diff --git a/cms/templates/widgets/metadata-edit.html b/cms/templates/widgets/metadata-edit.html
index ac904262c3..74c5ac968e 100644
--- a/cms/templates/widgets/metadata-edit.html
+++ b/cms/templates/widgets/metadata-edit.html
@@ -5,7 +5,7 @@
import hashlib
import copy
import json
- hlskey = hashlib.md5(module.location.url()).hexdigest()
+ hlskey = hashlib.md5(module.location.url().encode('utf-8')).hexdigest()
%>
## js templates
diff --git a/cms/templates/widgets/source-edit.html b/cms/templates/widgets/source-edit.html
index fbd7e3f0bc..6681fcd997 100644
--- a/cms/templates/widgets/source-edit.html
+++ b/cms/templates/widgets/source-edit.html
@@ -123,7 +123,16 @@ require(["jquery", "jquery.leanModal", "codemirror/stex"], function($) {
if (xml.length == 0) {
alert('Conversion failed! error:' + data.message);
} else {
- el.closest('.component').find('.CodeMirror-wrap')[0].CodeMirror.setValue(xml);
+ // If a parent CodeMirror editor is open (LaTeX problem being edited), set the text
+ // there. Otherwise, set the text in the active TinyMCE Editor for the case
+ // of an HTML component being edited.
+ var parentCodemirrorEditor = el.closest('.component').find('.CodeMirror-wrap');
+ if (parentCodemirrorEditor.length > 0) {
+ parentCodemirrorEditor[0].CodeMirror.setValue(xml);
+ }
+ else if (window.tinyMCE !== undefined && window.tinyMCE.activeEditor !== undefined) {
+ window.tinyMCE.activeEditor.setContent(xml);
+ }
save_hls(el);
}
},
diff --git a/common/djangoapps/dark_lang/middleware.py b/common/djangoapps/dark_lang/middleware.py
index 3629d44b3f..26ff0f5d49 100644
--- a/common/djangoapps/dark_lang/middleware.py
+++ b/common/djangoapps/dark_lang/middleware.py
@@ -16,6 +16,42 @@ from django.utils.translation.trans_real import parse_accept_lang_header
from dark_lang.models import DarkLangConfig
+def dark_parse_accept_lang_header(accept):
+ '''
+ The use of 'zh-cn' for 'Simplified Chinese' and 'zh-tw' for 'Traditional Chinese'
+ are now deprecated, as discussed here: https://code.djangoproject.com/ticket/18419.
+ The new language codes 'zh-hans' and 'zh-hant' are now used since django 1.7.
+ Although majority of browsers still use the old language codes, some new browsers
+ such as IE11 in Windows 8.1 start to use the new ones, which makes the current
+ chinese translations of edX don't work properly under these browsers.
+ This function can keep compatibility between the old and new language codes. If one
+ day edX uses django 1.7 or higher, this function can be modified to support the old
+ language codes until there are no browsers use them.
+ '''
+ browser_langs = parse_accept_lang_header(accept)
+ django_langs = []
+ for lang, priority in browser_langs:
+ lang = CHINESE_LANGUAGE_CODE_MAP.get(lang.lower(), lang)
+ django_langs.append((lang, priority))
+ return django_langs
+
+# If django 1.7 or higher is used, the right-side can be updated with new-style codes.
+CHINESE_LANGUAGE_CODE_MAP = {
+ # The following are the new-style language codes for chinese language
+ 'zh-hans': 'zh-CN', # Chinese (Simplified),
+ 'zh-hans-cn': 'zh-CN', # Chinese (Simplified, China)
+ 'zh-hans-sg': 'zh-CN', # Chinese (Simplified, Singapore)
+ 'zh-hant': 'zh-TW', # Chinese (Traditional)
+ 'zh-hant-hk': 'zh-TW', # Chinese (Traditional, Hongkong)
+ 'zh-hant-mo': 'zh-TW', # Chinese (Traditional, Macau)
+ 'zh-hant-tw': 'zh-TW', # Chinese (Traditional, Taiwan)
+ # The following are the old-style language codes that django does not recognize
+ 'zh-hk': 'zh-TW', # Chinese (Traditional, Hongkong)
+ 'zh-mo': 'zh-TW', # Chinese (Traditional, Macau)
+ 'zh-sg': 'zh-CN', # Chinese (Simplified, Singapore)
+}
+
+
class DarkLangMiddleware(object):
"""
Middleware for dark-launching languages.
