Added decorator @admin_only to the handlers that are restricted to the administrator.

This also uniformizes the http response to 403 Forbidden.

Added decorator @admin_only to the handlers that are restricted to the administrator.
This also uniformizes the http response to 403 Forbidden.
Miguel Barão
1 parent 1245246a
Showing 2 changed files with 57 additions and 47 deletions Show diff stats
BUGS.md
serve.py
 # BUGS
+- self.testapp.get_json_filename_of_test(test_id) retorna None quando test_id nao existe.
 - a revisao do teste não mostra as imagens.
 - se aluno tem teste activo e é allowed uma segunda vez, deve manter o mesmo teste. adicionar opcao para eliminar um teste em curso.
 - melhorar o botao de autorizar (desliga-se), usar antes um botao?
@@ -11,6 +11,7 @@ import mimetypes
 import signal
 import asyncio
 import json
+import functools
 # user installed libraries
 import tornado.ioloop
@@ -22,10 +23,21 @@ from tornado import template, gen
 from app import App, AppException
 from tools import load_yaml, md_to_html
+# ----------------------------------------------------------------------------
+# Decorator used to restrict access only to the administrator
+# ----------------------------------------------------------------------------
+def admin_only(func):
+    @functools.wraps(func)
+    def wrapper(self, *args, **kwargs):
+        if self.current_user != '0':
+            raise tornado.web.HTTPError(403)  # forbidden
+        else:
+            func(self, *args, **kwargs)
+    return wrapper
-# -------------------------------------------------------------------------
+# ----------------------------------------------------------------------------
 # Web Application. Routes to handler classes.
-# -------------------------------------------------------------------------
+# ----------------------------------------------------------------------------
 class WebApplication(tornado.web.Application):
     def __init__(self, testapp, debug=False):
         handlers = [
@@ -52,9 +64,9 @@ class WebApplication(tornado.web.Application):
         self.testapp = testapp
-# -------------------------------------------------------------------------
+# ----------------------------------------------------------------------------
 # Base handler. Other handlers will inherit this one.
-# -------------------------------------------------------------------------
+# ----------------------------------------------------------------------------
 class BaseHandler(tornado.web.RequestHandler):
     @property
     def testapp(self):
@@ -66,9 +78,9 @@ class BaseHandler(tornado.web.RequestHandler):
             return cookie.decode('utf-8')
-# -------------------------------------------------------------------------
+# ----------------------------------------------------------------------------
 # /login
-# -------------------------------------------------------------------------
+# ----------------------------------------------------------------------------
 class LoginHandler(BaseHandler):
     SUPPORTED_METHODS = ['GET', 'POST']
@@ -84,12 +96,12 @@ class LoginHandler(BaseHandler):
             self.set_secure_cookie("user", str(uid), expires_days=30)
             self.redirect(self.get_argument("next", "/"))
         else:
-            self.render("login.html",
-                        error='Não autorizado ou número/senha inválido')
+            self.render("login.html", error='Não autorizado ou número/senha inválido')
-# -------------------------------------------------------------------------
+
+# ----------------------------------------------------------------------------
 # /logout
-# -------------------------------------------------------------------------
+# ----------------------------------------------------------------------------
 class LogoutHandler(BaseHandler):
     @tornado.web.authenticated
     def get(self):
@@ -101,10 +113,24 @@ class LogoutHandler(BaseHandler):
 # ----------------------------------------------------------------------------
+# handles root / to redirect students to /test and admininistrator to /admin
+# ----------------------------------------------------------------------------
+# FIXME list available tests
+class RootHandler(BaseHandler):
+    @tornado.web.authenticated
+    def get(self):
+        if self.current_user == '0':
+            self.redirect('/admin')
+        else:
+            self.redirect('/test')
+
+
+# ----------------------------------------------------------------------------
 # Serves files from the /public subdir of the topics.
 # Based on https://bhch.github.io/posts/2017/12/serving-large-files-with-tornado-safely-without-blocking/
 # ----------------------------------------------------------------------------
 class FileHandler(BaseHandler):
+    SUPPORTED_METHODS = ['GET']
     chunk_size = 512 * 1024  # serve up to 512 KiB multiple times
     @tornado.web.authenticated
@@ -171,14 +197,15 @@ class TestHandler(BaseHandler):
         'success':      'question-success.html',
     }
-    # GET
+    # --- GET
     @tornado.web.authenticated
     def get(self):
         uid = self.current_user
+        # FIXME make generate async?
