diff --git a/parameciofast/libraries/db/extraforms/dateform.py b/parameciofast/libraries/db/extraforms/dateform.py index b00cc22..0c7cb32 100644 --- a/parameciofast/libraries/db/extraforms/dateform.py +++ b/parameciofast/libraries/db/extraforms/dateform.py @@ -1,7 +1,7 @@ #!/usr/bin/env python3 from parameciofast.libraries.db.coreforms import BaseForm -from parameciofast.libraries.mtemplates import standard_t +#from parameciofast.libraries.mtemplates import standard_t from parameciofast.libraries.datetime import format_timedata class DateForm(BaseForm): @@ -11,7 +11,7 @@ class DateForm(BaseForm): super().__init__(name, value) self.yes_time=False - self.t=standard_t + #self.t=standard_t def form(self): diff --git a/parameciofast/modules/fastadmin/app.py b/parameciofast/modules/fastadmin/app.py index 67998b3..a53e31b 100644 --- a/parameciofast/modules/fastadmin/app.py +++ b/parameciofast/modules/fastadmin/app.py @@ -1,4 +1,4 @@ -from fastapi import FastAPI, Cookie, Request, Response, Body +from fastapi import FastAPI, Cookie, Request, Response, Body, Header from fastapi.responses import HTMLResponse, RedirectResponse from parameciofast.modules.fastadmin import admin_app from typing import Annotated @@ -6,21 +6,29 @@ from parameciofast.fast import app from parameciofast.libraries.i18n import I18n from parameciofast.libraries.mtemplates import env_theme, PTemplate from pydantic import BaseModel, Field -from parameciofast.modules.fastadmin.models.admin import UserAdmin +from parameciofast.modules.fastadmin.models.admin import UserAdmin, LoginTries from parameciofast.libraries.db.webmodel import WebModel from parameciofast.libraries.fastutils import ResponseData from parameciofast.libraries.db import simplequery +from settings import config +from parameciofast.libraries.datetime import now, format_local_strtime, timestamp_to_datetime, obtain_timestamp env=env_theme(__file__) t=PTemplate(env, app.url_path_for) usermodel=UserAdmin() + +login_tries=5 + +if hasattr(config, 'login_tries'): + login_tries=config.login_tries + #useradmin.create_forms() #useradmin.safe_query=True @admin_app.get('/', response_class=HTMLResponse) -def home_admin(request: Request, paramecio_session: Annotated[str | None, Cookie(description='Cookie for validate into the admin site. The cookie name can change in you settings/config.py')] = None): +def home_admin(request: Request, paramecio_session: Annotated[str | None, Cookie(description='Cookie for validate into the admin site. The cookie name can change in you settings/config.py')] = None, remote_address: Annotated[str | None, Header()] = None): if not request.session.get('login_admin', None): return RedirectResponse(app.url_path_for('login_admin')) @@ -67,8 +75,11 @@ class UserAdmin(BaseModel): password: str = Field(description="The password of user") remember_login: bool | None = None +class ResponseDataLogin(ResponseData): + login_tries: bool + @admin_app.post('/login') -def check_login_admin(user: UserAdmin, request: Request) -> ResponseData: +def check_login_admin(user: UserAdmin, request: Request) -> ResponseDataLogin: db=WebModel.connection() @@ -78,7 +89,9 @@ def check_login_admin(user: UserAdmin, request: Request) -> ResponseData: message=i18n.tlang('Invalid user and password') - if user.username!='' and user.password!='': + no_login=check_login_tries(request, db) + + if user.username!='' and user.password!='' and not no_login: with db.query('select * from useradmin WHERE username=%s', [user.username]) as cursor: result=cursor.fetchone() @@ -93,7 +106,7 @@ def check_login_admin(user: UserAdmin, request: Request) -> ResponseData: db.close() - return {'error': error, 'message': message} + return {'error': error, 'message': message, 'login_tries': no_login} class UserSignup(BaseModel): username: str = Field(description="The username of new user", min_length=4, pattern=r"\w+") @@ -154,3 +167,43 @@ def logout_admin(request: Request) -> RedirectResponse: return RedirectResponse(app.url_path_for('login_admin')) + +def check_login_tries(request, db): + + logintries=LoginTries(db) + + logintries.safe_query() + + if 'x-real-ip' in request.headers: + ip=request.headers['x-real-ip'] + elif 'x-forwarded-for' in request.headers: + ip=request.headers['x-forwarded-for'] + else: + ip=request.client.host + + you_cannot_login=0 + + arr_try=logintries.set_conditions('WHERE ip=%s', [ip]).select_a_row_where() + + now_str=now() + date_now=format_local_strtime('YYYY-MM-DD HH:mm:ss', now_str) + + date_check=format_local_strtime('YYYY-MM-DD HH:mm:ss', timestamp_to_datetime(obtain_timestamp(now_str)-300)) + + logintries.query('delete from logintries where last_login<%s', [date_check]) + + if arr_try: + + if arr_try['num_tries']