exception) db = g.pop('db', None) if db is not None: if not exception: try: db.commit() except: pass db.rollback() db.close()