settings view tested for user + db fkey modifications

app/app/dao/user/user.py

@@ -32,7 +32,7 @@ def update_name(cur, old_name, new_name):
     WHERE
         name = %s
     """
-    cur.execute(query, (new_name,))
+    cur.execute(query, (new_name,old_name))
     return (True,)
 
 @with_psql
@@ -43,7 +43,7 @@ def update_password(cur, name, password):
     WHERE
         name = %s
     """
-    cur.execute(query, (password, name))
+    cur.execute(query, (bcrypt.hashpw(password, bcrypt.gensalt()).decode('utf-8'), name))
     return (True,)
 
 @with_psql

app/app/templates/layout.html

@@ -25,8 +25,10 @@
 					<li><a href="/">Home</a></li>
 					{% if not session['name'] %}
 					<li><a href="/login">Login</a></li>
+						{% if users_signup %}
         	    			<li><a href="/signup">Signup</a></li>
 						{% endif %}
+					{% endif %}
 	         		</ul>
 				{% if session['name'] %}
 				<ul class="nav navbar-nav navbar-right">

app/app/templates/public/settings.html

+{% extends 'layout.html' %}
+
+{% block title %} Settings {{ username }} {% endblock %}
+
+{% block content %}
+
+<div class="row">
+	<div class="col-md-3">
+		<div class="clickback">
+			<span class="glyphicon glyphicon-arrow-left"></span>	
+			<p><a class="backlink" onclick="history.back(-1)"></a></p>
+		</div>
+	</div>
+
+		<div class="col-md-6">
+			<div class="panel panel-primary">
+				<div class="panel-heading">
+					<h2><center> Settings {{ username }}: </center></h2>
+				</div>
+				<div class="panel-body">
+					<form class="form-inline" action="settings" method="post">
+						<table class="table">
+							<tr>
+								<td>
+									<label for="name">Name</label>
+								</td>
+								<td>
+									<input type="text" class="form-control" id="name" name="name" value="{{ username }}">
+								</td>
+							</tr>
+							<tr>
+								<td>
+									<label for="name">Password</label>
+								</td>
+								<td>
+									<input type="password" class="form-control" id="password" name="password" placeholder="Password">
+								</td>
+							</tr>
+						</table>
+						<button type="submit" class="btn btn-default">Save</button>
+					</form>
+				</div>
+			</div>
+		</div>	
+	</div>
+</div>
+
+{% endblock %}
+

app/app/views.py

@@ -42,8 +42,12 @@ def signup():
         if session['role'] and session['role'] == 'admin':
             return render_template('admin/signup.html')
         else:
+            if app.config['USERS_SIGNUP']:
                 return render_template('public/signup.html')
             else:
+                return redirect(url_for('index'))
+    else:
+        if app.config['USERS_SIGNUP'] or session['role'] == 'admin':
             username = request.form['username']
             password = request.form['password'].encode('utf-8')
             
@@ -71,7 +75,8 @@ def signup():
                         return redirect(url_for('dashboard'))
                     else:
                         return redirect(url_for('index'))
-
+        else:
+            return redirect(url_for('index'))
 
 
 @app.route('/login', methods=['GET', 'POST'])
@@ -435,5 +440,30 @@ def user_delete():
         flash('Warning: the user is admin or does not exist.' ,'warning')
         return redirect(url_for('index'))
 
+@app.route('/settings', methods=['GET', 'POST'])
+def settings():
+    if request.method == 'GET':
+        if session['role'] == 'admin':
+            return render_template('public/settings.html', username=session['name'])
+        else:
+            return render_template('public/settings.html', username=session['name'])
+    else:
+        if request.form['name'] != session['name']:
+            res = ud.update_name(session['name'], request.form['name'])
+            if not res[0]:
+                flash('Error: {}'.format(res[1]), 'danger')
+                return redirect(request.url);
+            else:
+                session['name'] = request.form['name']
+        if request.form['password'] != '':
+            res = ud.update_password(session['name'], request.form['password'].encode('utf-8'))
+            if not res[0]:
+                flash('Error: {}'.format(res[1]), 'danger')
+                return redirect(request.url);
+
+
+        return redirect(url_for('index'))
+
+
 def pend_delete_all_ack():
     pend.delete_all_ack()

app/config.py

@@ -20,6 +20,9 @@ class Config(object):
     # in minutes - 24 hours by default
     MAINTAINER_INTERVAL = 1440
 
+    # manual user signup by default
+    USERS_SIGNUP = False
+
 class ProductionConfig(Config):
     pass