From 92b93fa6bfaa763f2b803fdcac7c751936f599c6 Mon Sep 17 00:00:00 2001
From: Antoine Nguyen <tonio@ngyn.org>
Date: Fri, 29 Nov 2024 14:15:46 +0100
Subject: [PATCH] Deal with password scheme deprecation (crypt as of now)

Also display notifications in new admin.

see #3350
---
 frontend/src/api/admin.js                     |  3 +
 frontend/src/layouts/dashboard/NavBar.vue     | 42 +++++-----
 frontend/src/stores/global.store.js           | 18 +++++
 frontend/src/stores/index.js                  |  1 +
 frontend/src/views/admin/InformationView.vue  | 78 +++++++++++++++++--
 frontend/src/views/admin/ParametersView.vue   |  4 +-
 modoboa/core/api/v2/serializers.py            |  9 +++
 modoboa/core/api/v2/urls.py                   |  5 ++
 modoboa/core/api/v2/views.py                  | 20 +++++
 modoboa/core/checks.py                        |  9 +--
 modoboa/core/handlers.py                      | 37 ++++++---
 modoboa/core/models.py                        | 18 ++++-
 modoboa/core/password_hashers/__init__.py     | 11 ++-
 modoboa/core/templates/core/information.html  | 22 ++++++
 modoboa/core/views/admin.py                   |  8 +-
 modoboa/parameters/tools.py                   |  2 +-
 .../templates/common/top_notifications.html   |  2 +
 17 files changed, 241 insertions(+), 48 deletions(-)
 create mode 100644 frontend/src/stores/global.store.js

diff --git a/frontend/src/api/admin.js b/frontend/src/api/admin.js
index 489345a41..ff2b7b860 100644
--- a/frontend/src/api/admin.js
+++ b/frontend/src/api/admin.js
@@ -4,4 +4,7 @@ export default {
   getComponentsInformation() {
     return repository.get('/admin/components/')
   },
+  getNotifications() {
+    return repository.get('/admin/notifications/')
+  },
 }
diff --git a/frontend/src/layouts/dashboard/NavBar.vue b/frontend/src/layouts/dashboard/NavBar.vue
index a88c1603c..77706a082 100644
--- a/frontend/src/layouts/dashboard/NavBar.vue
+++ b/frontend/src/layouts/dashboard/NavBar.vue
@@ -22,11 +22,10 @@
     </div>
 
     <v-list nav>
-      <template v-for="item in menuItems">
+      <template v-for="item in menuItems" :key="item.text">
         <template v-if="displayMenuItem(item)">
           <v-list-item
             v-if="!item.children"
-            :key="item.text"
             :value="item"
             :to="item.to"
             link
@@ -34,8 +33,11 @@
             :title="item.text"
             :prepend-icon="item.icon"
           >
+            <template v-if="item.withBell && displayInformationBell" #append>
+              <v-icon color="red" icon="mdi-bell-alert-outline" />
+            </template>
           </v-list-item>
-          <v-list-group v-else :key="item.text" :value="item.text">
+          <v-list-group v-else :value="item.text">
             <template #activator="{ props }">
               <v-list-item
                 v-bind="props"
@@ -108,16 +110,15 @@
   </v-navigation-drawer>
 </template>
 
-<script setup lang="js">
+<script setup>
 import { useRoute, useRouter } from 'vue-router'
-import { ref, computed } from 'vue'
+import { ref, computed, onMounted } from 'vue'
 import { useGettext } from 'vue3-gettext'
 import { getActivePinia } from 'pinia'
-
+import { useGlobalStore, useAuthStore, useParametersStore } from '@/stores'
 import parametersApi from '@/api/parameters'
-import { useAuthStore, useParametersStore } from '@/stores'
-import { onMounted } from 'vue'
 
+const globalStore = useGlobalStore()
 const authStore = useAuthStore()
 const parametersStore = useParametersStore()
 const route = useRoute()
@@ -132,7 +133,6 @@ const isAuthenticated = computed(() => authStore.isAuthenticated)
 const backgroundColor = computed(() =>
   route.meta.layout === 'account' ? 'bg-grey-darken-1' : 'bg-primary-darken-1'
 )
-
 const userInitials = computed(() => {
   let initials = null
   if (authUser.value.first_name) {
@@ -170,8 +170,13 @@ const mainColor = computed(() => {
 
 const imapMigration = computed(() => parametersStore.imapMigrationEnabled)
 