@@ -65,7 +101,7 @@ class DarkLangMiddleware(object):
new_accept = ", ".join(
self._format_accept_value(lang, priority)
for lang, priority
- in parse_accept_lang_header(accept)
+ in dark_parse_accept_lang_header(accept)
if self._is_released(lang)
)
diff --git a/common/djangoapps/dark_lang/tests.py b/common/djangoapps/dark_lang/tests.py
index 9896851984..d38a95e509 100644
--- a/common/djangoapps/dark_lang/tests.py
+++ b/common/djangoapps/dark_lang/tests.py
@@ -208,3 +208,15 @@ class DarkLangMiddlewareTests(TestCase):
'rel',
self.process_request(preview_lang='unrel', django_language='rel')
)
+
+ def test_accept_chinese_language_codes(self):
+ DarkLangConfig(
+ released_languages=('zh-cn, zh-tw'),
+ changed_by=self.user,
+ enabled=True
+ ).save()
+
+ self.assertAcceptEquals(
+ 'zh-CN;q=1.0, zh-TW;q=0.5, zh-TW;q=0.3',
+ self.process_request(accept='zh-Hans;q=1.0, zh-Hant-TW;q=0.5, zh-hk;q=0.3')
+ )
diff --git a/common/djangoapps/student/migrations/0032_auto__add_loginfailures.py b/common/djangoapps/student/migrations/0032_auto__add_loginfailures.py
index c39d2595be..70919c4198 100644
--- a/common/djangoapps/student/migrations/0032_auto__add_loginfailures.py
+++ b/common/djangoapps/student/migrations/0032_auto__add_loginfailures.py
@@ -113,6 +113,8 @@ class Migration(SchemaMigration):
},
'student.userprofile': {
'Meta': {'object_name': 'UserProfile', 'db_table': "'auth_userprofile'"},
+ 'city': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+ 'country': ('django_countries.fields.CountryField', [], {'max_length': '2', 'null': 'True', 'blank': 'True'}),
'allow_certificate': ('django.db.models.fields.BooleanField', [], {'default': 'True'}),
'courseware': ('django.db.models.fields.CharField', [], {'default': "'course.xml'", 'max_length': '255', 'blank': 'True'}),
'gender': ('django.db.models.fields.CharField', [], {'db_index': 'True', 'max_length': '6', 'null': 'True', 'blank': 'True'}),
@@ -144,4 +146,4 @@ class Migration(SchemaMigration):
}
}
- complete_apps = ['student']
\ No newline at end of file
+ complete_apps = ['student']
diff --git a/common/djangoapps/student/migrations/0033_auto__add_passwordhistory.py b/common/djangoapps/student/migrations/0033_auto__add_passwordhistory.py
new file mode 100644
index 0000000000..f46fd07894
--- /dev/null
+++ b/common/djangoapps/student/migrations/0033_auto__add_passwordhistory.py
@@ -0,0 +1,156 @@
+# -*- coding: utf-8 -*-
+import datetime
+from south.db import db
+from south.v2 import SchemaMigration
+from django.db import models
+
+
+class Migration(SchemaMigration):
+
+ def forwards(self, orm):
+ # Adding model 'PasswordHistory'
+ db.create_table('student_passwordhistory', (
+ ('id', self.gf('django.db.models.fields.AutoField')(primary_key=True)),
+ ('user', self.gf('django.db.models.fields.related.ForeignKey')(to=orm['auth.User'])),
+ ('password', self.gf('django.db.models.fields.CharField')(max_length=128)),
+ ('time_set', self.gf('django.db.models.fields.DateTimeField')(default=datetime.datetime.now)),
+ ))
+ db.send_create_signal('student', ['PasswordHistory'])
+
+
+ def backwards(self, orm):
+ # Deleting model 'PasswordHistory'
+ db.delete_table('student_passwordhistory')
+
+
+ models = {
+ 'auth.group': {
+ 'Meta': {'object_name': 'Group'},
+ 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+ 'name': ('django.db.models.fields.CharField', [], {'unique': 'True', 'max_length': '80'}),
+ 'permissions': ('django.db.models.fields.related.ManyToManyField', [], {'to': "orm['auth.Permission']", 'symmetrical': 'False', 'blank': 'True'})
+ },
+ 'auth.permission': {
+ 'Meta': {'ordering': "('content_type__app_label', 'content_type__model', 'codename')", 'unique_together': "(('content_type', 'codename'),)", 'object_name': 'Permission'},
+ 'codename': ('django.db.models.fields.CharField', [], {'max_length': '100'}),
+ 'content_type': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['contenttypes.ContentType']"}),
+ 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+ 'name': ('django.db.models.fields.CharField', [], {'max_length': '50'})
+ },
+ 'auth.user': {
+ 'Meta': {'object_name': 'User'},
+ 'date_joined': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.now'}),
+ 'email': ('django.db.models.fields.EmailField', [], {'max_length': '75', 'blank': 'True'}),
+ 'first_name': ('django.db.models.fields.CharField', [], {'max_length': '30', 'blank': 'True'}),
+ 'groups': ('django.db.models.fields.related.ManyToManyField', [], {'to': "orm['auth.Group']", 'symmetrical': 'False', 'blank': 'True'}),
+ 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+ 'is_active': ('django.db.models.fields.BooleanField', [], {'default': 'True'}),
+ 'is_staff': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+ 'is_superuser': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+ 'last_login': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.now'}),
+ 'last_name': ('django.db.models.fields.CharField', [], {'max_length': '30', 'blank': 'True'}),
+ 'password': ('django.db.models.fields.CharField', [], {'max_length': '128'}),
+ 'user_permissions': ('django.db.models.fields.related.ManyToManyField', [], {'to': "orm['auth.Permission']", 'symmetrical': 'False', 'blank': 'True'}),
+ 'username': ('django.db.models.fields.CharField', [], {'unique': 'True', 'max_length': '30'})
+ },
+ 'contenttypes.contenttype': {
+ 'Meta': {'ordering': "('name',)", 'unique_together': "(('app_label', 'model'),)", 'object_name': 'ContentType', 'db_table': "'django_content_type'"},
+ 'app_label': ('django.db.models.fields.CharField', [], {'max_length': '100'}),
+ 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+ 'model': ('django.db.models.fields.CharField', [], {'max_length': '100'}),
+ 'name': ('django.db.models.fields.CharField', [], {'max_length': '100'})
+ },
+ 'student.anonymoususerid': {
+ 'Meta': {'object_name': 'AnonymousUserId'},
+ 'anonymous_user_id': ('django.db.models.fields.CharField', [], {'unique': 'True', 'max_length': '32'}),
+ 'course_id': ('django.db.models.fields.CharField', [], {'max_length': '255', 'db_index': 'True'}),
+ 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+ 'user': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['auth.User']"})
+ },
+ 'student.courseenrollment': {
+ 'Meta': {'ordering': "('user', 'course_id')", 'unique_together': "(('user', 'course_id'),)", 'object_name': 'CourseEnrollment'},
+ 'course_id': ('django.db.models.fields.CharField', [], {'max_length': '255', 'db_index': 'True'}),
+ 'created': ('django.db.models.fields.DateTimeField', [], {'auto_now_add': 'True', 'null': 'True', 'db_index': 'True', 'blank': 'True'}),
+ 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+ 'is_active': ('django.db.models.fields.BooleanField', [], {'default': 'True'}),
+ 'mode': ('django.db.models.fields.CharField', [], {'default': "'honor'", 'max_length': '100'}),
+ 'user': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['auth.User']"})
