Reputation: 918
This is a multi-part question, I have been working on a blog with Google App Engine, and to facilitate this I have created a datastore class for the blog containing the subject and text. I wanted to practice implementing user registration and therefore created another class for the users containing the username, password hash, email and date created
These two classes create entities on the app engine and show up on the dashboard, but my Users table(Since its a NoSql implementation I'm not sure what to call this) does not show up on my local devserver dashboard
When I am running a query on the Users table it is returning true even if the username has never been registered.
I have also implemented a login feature which always returns the message the the username or password is invalid, which of course has to come up only when they are invalid which I know they are not when I enter them.
This is my code for the datastore entities
class Blog(db.Model):
subject = db.StringProperty(required = True)
blog = db.TextProperty(required = True)
time_created = db.DateTimeProperty(auto_now_add = True)
day_created = db.DateProperty(auto_now_add = True)
class Users(db.Model):
username = db.StringProperty(required = True)
pw_hash = db.StringProperty(required = True)
emai = db.StringProperty()
user_since = db.DateTimeProperty(auto_now_add = True)
@classmethod
def by_id(cls, uid):
return Users.get_by_id(uid)
@classmethod
def by_name(cls, name):
user = Users.all().filter('name = ', name).get()
return user
@classmethod
def register(cls, name, pw, email = None):
pw_h = make_pw_h(name, pw)
return Users(username = name,
pw_hash = pw_h,
email = email)
@classmethod
def login(cls, name, pw):
u = cls.by_name(name)
if u and check_pw(pw):
return u
This is the function that registers a new user
class Signup(BaseHandler):
def get(self):
self.render("signup-form.html")
def post(self):
have_error = False
self.username = self.request.get('username')
self.password = self.request.get('password')
self.verify = self.request.get('verify')
self.email = self.request.get('email')
params = dict(username = self.username,
email = self.email)
if not valid_username(self.username):
params['error_username'] = "That's not a valid username."
have_error = True
if not valid_password(self.password):
params['error_password'] = "That wasn't a valid password."
have_error = True
elif self.password != self.verify:
params['error_verify'] = "Your passwords didn't match."
have_error = True
if not valid_email(self.email):
params['error_email'] = "That's not a valid email."
have_error = True
if have_error:
self.render('signup-form.html', **params)
else:
u = db.GqlQuery("SELECT username FROM Users WHERE username='self.username'")
if u:
msg = "User already exists"
self.render('signup-form.html', error_username = msg)
else:
sing_user = Users.register(self.username, self.password, self.email)
sing_user.put()
#self.login(sing_user)
self.set_sec_coki('user-id', sing_user.key().id())
self.redirect('/welcome')
This is the function that Logs a user in
class Login(BlogHandler):
def get(self):
self.render('login-form.html')
def post(self):
username = self.request.get('username')
password = self.request.get('password')
u = User.login(username, password)
if u:
self.login(u)
self.redirect('/blog')
else:
msg = 'Invalid login'
self.render('login-form.html', error = msg)
This is my BaseHandler function which inherits the webapp2 class
class BaseHandler(webapp2.RequestHandler):
def render(self, template, **kw):
self.response.out.write(render_str(template, **kw))
def write(self, *a, **kw):
self.response.out.write(*a, **kw)
def set_sec_coki(self, name, val):
sec_val = make_secure_val(str(val))
self.response.headers.add_header('Set-Cookie', "%s=%s; Path=/" % (name,sec_val))
def read_secure_cookie(self, name):
cookie_val = self.request.cookies.get(name)
return cookie_val and check_secure_val(cookie_val)
def login(self, user):
self.set_secure_cookie('user_id', str(user.key().id()))
def logout(self):
self.response.headers.add_header('Set-Cookie', 'user_id=; Path=/')
And these are the smaller functions that I use to hash and salt cookies and passwords
def make_secure_val(val):
return '%s|%s' % (val, hmac.new(secret, val).hexdigest())
def check_secure_val(sec_val):
val = sec_val.split('|')[0]
if sec_val == make_secure_val(val):
return val
def make_salt():
chars = string.ascii_uppercase + string.ascii_lowercase + string.digits
return ''.join(random.choice(chars) for x in range(5))
def make_pw_h(name, pw, salt = None):
if salt is None:
salt = make_salt()
return "%s,%s" % (salt, hashlib.sha256(name + pw + salt).hexdigest())
def check_pw_h(name, pw, h):
h = h.split(',')[1]
return h == make_pw_h(name, pw, h)
Upvotes: 1
Views: 86
Reputation: 2265
Your query for getting user is wrong:
This:
u = db.GqlQuery("SELECT username FROM Users WHERE username='self.username'")
should change to something like this:
u = db.GqlQuery("SELECT username FROM Users WHERE username = :1", self.username)
Take a look at the docs
Upvotes: 1