-const settings = []
+const displayInformationBell = computed(
+  () =>
+    globalStore.notifications.length !== undefined &&
+    globalStore.notifications.length !== 0
+)
 
+const settings = []
 const mainMenuItems = [
   {
     text: $gettext('Dashboard'),
@@ -246,6 +251,7 @@ const mainMenuItems = [
     text: $gettext('Information'),
     roles: ['SuperAdmins'],
     to: { name: 'Information' },
+    withBell: true,
   },
 ]
 
@@ -318,15 +324,13 @@ onMounted(() => {
         })
       })
     })
-  }
-  if (
-    authUser.value.role === 'SuperAdmins' &&
-    parametersStore.imapMigrationEnabled === null
-  ) {
-    parametersApi.getApplication('imap_migration').then((response) => {
-      parametersStore.imapMigrationEnabled =
-        response.data.params.enabled_imapmigration
-    })
+    globalStore.fetchNotifications()
+    if (parametersStore.imapMigrationEnabled === null) {
+      parametersApi.getApplication('imap_migration').then((response) => {
+        parametersStore.imapMigrationEnabled =
+          response.data.params.enabled_imapmigration
+      })
+    }
   }
 })
 </script>
diff --git a/frontend/src/stores/global.store.js b/frontend/src/stores/global.store.js
new file mode 100644
index 000000000..41f0a22a1
--- /dev/null
+++ b/frontend/src/stores/global.store.js
@@ -0,0 +1,18 @@
+import { ref } from 'vue'
+import { defineStore } from 'pinia'
+import adminApi from '@/api/admin'
+
+export const useGlobalStore = defineStore('global', () => {
+  const notifications = ref([])
+
+  async function fetchNotifications() {
+    const response = await adminApi.getNotifications()
+    notifications.value = response.data
+  }
+
+  function getNotificationById(id) {
+    return notifications.value.find((item) => item.id === id)
+  }
+
+  return { notifications, fetchNotifications, getNotificationById }
+})
diff --git a/frontend/src/stores/index.js b/frontend/src/stores/index.js
index 6759ecca6..bf7f54246 100644
--- a/frontend/src/stores/index.js
+++ b/frontend/src/stores/index.js
@@ -1,5 +1,6 @@
 import { createPinia } from 'pinia'
 
+export * from './global.store'
 export * from './auth.store'
 export * from './bus.store'
 export * from './domains.store'
diff --git a/frontend/src/views/admin/InformationView.vue b/frontend/src/views/admin/InformationView.vue
index 0ec43f3c9..a8aca5404 100644
--- a/frontend/src/views/admin/InformationView.vue
+++ b/frontend/src/views/admin/InformationView.vue
@@ -3,6 +3,72 @@
     <v-toolbar flat>
       <v-toolbar-title>{{ $gettext('Information') }}</v-toolbar-title>
     </v-toolbar>
+    <v-card v-if="globalStore.notifications.length" class="my-6">
+      <v-card-title>
+        {{ $gettext('Important messages') }}
+      </v-card-title>
+
+      <v-card-text>
+        <v-alert
+          v-for="notification in globalStore.notifications"
+          :key="notification.id"
+          :type="notification.level"
+          :title="notification.text"
+          border="start"
+          variant="tonal"
+        >
+          <template v-if="notification.id === 'deprecatedpasswordscheme'">
+            {{
+              $gettext(
+                'The password scheme you are using has been deprecated and will be removed in the next minor version. The procedure to upgrade to a stronger scheme is as follows:'
+              )
+            }}
+            <ol>
+              <li
+                v-html="
+                  $gettext(
+                    'Go to <strong>Settings > General</strong> section',
+                    true
+                  )
+                "
+              ></li>
+              <li
+                v-html="
+                  $gettext(
+                    'Change the value of <strong>Default password scheme</strong>',
+                    true
+                  )
+                "
+              ></li>
+              <li
+                v-html="
+                  $gettext(
+                    'Make sure <strong>Update password scheme at login</strong> option is enabled',
+                    true
+                  )
+                "
+              ></li>
+              <li v-html="$gettext('Save your changes')"></li>
+              <li>
+                {{
+                  $gettext(
+                    'Logout / Login with your current account so its password gets updated'
+                  )
+                }}
+              </li>
+              <li
+                v-html="
+                  $gettext(
+                    'Inform <strong>ALL</strong> your users that they must login to Modoboa to complete the operation',
+                    true
+                  )
+                "
+              ></li>
+            </ol>
+          </template>
+        </v-alert>
+      </v-card-text>
+    </v-card>
     <v-card class="mt-6">
       <v-card-title>
         {{ $gettext('Installed components') }}
@@ -10,10 +76,10 @@
       <v-card-text>
         <v-alert
           v-if="updatesAvailable"
-          variant="outlined"
+          variant="tonal"
           type="success"
           text
-          border="left"
+          border="start"
         >
           <div tag="p">
             {{ $gettext('One or more updates are available') }}
@@ -47,12 +113,14 @@
   </div>
 </template>
 
