diff --git a/pyweb/mumble/views.py b/pyweb/mumble/views.py index f306b4e..c047fab 100644 --- a/pyweb/mumble/views.py +++ b/pyweb/mumble/views.py @@ -88,9 +88,14 @@ def show( request, server ): # Unregistered users may or may not need a password to register. if settings.PROTECTED_MODE and srv.passwd: unregged_user_form = MumbleUserPasswordForm; + # Unregistered users may or may not want to link an existing account + elif settings.ALLOW_ACCOUNT_LINKING: + unregged_user_form = MumbleLinkForm; else: unregged_user_form = MumbleUserForm; + + if request.method == 'POST' and 'mode' in request.POST and request.POST['mode'] == 'reg': try: user = MumbleUser.objects.get( server=srv, owner=request.user ); @@ -98,6 +103,9 @@ def show( request, server ): regform = unregged_user_form( request.POST ); regform.server = srv; if regform.is_valid(): + # TODO: Check if LinkAcc is True, if yes: + # find MumbleUser with mumbleid=regform.mumbleid, + # if not exists create, save(). model = regform.save( commit=False ); model.isAdmin = False; model.server = srv; diff --git a/pyweb/settings.py b/pyweb/settings.py index d53e214..c1b7886 100644 --- a/pyweb/settings.py +++ b/pyweb/settings.py @@ -86,9 +86,22 @@ MUMBLE_DEFAULT_PORT = 64738 SHOW_EMPTY_SUBCHANS = False # Protect the registration form for private servers? -# If set to True, people will need to enter the server password in order to create accounts. +# If set to True, people will need to enter the server password in order to create accounts, +# and will not be able to link existing accounts. PROTECTED_MODE = False +# Account linking allows users who registered their accounts through Mumble instead of using +# Mumble-Django, to tell MD that this account belongs to them. Then they can use MD to change +# their passwords. +# This will of course require them to enter the password that belongs to the Murmur account, +# and the accounts will only be linked if the password is correct. +# By default, this is enabled only for non-admin accounts, because if an admin account gets +# stolen they could easily take over the server. (So make sure the password can't be easily +# guessed, use at least over 9000 letters, blah blah.) +# This feature is only available if PROTECTED_MODE is not active. +ALLOW_ACCOUNT_LINKING = False # Allow linking in general? +ALLOW_ACCOUNT_LINKING_ADMINS = False # Allow linking for Admin accounts? + # Database settings for Mumble-Django's database. These do NOT need to point to Murmur's database, # Mumble-Django should use its own! DATABASE_ENGINE = 'sqlite3'