From ab5b8d96c304ad766fab7ee0b33527f408298ae6 Mon Sep 17 00:00:00 2001
From: tonio <devnull@localhost>
Date: Fri, 27 Mar 2009 09:25:09 +0100
Subject: [PATCH] Authentication mechanism changed. I don't use Django's
 builtin passwords encryption anymore because the default format is something
 like : <algo>$<salt>$<password> I really think this format is not compatible
 with external softwares so I use simple hashes.

---
 INSTALL             | 27 ++++++++++++++++++++++++++-
 admin/models.py     |  1 +
 admin/views.py      |  5 ++++-
 lib/authbackends.py | 23 +++++++++++++++++++++++
 settings_sample.py  |  5 +++++
 5 files changed, 59 insertions(+), 2 deletions(-)
 create mode 100644 lib/authbackends.py

diff --git a/INSTALL b/INSTALL
index d08852459..e1f0d1fa9 100644
--- a/INSTALL
+++ b/INSTALL
@@ -11,6 +11,7 @@ How to install
 --------------
 
 Download Mailng's tarball and extract it::
+
   tar xzf mailng-<version>.tar.gz
 
 Enter the mailng directory, create a settings.py file (you can use 
@@ -19,15 +20,39 @@ must choose between mysql and postgresql, other types are not supported by
 major email projects like postfix or dovecot.
 
 Initialise the database by running the following command::
+
   python manage.py syncdb
 
 Create the super admin account (just follow the procedure).
 
+Host configuration
+------------------
+
+Before testing Mailng, you must create a group and a user that will be
+used to store mails on the host filesystem. There is only one
+group/user needed because we are in a virtual hosting configuration
+(ie. users with non-UNIX accounts).
+
+For example, create a vmail group::
+
+  groupadd vmail
+
+Then create a vmail user::
+
+  useradd -g vmail -d /var/vmail -m vmail
+
+At last, the system user used to run mailng will need permissions to
+manipulate directories in vmail's homedir. To do that, edit your /etc/sudoers
+file and add the following inside::
+
+  www-data ALL=(vmail) NOPASSWD: ALL
+
 Testing installation
 --------------------
 
 As a typical Django application, Mailng can be tested using a simple web 
 server. Just run this command to start it::
+
   python manage.py runserver
 
 You will be able to play with mailng by looking at 
@@ -105,6 +130,6 @@ Then, edit your /etc/dovecot/dovecot-sql.conf and modify following lines::
 
   driver = mysql
   connect = host=<mysqld socket> dbname=<database> user=<user> password=<password>
-  default_pass_scheme = MD5
+  default_pass_scheme = PLAIN-MD5
   password_query = SELECT address as user, password FROM admin_mailbox WHERE full_address = '%u'
   user_query = SELECT path as home, uid, gid FROM admin_mailbox WHERE full_address = '%u'
diff --git a/admin/models.py b/admin/models.py
index 39a21e2a6..a4e6988dd 100644
--- a/admin/models.py
+++ b/admin/models.py
@@ -40,6 +40,7 @@ class Mailbox(models.Model):
     name = models.CharField(max_length=100)
     address = models.CharField(max_length=100)
     full_address = models.CharField(max_length=150)
+    password = models.CharField(max_length=100)
     quota = models.IntegerField()
     uid = models.IntegerField()
     gid = models.IntegerField()
diff --git a/admin/views.py b/admin/views.py
index a3b3c8aed..f7564c131 100644
--- a/admin/views.py
+++ b/admin/views.py
@@ -10,6 +10,7 @@ from django.contrib.auth.models import User
 from mailng import admin
 from mailng.admin.models import Domain, Mailbox, Alias
 from forms import MailboxForm, DomainForm, AliasForm
+import md5
 
 def _ctx_ok(url):
     return {"status" : "ok", "url" : url}
@@ -114,7 +115,8 @@ def newmailbox(request, dom_id=None):
                 if mb.create_dir(domain):
                     user = User()
                     user.username = user.email = "%s@%s" % (mb.address, domain.name)
-                    user.set_password(request.POST["password1"])
+#                    user.set_password(request.POST["password1"])
+                    user.set_unusable_password()
                     user.is_active = request.POST.has_key("enabled") \
                         and True or False
                     fname, lname = mb.name.split()
@@ -123,6 +125,7 @@ def newmailbox(request, dom_id=None):
                     user.save()
                     mb.user = user
                  
+                    mb.password = md5.new(request.POST["password1"]).hexdigest()
                     mb.uid = mb.gid = 500
                     mb.domain = domain
                     mb.quota = request.POST["quota"]
diff --git a/lib/authbackends.py b/lib/authbackends.py
new file mode 100644
index 000000000..877abadb3
--- /dev/null
+++ b/lib/authbackends.py
@@ -0,0 +1,23 @@
+from django.contrib.auth.models import User
+from mailng.admin.models import Mailbox
+import md5
+
+class SimpleBackend:
+    def authenticate(self, username=None, password=None):
+        try:
+            user = User.objects.get(username=username)
+        except User.DoesNotExist:
+            return None
+        try:
+            mb = Mailbox.objects.get(full_address=username)
+        except Exception:
+            return None
+        if mb.password != md5.new(password).hexdigest():
+            return None
+        return user
+
+    def get_user(self, user_id):
+        try:
+            return User.objects.get(pk=user_id)
+        except User.DoesNotExist:
+            return None
diff --git a/settings_sample.py b/settings_sample.py
index 55ff3800b..7c2b2931d 100644
--- a/settings_sample.py
+++ b/settings_sample.py
@@ -81,6 +81,11 @@ INSTALLED_APPS = (
     'mailng.admin'
 )
 
+AUTHENTICATION_BACKENDS = (
+    'django.contrib.auth.backends.ModelBackend',
+    'mailng.lib.authbackends.SimpleBackend'
+)
+
 # Mailng specific options
 STORAGE_PATH = "/var/vmail"
 VIRTUAL_UID = "vmail"