passwordless account creation

passwordless account creation

[Thomas.J.Waldmann, 2013-03-10 14:46:57]

https://codereview.appspot.com/7685043/diff/1/MoinMoin/action/newaccount.py
File MoinMoin/action/newaccount.py (right):

https://codereview.appspot.com/7685043/diff/1/MoinMoin/action/newaccount.py#n...
MoinMoin/action/newaccount.py:55: 
The whole point of this changeset is that e.g. a secretary of a company or
organisation can set up accounts for new users (maybe also adding them to ACL
groups at the same time). It is assumed that the secretary uses the web
interface of moin.

Without this changeset, the secretary would need to enter some password for the
new user.

With this changeset, this is not needed any more and it'll even send a
notification email to the new created user.

https://codereview.appspot.com/7685043/diff/1/MoinMoin/action/newaccount.py#n...
MoinMoin/action/newaccount.py:68: return "Can't encode password: %s" %
wikiutil.escape(str(err))
line 57..68 are just indentation changes.
password only needs checking / encoding if there really IS a password.

https://codereview.appspot.com/7685043/diff/1/MoinMoin/action/newaccount.py#n...
MoinMoin/action/newaccount.py:98: result += _("No password set, only password
recovery will work!")
a bit of a pain is that this changeset needs to change i18ned strings, so we
need to wait for translators... :|

[ReimarBauer, 2013-03-12 21:48:19]

some comments

https://codereview.appspot.com/7685043/diff/1/MoinMoin/action/newaccount.py
File MoinMoin/action/newaccount.py (right):

https://codereview.appspot.com/7685043/diff/1/MoinMoin/action/newaccount.py#n...
MoinMoin/action/newaccount.py:86: # save data
I'm not sure if we should save with an invalid password hash because we don't
approve email but may be send also to mistaken written mail addresses. Sure it
makes this workflow of preparing accounts easier. 

If there is no good textcha's enabled it can be misused by creating accounts
with an invalid hash. We may identify those easier. Not sure if someone uses it
for sending nonsense mails. Needs more steps currently.

https://codereview.appspot.com/7685043/diff/1/MoinMoin/action/newaccount.py#n...
MoinMoin/action/newaccount.py:92: mailok, msg = theuser.mailAccountData()
We have to check that mail is configured.

https://codereview.appspot.com/7685043/diff/1/MoinMoin/action/newaccount.py#n...
MoinMoin/action/newaccount.py:94: result += ' '
we should do u' '

https://codereview.appspot.com/7685043/diff/1/MoinMoin/action/newaccount.py#n...
MoinMoin/action/newaccount.py:165: td.append(html.INPUT(type="submit",
name="create_mail",
We can only send mail if it is configured. The button should be dependent on
that. Lots of the UI action check for this feature

[Thomas.J.Waldmann, 2013-03-14 12:49:59]

https://codereview.appspot.com/7685043/diff/1/MoinMoin/action/newaccount.py
File MoinMoin/action/newaccount.py (right):

https://codereview.appspot.com/7685043/diff/1/MoinMoin/action/newaccount.py#n...
MoinMoin/action/newaccount.py:86: # save data
a wrong email address is easily found in this scenario as the user won't get an
email and the account won't work as no recovery is possible. user will complain,
account will get fixed.


> If there is no good textcha's enabled it can be
> misused by creating accounts with an invalid hash.

That's no way different from the situation before this patch.

Hmm, except that you can send password reset mails to the entered e-mail
address.

> Not sure if someone uses it
> for sending nonsense mails.

Yeah, spambots pressing all sorts of buttons, inserting fake or stolen e-mail
addresses, that's likely the biggest problem.

https://codereview.appspot.com/7685043/diff/1/MoinMoin/action/newaccount.py#n...
MoinMoin/action/newaccount.py:92: mailok, msg = theuser.mailAccountData()
Correct. Maybe I was assuming that the called code is doing that.

https://codereview.appspot.com/7685043/diff/1/MoinMoin/action/newaccount.py#n...
MoinMoin/action/newaccount.py:94: result += ' '
OK.

https://codereview.appspot.com/7685043/diff/1/MoinMoin/action/newaccount.py#n...
MoinMoin/action/newaccount.py:165: td.append(html.INPUT(type="submit",
name="create_mail",
OK.