+ },
+ 'student.courseenrollmentallowed': {
+ 'Meta': {'unique_together': "(('email', 'course_id'),)", 'object_name': 'CourseEnrollmentAllowed'},
+ 'auto_enroll': ('django.db.models.fields.BooleanField', [], {'default': 'False'}),
+ 'course_id': ('django.db.models.fields.CharField', [], {'max_length': '255', 'db_index': 'True'}),
+ 'created': ('django.db.models.fields.DateTimeField', [], {'auto_now_add': 'True', 'null': 'True', 'db_index': 'True', 'blank': 'True'}),
+ 'email': ('django.db.models.fields.CharField', [], {'max_length': '255', 'db_index': 'True'}),
+ 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'})
+ },
+ 'student.loginfailures': {
+ 'Meta': {'object_name': 'LoginFailures'},
+ 'failure_count': ('django.db.models.fields.IntegerField', [], {'default': '0'}),
+ 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+ 'lockout_until': ('django.db.models.fields.DateTimeField', [], {'null': 'True'}),
+ 'user': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['auth.User']"})
+ },
+ 'student.passwordhistory': {
+ 'Meta': {'object_name': 'PasswordHistory'},
+ 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+ 'password': ('django.db.models.fields.CharField', [], {'max_length': '128'}),
+ 'time_set': ('django.db.models.fields.DateTimeField', [], {'default': 'datetime.datetime.now'}),
+ 'user': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['auth.User']"})
+ },
+ 'student.pendingemailchange': {
+ 'Meta': {'object_name': 'PendingEmailChange'},
+ 'activation_key': ('django.db.models.fields.CharField', [], {'unique': 'True', 'max_length': '32', 'db_index': 'True'}),
+ 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+ 'new_email': ('django.db.models.fields.CharField', [], {'db_index': 'True', 'max_length': '255', 'blank': 'True'}),
+ 'user': ('django.db.models.fields.related.OneToOneField', [], {'to': "orm['auth.User']", 'unique': 'True'})
+ },
+ 'student.pendingnamechange': {
+ 'Meta': {'object_name': 'PendingNameChange'},
+ 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+ 'new_name': ('django.db.models.fields.CharField', [], {'max_length': '255', 'blank': 'True'}),
+ 'rationale': ('django.db.models.fields.CharField', [], {'max_length': '1024', 'blank': 'True'}),
+ 'user': ('django.db.models.fields.related.OneToOneField', [], {'to': "orm['auth.User']", 'unique': 'True'})
+ },
+ 'student.registration': {
+ 'Meta': {'object_name': 'Registration', 'db_table': "'auth_registration'"},
+ 'activation_key': ('django.db.models.fields.CharField', [], {'unique': 'True', 'max_length': '32', 'db_index': 'True'}),
+ 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+ 'user': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['auth.User']", 'unique': 'True'})
+ },
+ 'student.userprofile': {
+ 'Meta': {'object_name': 'UserProfile', 'db_table': "'auth_userprofile'"},
+ 'allow_certificate': ('django.db.models.fields.BooleanField', [], {'default': 'True'}),
+ 'city': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+ 'country': ('django_countries.fields.CountryField', [], {'max_length': '2', 'null': 'True', 'blank': 'True'}),
+ 'courseware': ('django.db.models.fields.CharField', [], {'default': "'course.xml'", 'max_length': '255', 'blank': 'True'}),
+ 'gender': ('django.db.models.fields.CharField', [], {'db_index': 'True', 'max_length': '6', 'null': 'True', 'blank': 'True'}),
+ 'goals': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+ 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+ 'language': ('django.db.models.fields.CharField', [], {'db_index': 'True', 'max_length': '255', 'blank': 'True'}),
+ 'level_of_education': ('django.db.models.fields.CharField', [], {'db_index': 'True', 'max_length': '6', 'null': 'True', 'blank': 'True'}),
+ 'location': ('django.db.models.fields.CharField', [], {'db_index': 'True', 'max_length': '255', 'blank': 'True'}),
+ 'mailing_address': ('django.db.models.fields.TextField', [], {'null': 'True', 'blank': 'True'}),
+ 'meta': ('django.db.models.fields.TextField', [], {'blank': 'True'}),
+ 'name': ('django.db.models.fields.CharField', [], {'db_index': 'True', 'max_length': '255', 'blank': 'True'}),
+ 'user': ('django.db.models.fields.related.OneToOneField', [], {'related_name': "'profile'", 'unique': 'True', 'to': "orm['auth.User']"}),
+ 'year_of_birth': ('django.db.models.fields.IntegerField', [], {'db_index': 'True', 'null': 'True', 'blank': 'True'})
+ },
+ 'student.userstanding': {
+ 'Meta': {'object_name': 'UserStanding'},
+ 'account_status': ('django.db.models.fields.CharField', [], {'max_length': '31', 'blank': 'True'}),
+ 'changed_by': ('django.db.models.fields.related.ForeignKey', [], {'to': "orm['auth.User']", 'blank': 'True'}),
+ 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+ 'standing_last_changed_at': ('django.db.models.fields.DateTimeField', [], {'auto_now': 'True', 'blank': 'True'}),
+ 'user': ('django.db.models.fields.related.ForeignKey', [], {'related_name': "'standing'", 'unique': 'True', 'to': "orm['auth.User']"})
+ },
+ 'student.usertestgroup': {
+ 'Meta': {'object_name': 'UserTestGroup'},
+ 'description': ('django.db.models.fields.TextField', [], {'blank': 'True'}),
+ 'id': ('django.db.models.fields.AutoField', [], {'primary_key': 'True'}),
+ 'name': ('django.db.models.fields.CharField', [], {'max_length': '32', 'db_index': 'True'}),
+ 'users': ('django.db.models.fields.related.ManyToManyField', [], {'to': "orm['auth.User']", 'db_index': 'True', 'symmetrical': 'False'})
+ }
+ }
+
+ complete_apps = ['student']
\ No newline at end of file
diff --git a/common/djangoapps/student/models.py b/common/djangoapps/student/models.py
index c4fc45950d..fc6ea6e344 100644
--- a/common/djangoapps/student/models.py
+++ b/common/djangoapps/student/models.py
@@ -18,16 +18,18 @@ import logging
from pytz import UTC
import uuid
from collections import defaultdict
+from dogapi import dog_stats_api
from django.conf import settings
+from django.utils import timezone
from django.contrib.auth.models import User
+from django.contrib.auth.hashers import make_password
from django.contrib.auth.signals import user_logged_in, user_logged_out
from django.db import models, IntegrityError
from django.db.models import Count
from django.db.models.signals import post_save
from django.dispatch import receiver, Signal
import django.dispatch
-from django.forms import ModelForm, forms
from django.core.exceptions import ObjectDoesNotExist
from django.utils.translation import ugettext_noop
from django_countries import CountryField
@@ -36,6 +38,8 @@ from track.views import server_track
from eventtracking import tracker
from importlib import import_module
+from xmodule.modulestore import Location
+
from course_modes.models import CourseMode
import lms.lib.comment_client as cc
from util.query import use_read_replica_if_available
@@ -79,8 +83,8 @@ def anonymous_id_for_user(user, course_id):