-<script setup lang="js">
-import { useGettext } from 'vue3-gettext'
-import adminApi from '@/api/admin'
+<script setup>
 import { computed, ref, onMounted } from 'vue'
+import { useGettext } from 'vue3-gettext'
+import { useGlobalStore } from '@/stores'
+import adminApi from '@/api/admin'
 
 const { $gettext } = useGettext()
+const globalStore = useGlobalStore()
 
 const components = ref([])
 const headers = [
diff --git a/frontend/src/views/admin/ParametersView.vue b/frontend/src/views/admin/ParametersView.vue
index c47e49f2f..436e5de27 100644
--- a/frontend/src/views/admin/ParametersView.vue
+++ b/frontend/src/views/admin/ParametersView.vue
@@ -94,10 +94,11 @@ import parametersApi from '@/api/parameters'
 import { ref, computed, watch } from 'vue'
 import { useGettext } from 'vue3-gettext'
 import { useRoute } from 'vue-router'
-import { useParametersStore } from '@/stores'
+import { useGlobalStore, useParametersStore } from '@/stores'
 
 const { $gettext } = useGettext()
 const busStore = useBusStore()
+const globalStore = useGlobalStore()
 const route = useRoute()
 const parametersStore = useParametersStore()
 
@@ -152,6 +153,7 @@ async function save() {
       busStore.displayNotification({
         msg: $gettext('Parameters updated'),
       })
+      globalStore.fetchNotifications()
       if (route.params.app === 'imap_migration') {
         parametersStore.imapMigrationEnabled =
           parameters.value.enabled_imapmigration
diff --git a/modoboa/core/api/v2/serializers.py b/modoboa/core/api/v2/serializers.py
index fe230139b..d0413cd3c 100644
--- a/modoboa/core/api/v2/serializers.py
+++ b/modoboa/core/api/v2/serializers.py
@@ -522,3 +522,12 @@ class ModoboaComponentSerializer(serializers.Serializer):
     description = serializers.CharField()
     update = serializers.BooleanField(default=False)
     changelog_url = serializers.URLField(required=False)
+
+
+class NotificationSerializer(serializers.Serializer):
+    """Serializer used to render a notification."""
+
+    id = serializers.CharField()
+    url = serializers.CharField(required=False)
+    text = serializers.CharField()
+    level = serializers.CharField()
diff --git a/modoboa/core/api/v2/urls.py b/modoboa/core/api/v2/urls.py
index dd6f47cd5..6343380c9 100644
--- a/modoboa/core/api/v2/urls.py
+++ b/modoboa/core/api/v2/urls.py
@@ -32,4 +32,9 @@ urlpatterns += [
         views.ComponentsInformationAPIView.as_view(),
         name="components_information",
     ),
+    path(
+        "admin/notifications/",
+        views.NotificationsAPIView.as_view(),
+        name="notifications",
+    ),
 ]
diff --git a/modoboa/core/api/v2/views.py b/modoboa/core/api/v2/views.py
index 7f3b5ac92..40b2dce4f 100644
--- a/modoboa/core/api/v2/views.py
+++ b/modoboa/core/api/v2/views.py
@@ -1,5 +1,6 @@
 """Core API v2 views."""
 