         t = self.testapp.get_student_test(uid) or self.testapp.generate_test(uid)
         self.render('test.html', t=t, md=md_to_html, templ=self._templates)
-    # POST
+    # --- POST
     @tornado.web.authenticated
     async def post(self):
         uid = self.current_user
@@ -211,6 +238,19 @@ class TestHandler(BaseHandler):
         self.render('grade.html', t=t, allgrades=self.testapp.get_student_grades_from_all_tests(uid))
+# -------------------------------------------------------------------------
+# FIXME this should be a post in the test with command giveup instead of correct...
+# class GiveupHandler(BaseHandler):
+#     @tornado.web.authenticated
+#     def get(self):
+#         uid = self.current_user
+#         t = self.testapp.giveup_test(uid)
+#         self.testapp.logout(uid)
+
+#         # --- Show result to student
+#         self.render('grade.html', t=t, allgrades=self.testapp.get_student_grades_from_all_tests(uid))
+
+
 # --- REVIEW -------------------------------------------------------------
 class ReviewHandler(BaseHandler):
     _templates = {
@@ -230,15 +270,12 @@ class ReviewHandler(BaseHandler):
     }
     @tornado.web.authenticated
+    @admin_only
     def get(self):
-        uid = self.current_user
-        if uid != '0':
-            raise tornado.web.HTTPError(404)
-
         test_id = self.get_query_argument('test_id', None)
         logging.info(f'Review test {test_id}.')
         try:
-            fname = self.testapp.get_json_filename_of_test(test_id)
+            fname = self.testapp.get_json_filename_of_test(test_id) # FIXME is returning None if nonexistent
         except:
             raise tornado.web.HTTPError(404, 'Test ID not found.')
@@ -253,38 +290,12 @@ class ReviewHandler(BaseHandler):
 # -------------------------------------------------------------------------
-# FIXME this should be a post in the test with command giveup instead of correct...
-class GiveupHandler(BaseHandler):
-    @tornado.web.authenticated
-    def get(self):
-        uid = self.current_user
-        t = self.testapp.giveup_test(uid)
-        self.testapp.logout(uid)
-
-        # --- Show result to student
-        self.render('grade.html', t=t, allgrades=self.testapp.get_student_grades_from_all_tests(uid))
-
-
-# -------------------------------------------------------------------------
-# FIXME list available tests
-class RootHandler(BaseHandler):
-    @tornado.web.authenticated
-    def get(self):
-        if self.current_user == '0':
-            self.redirect('/admin')
-        else:
-            self.redirect('/test')
-
-
-# -------------------------------------------------------------------------
 class AdminHandler(BaseHandler):
     SUPPORTED_METHODS = ['GET', 'POST']
     @tornado.web.authenticated
+    @admin_only
     def get(self):
-        if self.current_user != '0':
-            raise tornado.web.HTTPError(403)
-
         cmd = self.get_query_argument('cmd', default=None)
         if cmd == 'students_table':
@@ -307,10 +318,8 @@ class AdminHandler(BaseHandler):
             self.render('admin.html')
     @tornado.web.authenticated
+    @admin_only
     def post(self):
-        if self.current_user != '0':
-            self.redirect('/')
-
         cmd = self.get_body_argument('cmd', None)
         value = self.get_body_argument('value', None)
1		1
2	# BUGS	2	# BUGS
3		3
		4	+- self.testapp.get_json_filename_of_test(test_id) retorna None quando test_id nao existe.
4	- a revisao do teste não mostra as imagens.	5	- a revisao do teste não mostra as imagens.
5	- se aluno tem teste activo e é allowed uma segunda vez, deve manter o mesmo teste. adicionar opcao para eliminar um teste em curso.	6	- se aluno tem teste activo e é allowed uma segunda vez, deve manter o mesmo teste. adicionar opcao para eliminar um teste em curso.
6	- melhorar o botao de autorizar (desliga-se), usar antes um botao?	7	- melhorar o botao de autorizar (desliga-se), usar antes um botao?