# include the secret key as a salt, and to make the ids unique across different LMS installs.
hasher = hashlib.md5()
hasher.update(settings.SECRET_KEY)
- hasher.update(str(user.id))
- hasher.update(course_id)
+ hasher.update(unicode(user.id))
+ hasher.update(course_id.encode('utf-8'))
digest = hasher.hexdigest()
try:
@@ -312,6 +316,185 @@ EVENT_NAME_ENROLLMENT_ACTIVATED = 'edx.course.enrollment.activated'
EVENT_NAME_ENROLLMENT_DEACTIVATED = 'edx.course.enrollment.deactivated'
+class PasswordHistory(models.Model):
+ """
+ This model will keep track of past passwords that a user has used
+ as well as providing contraints (e.g. can't reuse passwords)
+ """
+ user = models.ForeignKey(User)
+ password = models.CharField(max_length=128)
+ time_set = models.DateTimeField(default=timezone.now)
+
+ def create(self, user):
+ """
+ This will copy over the current password, if any of the configuration has been turned on
+ """
+
+ if not (PasswordHistory.is_student_password_reuse_restricted() or
+ PasswordHistory.is_staff_password_reuse_restricted() or
+ PasswordHistory.is_password_reset_frequency_restricted() or
+ PasswordHistory.is_staff_forced_password_reset_enabled() or
+ PasswordHistory.is_student_forced_password_reset_enabled()):
+
+ return
+
+ self.user = user
+ self.password = user.password
+ self.save()
+
+ @classmethod
+ def is_student_password_reuse_restricted(cls):
+ """
+ Returns whether the configuration which limits password reuse has been turned on
+ """
+ return settings.FEATURES['ADVANCED_SECURITY'] and \
+ settings.ADVANCED_SECURITY_CONFIG.get(
+ 'MIN_DIFFERENT_STUDENT_PASSWORDS_BEFORE_REUSE', 0
+ ) > 0
+
+ @classmethod
+ def is_staff_password_reuse_restricted(cls):
+ """
+ Returns whether the configuration which limits password reuse has been turned on
+ """
+ return settings.FEATURES['ADVANCED_SECURITY'] and \
+ settings.ADVANCED_SECURITY_CONFIG.get(
+ 'MIN_DIFFERENT_STAFF_PASSWORDS_BEFORE_REUSE', 0
+ ) > 0
+
+ @classmethod
+ def is_password_reset_frequency_restricted(cls):
+ """
+ Returns whether the configuration which limits the password reset frequency has been turned on
+ """
+ return settings.FEATURES['ADVANCED_SECURITY'] and \
+ settings.ADVANCED_SECURITY_CONFIG.get(
+ 'MIN_TIME_IN_DAYS_BETWEEN_ALLOWED_RESETS', None
+ )
+
+ @classmethod
+ def is_staff_forced_password_reset_enabled(cls):
+ """
+ Returns whether the configuration which forces password resets to occur has been turned on
+ """
+ return settings.FEATURES['ADVANCED_SECURITY'] and \
+ settings.ADVANCED_SECURITY_CONFIG.get(
+ 'MIN_DAYS_FOR_STAFF_ACCOUNTS_PASSWORD_RESETS', None
+ )
+
+ @classmethod
+ def is_student_forced_password_reset_enabled(cls):
+ """
+ Returns whether the configuration which forces password resets to occur has been turned on
+ """
+ return settings.FEATURES['ADVANCED_SECURITY'] and \
+ settings.ADVANCED_SECURITY_CONFIG.get(
+ 'MIN_DAYS_FOR_STUDENT_ACCOUNTS_PASSWORD_RESETS', None
+ )
+
+ @classmethod
+ def should_user_reset_password_now(cls, user):
+ """
+ Returns whether a password has 'expired' and should be reset. Note there are two different
+ expiry policies for staff and students
+ """
+ if not settings.FEATURES['ADVANCED_SECURITY']:
+ return False
+
+ days_before_password_reset = None
+ if user.is_staff:
+ if cls.is_staff_forced_password_reset_enabled():
+ days_before_password_reset = \
+ settings.ADVANCED_SECURITY_CONFIG['MIN_DAYS_FOR_STAFF_ACCOUNTS_PASSWORD_RESETS']
+ elif cls.is_student_forced_password_reset_enabled():
+ days_before_password_reset = \
+ settings.ADVANCED_SECURITY_CONFIG['MIN_DAYS_FOR_STUDENT_ACCOUNTS_PASSWORD_RESETS']
+
+ if days_before_password_reset:
+ history = PasswordHistory.objects.filter(user=user).order_by('-time_set')
+ time_last_reset = None
+
+ if history:
+ # first element should be the last time we reset password
+ time_last_reset = history[0].time_set
+ else:
+ # no history, then let's take the date the user joined
+ time_last_reset = user.date_joined
+
+ now = timezone.now()
+
+ delta = now - time_last_reset
+
+ return delta.days >= days_before_password_reset
