Fixes OSQA 275, Password changing is not reliable.

Makes superusers able to change any password without having to type the old one.
Makes old passwords to be check against the db in every circunstancies.

git-svn-id: http://svn.osqa.net/svnroot/osqa/trunk@339 0cfe37f9-358a-4d5e-be75-b63607b5c754

diff --git a/forum/models/comment.py b/forum/models/comment.py
index a70d4749f762a366a20b0a428c7498ad8f8f6db9..793a1f76b87dd01a4ae98fbe68682ccbb431c956 100644 (file)
--- a/forum/models/comment.py
+++ b/forum/models/comment.py
@@ -51,7 +51,7 @@ class Comment(Node):
         return False\r
 \r
     def get_absolute_url(self):\r
-        return self.absolute_parent.get_absolute_url() + "#%d" % self.id\r
+        return self.abs_parent.get_absolute_url() + "#%d" % self.id\r
 \r
     def __unicode__(self):\r
         return self.body\r

diff --git a/forum/models/node.py b/forum/models/node.py
index 2299663dee822b52a3a1c636fd73ad038e680eef..b375ec44c1d1dc21fdfa9f67ac22761b90631da4 100644 (file)
--- a/forum/models/node.py
+++ b/forum/models/node.py
@@ -244,9 +244,9 @@ class Node(BaseModel, NodeContent):
     @property    \r
     def absolute_parent(self):\r
         if not self.abs_parent_id:\r
-            return self.leaf\r
+            return self\r
 \r
-        return self.abs_parent.leaf\r
+        return self.abs_parent\r
 \r
     @property\r
     def summary(self):\r

diff --git a/forum/models/user.py b/forum/models/user.py
index 6f7613a31cc4239bb00e99f7b56016e862819b7b..31f4e19a87bf5125d3307534e6a97f5c987b7546 100644 (file)
--- a/forum/models/user.py
+++ b/forum/models/user.py
@@ -255,6 +255,11 @@ class User(BaseModel, DjangoUser):
     def can_upload_files(self):\r
         return self.reputation >= int(settings.REP_TO_UPLOAD)\r
 \r
+    def check_password(self, old_passwd):\r
+        self.__dict__.update(self.__class__.objects.filter(id=self.id).values('password')[0])\r
+        return DjangoUser.check_password(self, old_passwd)\r
+\r
+\r
     class Meta:\r
         app_label = 'forum'\r
 \r

diff --git a/forum/views/auth.py b/forum/views/auth.py
index 26ce783161ccae5c422424d06037600ec30f0e63..9b41503120f3f9e8549d51a43da1de2f7e993e09 100644 (file)
--- a/forum/views/auth.py
+++ b/forum/views/auth.py
@@ -268,10 +268,10 @@ def auth_settings(request, id):
 
     auth_keys = user_.auth_keys.all()
 
-    if user_.has_usable_password():
-        FormClass = ChangePasswordForm
-    else:
+    if request.user.is_superuser or (not user_.has_usable_password()):
         FormClass = SetPasswordForm
+    else:
+        FormClass = ChangePasswordForm
 
     if request.POST:
         form = FormClass(request.POST, user=user_)
@@ -280,13 +280,14 @@ def auth_settings(request, id):
                 request.user.message_set.create(message=_("Your password was changed"))
             else:
                 request.user.message_set.create(message=_("New password set"))
-                FormClass = ChangePasswordForm
+                if not request.user.is_superuser:
+                    form = ChangePasswordForm(user=user_)
                 
             user_.set_password(form.cleaned_data['password1'])
             user_.save()
             return HttpResponseRedirect(reverse('user_authsettings', kwargs={'id': user_.id}))
-    
-    form = FormClass(user=user_)
+    else:
+        form = FormClass(user=user_)
 
     auth_keys_list = []