Merge pull request #533 from GreatFruitOmsk/resolve-pr-495

Resolve pr 495

.travis.yml

@@ -6,6 +6,7 @@ addons:
     packages:
       - net-tools
       - mplayer
+      - python-setuptools
 install:
   - pip install -U pip
   - pip install -r requirements.txt

ansible/roles/screenly/files/screenly.conf

@@ -23,3 +23,8 @@ debug_logging = False
 
 ; Only display pages with proper SSL certificates
 verify_ssl = True
+
+[auth]
+; If desired, fill in with appropriate username and password.
+user=
+password=

requirements.dev.txt

@@ -2,4 +2,5 @@ nose==1.2.1
 mock==1.0.1
 pep8==1.7.0
 selenium==2.53.6
+setuptools==34.4.0
 splinter==0.7.4

server.py

@@ -33,7 +33,7 @@ from lib.utils import url_fails
 from lib.utils import get_video_duration
 from dateutil import parser as date_parser
 
-from settings import settings, DEFAULTS, CONFIGURABLE_SETTINGS
+from settings import settings, DEFAULTS, CONFIGURABLE_SETTINGS, auth_basic
 from werkzeug.wrappers import Request
 ################################
 # Utilities
@@ -199,6 +199,7 @@ def prepare_asset(request):
 
 
 @route('/api/assets', method="GET")
+@auth_basic
 def api_assets():
     with db.conn(settings['database']) as conn:
         assets = assets_helper.read(conn)
@@ -220,6 +221,7 @@ def api(view):
 
 
 @route('/api/assets', method="POST")
+@auth_basic
 @api
 def add_asset():
     asset = prepare_asset(request)
@@ -230,6 +232,7 @@ def add_asset():
 
 
 @route('/api/assets/:asset_id', method="GET")
+@auth_basic
 @api
 def edit_asset(asset_id):
     with db.conn(settings['database']) as conn:
@@ -237,6 +240,7 @@ def edit_asset(asset_id):
 
 
 @route('/api/assets/:asset_id', method=["PUT", "POST"])
+@auth_basic
 @api
 def edit_asset(asset_id):
     with db.conn(settings['database']) as conn:
@@ -244,6 +248,7 @@ def edit_asset(asset_id):
 
 
 @route('/api/assets/:asset_id', method="DELETE")
+@auth_basic
 @api
 def remove_asset(asset_id):
     with db.conn(settings['database']) as conn:
@@ -258,6 +263,7 @@ def remove_asset(asset_id):
 
 
 @route('/api/assets/order', method="POST")
+@auth_basic
 @api
 def playlist_order():
     with db.conn(settings['database']) as conn:
@@ -270,11 +276,13 @@ def playlist_order():
 
 
 @route('/')
+@auth_basic
 def viewIndex():
     return template('index')
 
 
 @route('/settings', method=["GET", "POST"])
+@auth_basic
 def settings_page():
 
     context = {'flash': None}
@@ -302,6 +310,7 @@ def settings_page():
 
 
 @route('/system_info')
+@auth_basic
 def system_info():
     viewlog = None
     try:

settings.py

@@ -6,6 +6,7 @@ from sys import exit
 import ConfigParser
 import logging
 from UserDict import IterableUserDict
+import bottle
 
 CONFIG_DIR = '.screenly/'
 CONFIG_FILE = 'screenly.conf'
@@ -24,6 +25,10 @@ DEFAULTS = {
         'default_duration': '10',
         'debug_logging': False,
         'verify_ssl': True,
+    },
+    'auth': {
+        'user': '',
+        'password': ''
     }
 }
 CONFIGURABLE_SETTINGS = DEFAULTS['viewer']
@@ -115,4 +120,16 @@ class ScreenlySettings(IterableUserDict):
     def get_listen_port(self):
         return self['listen'].split(':')[1]
 