+
+ return False
+
+ @classmethod
+ def is_password_reset_too_soon(cls, user):
+ """
+ Verifies that the password is not getting reset too frequently
+ """
+ if not cls.is_password_reset_frequency_restricted():
+ return False
+
+ history = PasswordHistory.objects.filter(user=user).order_by('-time_set')
+
+ if not history:
+ return False
+
+ now = timezone.now()
+
+ delta = now - history[0].time_set
+
+ return delta.days < settings.ADVANCED_SECURITY_CONFIG['MIN_TIME_IN_DAYS_BETWEEN_ALLOWED_RESETS']
+
+ @classmethod
+ def is_allowable_password_reuse(cls, user, new_password):
+ """
+ Verifies that the password adheres to the reuse policies
+ """
+ if not settings.FEATURES['ADVANCED_SECURITY']:
+ return True
+
+ if user.is_staff and cls.is_staff_password_reuse_restricted():
+ min_diff_passwords_required = \
+ settings.ADVANCED_SECURITY_CONFIG['MIN_DIFFERENT_STAFF_PASSWORDS_BEFORE_REUSE']
+ elif cls.is_student_password_reuse_restricted():
+ min_diff_passwords_required = \
+ settings.ADVANCED_SECURITY_CONFIG['MIN_DIFFERENT_STUDENT_PASSWORDS_BEFORE_REUSE']
+ else:
+ min_diff_passwords_required = 0
+
+ # just limit the result set to the number of different
+ # password we need
+ history = PasswordHistory.objects.filter(user=user).order_by('-time_set')[:min_diff_passwords_required]
+
+ for entry in history:
+
+ # be sure to re-use the same salt
+ # NOTE, how the salt is serialized in the password field is dependent on the algorithm
+ # in pbkdf2_sha256 [LMS] it's the 3rd element, in sha1 [unit tests] it's the 2nd element
+ hash_elements = entry.password.split('$')
+ algorithm = hash_elements[0]
+ if algorithm == 'pbkdf2_sha256':
+ hashed_password = make_password(new_password, hash_elements[2])
+ elif algorithm == 'sha1':
+ hashed_password = make_password(new_password, hash_elements[1])
+ else:
+ # This means we got something unexpected. We don't want to throw an exception, but
+ # log as an error and basically allow any password reuse
+ AUDIT_LOG.error('''
+ Unknown password hashing algorithm "{0}" found in existing password
+ hash, password reuse policy will not be enforced!!!
+ '''.format(algorithm))
+ return True
+
+ if entry.password == hashed_password:
+ return False
+
+ return True
+
+
class LoginFailures(models.Model):
"""
This model will keep track of failed login attempts
@@ -496,12 +679,31 @@ class CourseEnrollment(models.Model):
if activation_changed or mode_changed:
self.save()
if activation_changed:
+ course_id_dict = Location.parse_course_id(self.course_id)
if self.is_active:
self.emit_event(EVENT_NAME_ENROLLMENT_ACTIVATED)
+
+ dog_stats_api.increment(
+ "common.student.enrollment",
+ tags=[u"org:{org}".format(**course_id_dict),
+ u"course:{course}".format(**course_id_dict),
+ u"run:{name}".format(**course_id_dict),
+ u"mode:{}".format(self.mode)]
+ )
+
else:
unenroll_done.send(sender=None, course_enrollment=self)
+
self.emit_event(EVENT_NAME_ENROLLMENT_DEACTIVATED)
+ dog_stats_api.increment(
+ "common.student.unenrollment",
+ tags=[u"org:{org}".format(**course_id_dict),
+ u"course:{course}".format(**course_id_dict),
+ u"run:{name}".format(**course_id_dict),
+ u"mode:{}".format(self.mode)]
+ )
+
def emit_event(self, event_name):
"""
Emits an event to explicitly track course enrollment and unenrollment.
diff --git a/common/djangoapps/student/roles.py b/common/djangoapps/student/roles.py
index a0783196b5..e50e7290b3 100644
--- a/common/djangoapps/student/roles.py
+++ b/common/djangoapps/student/roles.py
@@ -64,7 +64,7 @@ class GlobalStaff(AccessRole):
def add_users(self, *users):
for user in users:
- if (user.is_authenticated and user.is_active):
+ if (user.is_authenticated() and user.is_active):
user.is_staff = True
user.save()
@@ -98,7 +98,7 @@ class GroupBasedRole(AccessRole):
"""
Return whether the supplied django user has access to this role.
"""
- if not (user.is_authenticated and user.is_active):
+ if not (user.is_authenticated() and user.is_active):
return False
# pylint: disable=protected-access
@@ -113,7 +113,7 @@ class GroupBasedRole(AccessRole):
"""