+from functools import reduce
 import logging
 from smtplib import SMTPException
 
@@ -9,6 +10,7 @@ from drf_spectacular.utils import extend_schema
 from rest_framework import permissions, response
 from rest_framework.views import APIView
 
+from modoboa.core import signals
 from modoboa.core.utils import check_for_updates
 from modoboa.lib.permissions import IsSuperUser
 from modoboa.lib.throttle import (
@@ -141,3 +143,21 @@ class ComponentsInformationAPIView(APIView):
         status, extensions = check_for_updates()
         serializer = serializers.ModoboaComponentSerializer(extensions, many=True)
         return response.Response(serializer.data)
+
+
+class NotificationsAPIView(APIView):
+    """Return list of active notifications."""
+
+    permission_classes = [permissions.IsAuthenticated, IsSuperUser]
+    throttle_classes = [UserLesserDdosUser]
+
+    @extend_schema(responses=serializers.NotificationSerializer(many=True))
+    def get(self, request, *args, **kwargs):
+        notifications = signals.get_top_notifications.send(
+            sender="top_notifications", include_all=False
+        )
+        notifications = reduce(
+            lambda a, b: a + b, [notif[1] for notif in notifications]
+        )
+        serializer = serializers.NotificationSerializer(notifications, many=True)
+        return response.Response(serializer.data)
diff --git a/modoboa/core/checks.py b/modoboa/core/checks.py
index a8977339f..79c229c93 100644
--- a/modoboa/core/checks.py
+++ b/modoboa/core/checks.py
@@ -2,9 +2,9 @@ from django.core.checks import register, Info, Warning
 from django.conf import settings
 from django.utils.translation import gettext as _
 
+from modoboa.core.models import User
+from modoboa.core.password_hashers import get_configured_password_hasher
 from modoboa.core.utils import generate_rsa_private_key
-from modoboa.parameters.tools import get_global_parameter
-from modoboa.core.password_hashers import get_password_hasher
 
 W001 = Warning(
     _(
@@ -49,8 +49,7 @@ def check_rsa_private_key_exists(app_configs, **kwargs):
 @register()
 def check_password_hasher(app_configs, **kwargs):
     msgs = []
-    scheme_in_use = get_global_parameter("password_scheme", app="core")
-    hasher = get_password_hasher(scheme_in_use)
-    if hasher.deprecated:
+    hasher = get_configured_password_hasher()
+    if hasher.deprecated or User.objects.is_password_scheme_in_use(hasher):
         msgs.append(W002)
     return msgs
diff --git a/modoboa/core/handlers.py b/modoboa/core/handlers.py
index 7c4fe6584..ac8334c27 100644
--- a/modoboa/core/handlers.py
+++ b/modoboa/core/handlers.py
@@ -12,6 +12,7 @@ from django.urls import reverse
 from django.utils.encoding import smart_str
 from django.utils.translation import gettext as _
 
+from modoboa.core.password_hashers import get_configured_password_hasher
 from modoboa.lib import exceptions, permissions
 from modoboa.lib.signals import get_request
 from . import models, signals as core_signals, utils
@@ -113,19 +114,33 @@ def update_permissions(sender, instance, **kwargs):
 