+    def check_user(self, user, password):
+        if not self['user'] or not self['password']:
+            logging.debug('Username or password not configured: skip authentication')
+            return True
+
+        return self['user'] == user and self['password'] == password
+
+
 settings = ScreenlySettings()
+
+
+def auth_basic(orig):
+    return orig if not settings['user'] or not settings['password'] else bottle.auth_basic(settings.check_user)(orig)

tests/splinter_test.py

@@ -33,6 +33,10 @@ asset_y = {
     'play_order': 0,
 }
 
+main_page_url = 'http://foo:bar@localhost:8080'
+settings_url = 'http://foo:bar@localhost:8080/settings'
+system_info_url = 'http://foo:bar@localhost:8080/system_info'
+
 
 def wait_for_and_do(browser, query, callback):
     not_filled = True
@@ -60,7 +64,7 @@ class WebTest(unittest.TestCase):
 
     def test_add_asset_url(self):
         with Browser() as browser:
-            browser.visit('http://localhost:8080')
+            browser.visit(main_page_url)
 
             wait_for_and_do(browser, '#add-asset-button', lambda btn: btn.click())
             sleep(1)
@@ -89,7 +93,7 @@ class WebTest(unittest.TestCase):
             assets_helper.create(conn, asset_x)
 
         with Browser() as browser:
-            browser.visit('http://localhost:8080')
+            browser.visit(main_page_url)
             wait_for_and_do(browser, '.edit-asset-button', lambda btn: btn.click())
             sleep(1)
 
@@ -114,7 +118,7 @@ class WebTest(unittest.TestCase):
         image_file = '/tmp/image.png'
 
         with Browser() as browser:
-            browser.visit('http://localhost:8080')
+            browser.visit(main_page_url)
 
             browser.find_by_id('add-asset-button').click()
             sleep(1)
@@ -144,7 +148,7 @@ class WebTest(unittest.TestCase):
         video_file = '/tmp/video.mov'
 
         with Browser() as browser:
-            browser.visit('http://localhost:8080')
+            browser.visit(main_page_url)
 
             browser.find_by_id('add-asset-button').click()
             sleep(1)
@@ -174,7 +178,7 @@ class WebTest(unittest.TestCase):
             assets_helper.create(conn, asset_x)
 
         with Browser() as browser:
-            browser.visit('http://localhost:8080')
+            browser.visit(main_page_url)
 
             wait_for_and_do(browser, '.delete-asset-button', lambda btn: btn.click())
             wait_for_and_do(browser, '.confirm-delete', lambda btn: btn.click())
@@ -189,7 +193,7 @@ class WebTest(unittest.TestCase):
             assets_helper.create(conn, asset_x)
 
         with Browser() as browser:
-            browser.visit('http://localhost:8080')
+            browser.visit(main_page_url)
             wait_for_and_do(browser, 'span[class="on"]', lambda btn: btn.click())
             sleep(3)  # backend need time to process request
 
@@ -207,7 +211,7 @@ class WebTest(unittest.TestCase):
             assets_helper.create(conn, _asset_x)
 
         with Browser() as browser:
-            browser.visit('http://localhost:8080')
+            browser.visit(main_page_url)
 
             wait_for_and_do(browser, 'span[class="off"]', lambda btn: btn.click())
             sleep(3)  # backend need time to process request
@@ -227,7 +231,7 @@ class WebTest(unittest.TestCase):
             assets_helper.create(conn, asset_y)
 
         with Browser() as browser:
-            browser.visit('http://localhost:8080')
+            browser.visit(main_page_url)
 
             asset_x_for_drag = browser.find_by_id(asset_x['asset_id'])
             sleep(1)
@@ -245,12 +249,12 @@ class WebTest(unittest.TestCase):
 
     def test_settings_page_should_work(self):
         with Browser() as browser:
-            browser.visit('http://localhost:8080/settings')
+            browser.visit(settings_url)
             self.assertEqual(browser.is_text_present('Error: 500 Internal Server Error'), False,
                              '500: internal server error not expected')
 
     def test_system_info_page_should_work(self):
         with Browser() as browser:
-            browser.visit('http://localhost:8080/system_info')
+            browser.visit(system_info_url)
             self.assertEqual(browser.is_text_present('Error: 500 Internal Server Error'), False,
                              '500: internal server error not expected')