# silently ignores anonymous and inactive users so that any that are
# legit get updated.
- users = [user for user in users if user.is_authenticated and user.is_active]
+ users = [user for user in users if user.is_authenticated() and user.is_active]
group, _ = Group.objects.get_or_create(name=self._group_names[0])
group.user_set.add(*users)
# remove cache
diff --git a/common/djangoapps/student/tests/test_authz.py b/common/djangoapps/student/tests/test_authz.py
index 289c911d4a..dee2eb84f4 100644
--- a/common/djangoapps/student/tests/test_authz.py
+++ b/common/djangoapps/student/tests/test_authz.py
@@ -4,7 +4,7 @@ Tests authz.py
import mock
from django.test import TestCase
-from django.contrib.auth.models import User
+from django.contrib.auth.models import User, AnonymousUser
from xmodule.modulestore import Location
from django.core.exceptions import PermissionDenied
@@ -78,9 +78,10 @@ class CreatorGroupTest(TestCase):
"""
with mock.patch.dict('django.conf.settings.FEATURES',
{'DISABLE_COURSE_CREATION': False, "ENABLE_CREATOR_GROUP": True}):
- self.user.is_authenticated = False
- add_users(self.admin, CourseCreatorRole(), self.user)
- self.assertFalse(has_access(self.user, CourseCreatorRole()))
+ anonymous_user = AnonymousUser()
+ role = CourseCreatorRole()
+ add_users(self.admin, role, anonymous_user)
+ self.assertFalse(has_access(anonymous_user, role))
def test_add_user_not_active(self):
"""
diff --git a/common/djangoapps/student/tests/test_email.py b/common/djangoapps/student/tests/test_email.py
index ce680d18ec..1abae9fabf 100644
--- a/common/djangoapps/student/tests/test_email.py
+++ b/common/djangoapps/student/tests/test_email.py
@@ -5,7 +5,7 @@ import unittest
from student.tests.factories import UserFactory, RegistrationFactory, PendingEmailChangeFactory
from student.views import reactivation_email_for_user, change_email_request, confirm_email_change
from student.models import UserProfile, PendingEmailChange
-from django.contrib.auth.models import User
+from django.contrib.auth.models import User, AnonymousUser
from django.test import TestCase, TransactionTestCase
from django.test.client import RequestFactory
from mock import Mock, patch
@@ -157,10 +157,11 @@ class EmailChangeRequestTests(TestCase):
self.assertFalse(self.user.email_user.called)
def test_unauthenticated(self):
- self.user.is_authenticated = False
+ self.request.user = AnonymousUser()
+ self.request.user.email_user = Mock()
with self.assertRaises(Http404):
change_email_request(self.request)
- self.assertFalse(self.user.email_user.called)
+ self.assertFalse(self.request.user.email_user.called)
def test_invalid_password(self):
self.request.POST['password'] = 'wrong'
diff --git a/common/djangoapps/student/tests/test_password_history.py b/common/djangoapps/student/tests/test_password_history.py
new file mode 100644
index 0000000000..efa1e370ed
--- /dev/null
+++ b/common/djangoapps/student/tests/test_password_history.py
@@ -0,0 +1,205 @@
+# -*- coding: utf-8 -*-
+"""
+This test file will verify proper password history enforcement
+"""
+from django.test import TestCase
+from django.utils import timezone
+from mock import patch
+from student.tests.factories import UserFactory, AdminFactory
+
+from student.models import PasswordHistory
+from freezegun import freeze_time
+from datetime import timedelta
+
+from django.test.utils import override_settings
+
+
+@patch.dict("django.conf.settings.FEATURES", {'ADVANCED_SECURITY': True})
+class TestPasswordHistory(TestCase):
+ """
+ All the tests that assert proper behavior regarding password history
+ """
+
+ def _change_password(self, user, password):
+ """
+ Helper method to change password on user and record in the PasswordHistory
+ """
+ user.set_password(password)
+ user.save()
+ history = PasswordHistory()
+ history.create(user)
+
+ def _user_factory_with_history(self, is_staff=False, set_initial_history=True):
+ """
+ Helper method to generate either an Admin or a User
+ """
+ if is_staff:
+ user = AdminFactory()
+ else:
+ user = UserFactory()
+
+ user.date_joined = timezone.now()
+
+ if set_initial_history:
+ history = PasswordHistory()
+ history.create(user)
+
+ return user
+
+ @patch.dict("django.conf.settings.FEATURES", {'ADVANCED_SECURITY': False})
+ def test_disabled_feature(self):
+ """
+ Test that behavior is normal when this feature is not turned on
+ """
+ user = UserFactory()
+ staff = AdminFactory()
+
+ # if feature is disabled user can keep reusing same password
+ self.assertTrue(PasswordHistory.is_allowable_password_reuse(user, "test"))
+ self.assertTrue(PasswordHistory.is_allowable_password_reuse(staff, "test"))
+
+ self.assertFalse(PasswordHistory.should_user_reset_password_now(user))
+ self.assertFalse(PasswordHistory.should_user_reset_password_now(staff))
+
+ @patch.dict("django.conf.settings.ADVANCED_SECURITY_CONFIG", {'MIN_DIFFERENT_STAFF_PASSWORDS_BEFORE_REUSE': 2})
+ @patch.dict("django.conf.settings.ADVANCED_SECURITY_CONFIG", {'MIN_DIFFERENT_STUDENT_PASSWORDS_BEFORE_REUSE': 1})
+ def test_accounts_password_reuse(self):
+ """
+ Assert against the password reuse policy
+ """
+ user = self._user_factory_with_history()
+ staff = self._user_factory_with_history(is_staff=True)
+
+ # students need to user at least one different passwords before reuse
+ self.assertFalse(PasswordHistory.is_allowable_password_reuse(user, "test"))
+ self.assertTrue(PasswordHistory.is_allowable_password_reuse(user, "different"))
+ self._change_password(user, "different")
+
+ self.assertTrue(PasswordHistory.is_allowable_password_reuse(user, "test"))
+
+ # staff needs to use at least two different passwords before reuse
+ self.assertFalse(PasswordHistory.is_allowable_password_reuse(staff, "test"))
+ self.assertTrue(PasswordHistory.is_allowable_password_reuse(staff, "different"))
+ self._change_password(staff, "different")
+
+ self.assertFalse(PasswordHistory.is_allowable_password_reuse(staff, "test"))