 
 @receiver(core_signals.get_top_notifications)
-def check_for_new_versions(sender, include_all, **kwargs):
+def check_for_new_versions(sender, include_all: bool, **kwargs) -> list:
     """Check if new versions are available."""
     request = get_request()
     if not request.user.is_superuser:
         return []
+    result = []
     status, extensions = utils.check_for_updates()
-    if not status:
-        return [{"id": "newversionavailable"}] if include_all else []
-    return [
-        {
-            "id": "newversionavailable",
-            "url": reverse("core:index") + "#info/",
-            "text": _("One or more updates are available"),
-            "level": "info",
-        }
-    ]
+    if status:
+        result += [
+            {
+                "id": "newversionavailable",
+                "url": reverse("core:index") + "#info/",
+                "text": _("One or more updates are available"),
+                "level": "info",
+            }
+        ]
+    elif include_all:
+        result += [{"id": "newversionavailable"}]
+    hasher = get_configured_password_hasher()
+    if hasher.deprecated or models.User.objects.is_password_scheme_in_use(hasher):
+        result += [
+            {
+                "id": "deprecatedpasswordscheme",
+                "url": reverse("core:index") + "#info/",
+                "text": _("You are using a deprecated password scheme (%s)")
+                % hasher.name,
+                "level": "warning",
+            }
+        ]
+    return result
diff --git a/modoboa/core/models.py b/modoboa/core/models.py
index a9595c719..9999b84b8 100644
--- a/modoboa/core/models.py
+++ b/modoboa/core/models.py
@@ -12,14 +12,14 @@ from django.utils.encoding import force_str, smart_bytes, smart_str
 from django.utils.functional import cached_property
 from django.utils.translation import gettext as _, gettext_lazy
 
-from django.contrib.auth.models import AbstractUser, Group
+from django.contrib.auth.models import AbstractUser, BaseUserManager, Group
 from django.contrib.contenttypes.fields import GenericForeignKey
 from django.contrib.contenttypes.models import ContentType
 
 from phonenumber_field.modelfields import PhoneNumberField
 from reversion import revisions as reversion
 
-from modoboa.core.password_hashers import get_password_hasher
+from modoboa.core.password_hashers import get_password_hasher, PasswordHasher
 from modoboa.lib.exceptions import (
     BadRequest,
     Conflict,
@@ -41,6 +41,18 @@ def get_default_language() -> str:
     return settings.LANGUAGE_CODE
 
 
+class UserManager(BaseUserManager):
+    """Custom manager for User."""
+
+    def is_password_scheme_in_use(self, password_hasher: PasswordHasher) -> bool:
+        """Check if given password scheme is still in use."""
+        return (
+            self.get_queryset()
+            .filter(password__startswith=password_hasher.scheme)
+            .exists()
+        )
+
+
 class User(AbstractUser):
     """Custom User model.
 
@@ -92,6 +104,8 @@ class User(AbstractUser):
 
     password_expr = re.compile(r"\{([\w\-]+)\}(.+)")
 
+    objects = UserManager()
+
     def __init__(self, *args, **kwargs):
         """Load parameter manager."""
         super().__init__(*args, **kwargs)
diff --git a/modoboa/core/password_hashers/__init__.py b/modoboa/core/password_hashers/__init__.py
index 560c43ef4..7f644d10d 100644
--- a/modoboa/core/password_hashers/__init__.py
+++ b/modoboa/core/password_hashers/__init__.py
@@ -1,6 +1,4 @@
-"""
-Password hashers for Modoboa.
-"""
+"""Password hashers for Modoboa."""
 
 from modoboa.core.password_hashers.advanced import (  # NOQA:F401
     BLFCRYPTHasher,
@@ -17,6 +15,7 @@ from modoboa.core.password_hashers.base import (  # NOQA:F401
     SHA256Hasher,
     PasswordHasher,
 )
+from modoboa.parameters import tools as param_tools
 