+ self.assertFalse(PasswordHistory.is_allowable_password_reuse(staff, "different"))
+ self.assertTrue(PasswordHistory.is_allowable_password_reuse(staff, "third"))
+ self._change_password(staff, "third")
+
+ self.assertTrue(PasswordHistory.is_allowable_password_reuse(staff, "test"))
+
+ @override_settings(PASSWORD_HASHERS=('django.contrib.auth.hashers.PBKDF2PasswordHasher'))
+ @patch.dict("django.conf.settings.ADVANCED_SECURITY_CONFIG", {'MIN_DIFFERENT_STAFF_PASSWORDS_BEFORE_REUSE': 2})
+ @patch.dict("django.conf.settings.ADVANCED_SECURITY_CONFIG", {'MIN_DIFFERENT_STUDENT_PASSWORDS_BEFORE_REUSE': 1})
+ def test_pbkdf2_sha256_password_reuse(self):
+ """
+ Assert against the password reuse policy but using the normal Django PBKDF2
+ """
+ user = self._user_factory_with_history()
+ staff = self._user_factory_with_history(is_staff=True)
+
+ # students need to user at least one different passwords before reuse
+ self.assertFalse(PasswordHistory.is_allowable_password_reuse(user, "test"))
+ self.assertTrue(PasswordHistory.is_allowable_password_reuse(user, "different"))
+ self._change_password(user, "different")
+
+ self.assertTrue(PasswordHistory.is_allowable_password_reuse(user, "test"))
+
+ # staff needs to use at least two different passwords before reuse
+ self.assertFalse(PasswordHistory.is_allowable_password_reuse(staff, "test"))
+ self.assertTrue(PasswordHistory.is_allowable_password_reuse(staff, "different"))
+ self._change_password(staff, "different")
+
+ self.assertFalse(PasswordHistory.is_allowable_password_reuse(staff, "test"))
+ self.assertFalse(PasswordHistory.is_allowable_password_reuse(staff, "different"))
+ self.assertTrue(PasswordHistory.is_allowable_password_reuse(staff, "third"))
+ self._change_password(staff, "third")
+
+ self.assertTrue(PasswordHistory.is_allowable_password_reuse(staff, "test"))
+
+ @patch.dict("django.conf.settings.ADVANCED_SECURITY_CONFIG", {'MIN_DAYS_FOR_STAFF_ACCOUNTS_PASSWORD_RESETS': 1})
+ @patch.dict("django.conf.settings.ADVANCED_SECURITY_CONFIG", {'MIN_DAYS_FOR_STUDENT_ACCOUNTS_PASSWORD_RESETS': 5})
+ def test_forced_password_change(self):
+ """
+ Assert when passwords must be reset
+ """
+ student = self._user_factory_with_history()
+ staff = self._user_factory_with_history(is_staff=True)
+ grandfathered_student = self._user_factory_with_history(set_initial_history=False)
+
+ self.assertFalse(PasswordHistory.should_user_reset_password_now(student))
+ self.assertFalse(PasswordHistory.should_user_reset_password_now(staff))
+ self.assertFalse(PasswordHistory.should_user_reset_password_now(grandfathered_student))
+
+ staff_reset_time = timezone.now() + timedelta(days=1)
+ with freeze_time(staff_reset_time):
+ self.assertFalse(PasswordHistory.should_user_reset_password_now(student))
+ self.assertFalse(PasswordHistory.should_user_reset_password_now(grandfathered_student))
+ self.assertTrue(PasswordHistory.should_user_reset_password_now(staff))
+
+ self._change_password(staff, 'Different')
+ self.assertFalse(PasswordHistory.should_user_reset_password_now(staff))
+
+ student_reset_time = timezone.now() + timedelta(days=5)
+
+ with freeze_time(student_reset_time):
+ self.assertTrue(PasswordHistory.should_user_reset_password_now(student))
+ self.assertTrue(PasswordHistory.should_user_reset_password_now(grandfathered_student))
+ self.assertTrue(PasswordHistory.should_user_reset_password_now(staff))
+
+ self._change_password(student, 'Different')
+ self.assertFalse(PasswordHistory.should_user_reset_password_now(student))
+
+ self._change_password(grandfathered_student, 'Different')
+ self.assertFalse(PasswordHistory.should_user_reset_password_now(grandfathered_student))
+
+ self._change_password(staff, 'Different')
+ self.assertFalse(PasswordHistory.should_user_reset_password_now(staff))
+
+ @patch.dict("django.conf.settings.ADVANCED_SECURITY_CONFIG", {'MIN_DAYS_FOR_STAFF_ACCOUNTS_PASSWORD_RESETS': None})
+ @patch.dict("django.conf.settings.ADVANCED_SECURITY_CONFIG", {'MIN_DAYS_FOR_STUDENT_ACCOUNTS_PASSWORD_RESETS': None})
+ def test_no_forced_password_change(self):
+ """
+ Assert that if we skip configuration, then user will never have to force reset password
+ """
+ student = self._user_factory_with_history()
+ staff = self._user_factory_with_history(is_staff=True)
+
+ # also create a user who doesn't have any history
+ grandfathered_student = UserFactory()
+ grandfathered_student.date_joined = timezone.now()
+
+ self.assertFalse(PasswordHistory.should_user_reset_password_now(student))
+ self.assertFalse(PasswordHistory.should_user_reset_password_now(staff))
+ self.assertFalse(PasswordHistory.should_user_reset_password_now(grandfathered_student))
+
+ staff_reset_time = timezone.now() + timedelta(days=100)
+ with freeze_time(staff_reset_time):
+ self.assertFalse(PasswordHistory.should_user_reset_password_now(student))
+ self.assertFalse(PasswordHistory.should_user_reset_password_now(grandfathered_student))
+ self.assertFalse(PasswordHistory.should_user_reset_password_now(staff))
+
+ @patch.dict("django.conf.settings.ADVANCED_SECURITY_CONFIG", {'MIN_TIME_IN_DAYS_BETWEEN_ALLOWED_RESETS': 1})
+ def test_too_frequent_password_resets(self):
+ """
+ Assert that a user should not be able to password reset too frequently
+ """
+ student = self._user_factory_with_history()
+ grandfathered_student = self._user_factory_with_history(set_initial_history=False)
+
+ self.assertTrue(PasswordHistory.is_password_reset_too_soon(student))
+ self.assertFalse(PasswordHistory.is_password_reset_too_soon(grandfathered_student))
+
+ staff_reset_time = timezone.now() + timedelta(days=100)
+ with freeze_time(staff_reset_time):
+ self.assertFalse(PasswordHistory.is_password_reset_too_soon(student))
+
+ @patch.dict("django.conf.settings.ADVANCED_SECURITY_CONFIG", {'MIN_TIME_IN_DAYS_BETWEEN_ALLOWED_RESETS': None})
+ def test_disabled_too_frequent_password_resets(self):
+ """