 
 def get_password_hasher(scheme: str) -> PasswordHasher:
@@ -34,3 +33,9 @@ def get_password_hasher(scheme: str) -> PasswordHasher:
     except KeyError:
         hasher = PLAINHasher
     return hasher
+
+
+def get_configured_password_hasher() -> PasswordHasher:
+    """Retrieve the password hasher class currently configured."""
+    scheme = param_tools.get_global_parameter("password_scheme")
+    return get_password_hasher(scheme)
diff --git a/modoboa/core/templates/core/information.html b/modoboa/core/templates/core/information.html
index dd154822b..1b2d96d82 100644
--- a/modoboa/core/templates/core/information.html
+++ b/modoboa/core/templates/core/information.html
@@ -1,5 +1,27 @@
 {% load i18n core_tags lib_tags %}
 <h2>{% trans "Information" %} <small>{% trans "Various information about Modoboa" %}</small></h2><hr>
+{% if password_hasher.deprecated or password_hasher_in_use %}
+  <div class="alert alert-block alert-warning">
+    <h4>{% trans "You are using a deprecated password scheme!" %}</h4>
+    <p>{% blocktranslate trimmed %}
+      The password scheme <strong>{{ scheme }}</strong> has been
+      deprecated and will be removed in the next minor version. The procedure to upgrade to a stronger scheme is as follows:
+      <ul>
+        <li>Go to <strong>Parameters > General</strong> section</li>
+        <li>Change the value of <strong>Default password scheme</strong></li>
+        <li>Make sure <strong>Update password scheme at login</strong> option is enabled</li>
+        <li>Save your changes</li>
+        <li>Logout / Login with your current account so its password gets updated</li>
+        <li>Inform <strong>ALL</strong> your users that they must login to Modoboa to complete the operation</li>
+      </ul>
+    {% endblocktranslate %}</p>
+    <p>{% blocktranslate trimmed %}
+      You must apply this procedure <strong>BEFORE</strong> you install a newest
+      version of Modoboa, otherwise <strong>you will be unable to connect to
+      the web interface anymore</strong>.
+    {% endblocktranslate %}</p>
+  </div>
+{% endif %}
 {% if update_avail %}
 <div class="alert alert-block alert-success">
   <h4>{% trans "One or more updates are available!" %}</h4>
diff --git a/modoboa/core/views/admin.py b/modoboa/core/views/admin.py
index 7cd2bb21b..64559744e 100644
--- a/modoboa/core/views/admin.py
+++ b/modoboa/core/views/admin.py
@@ -7,7 +7,8 @@ from django.shortcuts import render
 from django.template.loader import render_to_string
 from django.utils.translation import gettext as _
 
-from modoboa.core.models import Log
+from modoboa.core.models import Log, User
+from modoboa.core.password_hashers import get_configured_password_hasher
 from modoboa.core.utils import check_for_updates
 from modoboa.lib.listing import get_listing_page, get_sort_order
 from modoboa.lib.web_utils import render_to_json_response
@@ -60,6 +61,8 @@ def parameters(request, tplname="core/parameters.html"):
 @user_passes_test(lambda u: u.is_superuser)
 def information(request, tplname="core/information.html"):
     status, extensions = check_for_updates()
+    hasher = get_configured_password_hasher()
+    password_hasher_in_use = User.objects.is_password_scheme_in_use(hasher)
     return render_to_json_response(
         {
             "content": render_to_string(
@@ -67,6 +70,9 @@ def information(request, tplname="core/information.html"):
                 {
                     "update_avail": status,
                     "extensions": extensions,
+                    "password_hasher": hasher,
+                    "password_hasher_in_use": password_hasher_in_use,
+                    "scheme": hasher.name,
                 },
             ),
         }
diff --git a/modoboa/parameters/tools.py b/modoboa/parameters/tools.py
index 69629fbc5..5cade577b 100644
--- a/modoboa/parameters/tools.py
+++ b/modoboa/parameters/tools.py
@@ -21,7 +21,7 @@ class NotDefined(exceptions.ModoboaException):
         return "Parameter {} not defined for app {}".format(self.name, self.app)
 
 
-class Registry(object):
+class Registry:
     """A registry for parameters."""
 
     def __init__(self):
diff --git a/modoboa/templates/common/top_notifications.html b/modoboa/templates/common/top_notifications.html
index ebd0f52fe..72310b7e9 100644
--- a/modoboa/templates/common/top_notifications.html
+++ b/modoboa/templates/common/top_notifications.html
@@ -9,6 +9,8 @@
         <a id="{{ notification.id }}" href="{{ notification.url }}">
           {% if notification.counter %}
           <span class="label label-{{ notification.level }}"> {{ notification.counter }}</span> {{ notification.text|safe }}
+          {% elif notification.level == 'warning' %}
+          <span class="fa fa-warning"></span> {{ notification.text|safe }}
           {% else %}
           <span class="fa fa-info-circle"></span> {{ notification.text|safe }}
           {% endif %}