+ Verify properly default behavior when feature is disabled
+ """
+ student = self._user_factory_with_history()
+
+ self.assertFalse(PasswordHistory.is_password_reset_too_soon(student))
diff --git a/common/djangoapps/student/tests/test_password_policy.py b/common/djangoapps/student/tests/test_password_policy.py
index 647288ad0f..a649c53544 100644
--- a/common/djangoapps/student/tests/test_password_policy.py
+++ b/common/djangoapps/student/tests/test_password_policy.py
@@ -87,7 +87,7 @@ class TestPasswordPolicy(TestCase):
)
@patch.dict("django.conf.settings.PASSWORD_COMPLEXITY", {'LOWER': 3})
- def test_password_not_enough_lowercase(self):
+ def test_password_enough_lowercase(self):
self.url_params['password'] = 'ThisShouldPass'
response = self.client.post(self.url, self.url_params)
self.assertEqual(response.status_code, 200)
diff --git a/common/djangoapps/student/tests/test_reset_password.py b/common/djangoapps/student/tests/test_reset_password.py
new file mode 100644
index 0000000000..d0f35bc9c7
--- /dev/null
+++ b/common/djangoapps/student/tests/test_reset_password.py
@@ -0,0 +1,158 @@
+"""
+Test the various password reset flows
+"""
+import json
+import re
+import unittest
+
+from django.core.cache import cache
+from django.conf import settings
+from django.test import TestCase
+from django.test.client import RequestFactory
+from django.contrib.auth.models import User
+from django.contrib.auth.hashers import UNUSABLE_PASSWORD
+from django.contrib.auth.tokens import default_token_generator
+from django.utils.http import int_to_base36
+
+from mock import Mock, patch
+from textwrap import dedent
+
+from student.views import password_reset, password_reset_confirm_wrapper
+from student.tests.factories import UserFactory
+from student.tests.test_email import mock_render_to_string
+
+
+class ResetPasswordTests(TestCase):
+ """ Tests that clicking reset password sends email, and doesn't activate the user
+ """
+ request_factory = RequestFactory()
+
+ def setUp(self):
+ self.user = UserFactory.create()
+ self.user.is_active = False
+ self.user.save()
+ self.token = default_token_generator.make_token(self.user)
+ self.uidb36 = int_to_base36(self.user.id)
+
+ self.user_bad_passwd = UserFactory.create()
+ self.user_bad_passwd.is_active = False
+ self.user_bad_passwd.password = UNUSABLE_PASSWORD
+ self.user_bad_passwd.save()
+
+ @patch('student.views.render_to_string', Mock(side_effect=mock_render_to_string, autospec=True))
+ def test_user_bad_password_reset(self):
+ """Tests password reset behavior for user with password marked UNUSABLE_PASSWORD"""
+
+ bad_pwd_req = self.request_factory.post('/password_reset/', {'email': self.user_bad_passwd.email})
+ bad_pwd_resp = password_reset(bad_pwd_req)
+ # If they've got an unusable password, we return a successful response code
+ self.assertEquals(bad_pwd_resp.status_code, 200)
+ obj = json.loads(bad_pwd_resp.content)
+ self.assertEquals(obj, {
+ 'success': True,
+ 'value': "('registration/password_reset_done.html', [])",
+ })
+
+ @patch('student.views.render_to_string', Mock(side_effect=mock_render_to_string, autospec=True))
+ def test_nonexist_email_password_reset(self):
+ """Now test the exception cases with of reset_password called with invalid email."""
+
+ bad_email_req = self.request_factory.post('/password_reset/', {'email': self.user.email + "makeItFail"})
+ bad_email_resp = password_reset(bad_email_req)
+ # Note: even if the email is bad, we return a successful response code
+ # This prevents someone potentially trying to "brute-force" find out which
+ # emails are and aren't registered with edX
+ self.assertEquals(bad_email_resp.status_code, 200)
+ obj = json.loads(bad_email_resp.content)
+ self.assertEquals(obj, {
+ 'success': True,
+ 'value': "('registration/password_reset_done.html', [])",
+ })
+
+ @patch('student.views.render_to_string', Mock(side_effect=mock_render_to_string, autospec=True))
+ def test_password_reset_ratelimited(self):
+ """ Try (and fail) resetting password 30 times in a row on an non-existant email address """
+ cache.clear()
+
+ for i in xrange(30):
+ good_req = self.request_factory.post('/password_reset/', {
+ 'email': 'thisdoesnotexist{0}@foo.com'.format(i)
+ })
+ good_resp = password_reset(good_req)
+ self.assertEquals(good_resp.status_code, 200)
+
+ # then the rate limiter should kick in and give a HttpForbidden response
+ bad_req = self.request_factory.post('/password_reset/', {'email': 'thisdoesnotexist@foo.com'})
+ bad_resp = password_reset(bad_req)
+ self.assertEquals(bad_resp.status_code, 403)
+
+ cache.clear()
+
+ @unittest.skipIf(
+ settings.FEATURES.get('DISABLE_RESET_EMAIL_TEST', False),
+ dedent("""
+ Skipping Test because CMS has not provided necessary templates for password reset.
+ If LMS tests print this message, that needs to be fixed.
+ """)
+ )
+ @patch('django.core.mail.send_mail')
+ @patch('student.views.render_to_string', Mock(side_effect=mock_render_to_string, autospec=True))
+ def test_reset_password_email(self, send_email):
+ """Tests contents of reset password email, and that user is not active"""
+
+ good_req = self.request_factory.post('/password_reset/', {'email': self.user.email})
+ good_resp = password_reset(good_req)
+ self.assertEquals(good_resp.status_code, 200)
+ obj = json.loads(good_resp.content)
+ self.assertEquals(obj, {
+ 'success': True,
+ 'value': "('registration/password_reset_done.html', [])",
+ })
+
+ (subject, msg, from_addr, to_addrs) = send_email.call_args[0]
+ self.assertIn("Password reset", subject)
+ self.assertIn("You're receiving this e-mail because you requested a password reset", msg)
+ self.assertEquals(from_addr, settings.DEFAULT_FROM_EMAIL)
+ self.assertEquals(len(to_addrs), 1)
+ self.assertIn(self.user.email, to_addrs)
+
+ #test that the user is not active
+ self.user = User.objects.get(pk=self.user.pk)
+ self.assertFalse(self.user.is_active)
+ re.search(r'password_reset_confirm/(?P