1
|
|
|
''' |
2
|
|
|
This module contains administrative functionality that is available as command-line tool "opensubmit-web". |
3
|
|
|
''' |
4
|
|
|
|
5
|
|
|
import os, pwd, grp, urllib.request, urllib.parse, urllib.error, sys, shutil |
6
|
|
|
from configparser import RawConfigParser |
7
|
|
|
from pkg_resources import Requirement, resource_filename |
8
|
|
|
|
9
|
|
|
DEFAULT_CONFIG=''' |
10
|
|
|
# This is the configuration file for the OpenSubmit tool. |
11
|
|
|
# https://github.com/troeger/opensubmit |
12
|
|
|
# |
13
|
|
|
# It is expected to be located at: |
14
|
|
|
# /etc/opensubmit/settings.ini (on production system), or |
15
|
|
|
# ./settings_dev.ini (on developer systems) |
16
|
|
|
|
17
|
|
|
[general] |
18
|
|
|
# Enabling this will lead to detailed developer error information as result page |
19
|
|
|
# whenever something goes wrong on server side. |
20
|
|
|
# In production systems, you never want that to be enabled, for obvious security reasons. |
21
|
|
|
DEBUG: False |
22
|
|
|
|
23
|
|
|
[server] |
24
|
|
|
# This is the root host url were the OpenSubmit tool is offered by your web server. |
25
|
|
|
# If you serve the content from a subdirectory, please specify it too, without leading or trailing slashes, |
26
|
|
|
# otherwise leave it empty. |
27
|
|
|
HOST: ***not configured*** |
28
|
|
|
HOST_DIR: submit |
29
|
|
|
|
30
|
|
|
# This is the local directory were the uploaded assignment attachments are stored. |
31
|
|
|
# Your probably need a lot of space here. |
32
|
|
|
# Make sure that the path starts and ends with a slash. |
33
|
|
|
MEDIA_ROOT: ***not configured*** |
34
|
|
|
|
35
|
|
|
# This is the logging file. The web server must be allowed to write into it. |
36
|
|
|
LOG_FILE: /var/log/opensubmit.log |
37
|
|
|
|
38
|
|
|
# This is the timezone all dates and deadlines are specified in. |
39
|
|
|
# This setting overrides your web server default for the time zone. |
40
|
|
|
# The list of available zones is here: |
41
|
|
|
# http://en.wikipedia.org/wiki/List_of_tz_database_time_zones |
42
|
|
|
TIME_ZONE: Europe/Berlin |
43
|
|
|
|
44
|
|
|
# This is a unique string needed for some of the security features. |
45
|
|
|
# Change it, the value does not matter. |
46
|
|
|
SECRET_KEY: uzfp=4gv1u((#hb*#o3*4^v#u#g9k8-)us2nw^)@rz0-$2-23) |
47
|
|
|
|
48
|
|
|
[database] |
49
|
|
|
# The database you are using. Possible choices are |
50
|
|
|
# - postgresql_psycopg2 |
51
|
|
|
# - mysql |
52
|
|
|
# - sqlite3 |
53
|
|
|
# - oracle |
54
|
|
|
DATABASE_ENGINE: sqlite3 |
55
|
|
|
|
56
|
|
|
# The name of the database. It must be already available for being used. |
57
|
|
|
# In SQLite, this is the path to the database file. |
58
|
|
|
DATABASE_NAME: database.sqlite |
59
|
|
|
|
60
|
|
|
# The user name for accessing the database. Not needed for SQLite. |
61
|
|
|
DATABASE_USER: |
62
|
|
|
|
63
|
|
|
# The user password for accessing the database. Not needed for SQLite. |
64
|
|
|
DATABASE_PASSWORD: |
65
|
|
|
|
66
|
|
|
# The host name for accessing the database. Not needed for SQLite. |
67
|
|
|
# An empty settings means that the database is on the same host as the web server. |
68
|
|
|
DATABASE_HOST: |
69
|
|
|
|
70
|
|
|
# The port number for accessing the database. Not needed for SQLite. |
71
|
|
|
# An empty settings means that the database default use used. |
72
|
|
|
DATABASE_PORT: |
73
|
|
|
|
74
|
|
|
[executor] |
75
|
|
|
# The shared secret with the job executor. This ensures that only authorized |
76
|
|
|
# machines can fetch submitted solution attachments for validation, and not |
77
|
|
|
# every student ... |
78
|
|
|
# Change it, the value does not matter. |
79
|
|
|
SHARED_SECRET: 49846zut93purfh977TTTiuhgalkjfnk89 |
80
|
|
|
|
81
|
|
|
[admin] |
82
|
|
|
# The administrator for this installation. Course administrators |
83
|
|
|
# are stored in the database, so this is only the technical contact for problems |
84
|
|
|
# with the tool itself. Exceptions that happen due to bugs or other issues |
85
|
|
|
# are sent to this address. |
86
|
|
|
ADMIN_NAME: Super Admin |
87
|
|
|
ADMIN_EMAIL: root@localhost |
88
|
|
|
|
89
|
|
|
[login] |
90
|
|
|
# Enables or disables login with OpenID |
91
|
|
|
LOGIN_OPENID: True |
92
|
|
|
|
93
|
|
|
# Text shown beside the OpenID login icon. |
94
|
|
|
LOGIN_DESCRIPTION: StackExchange |
95
|
|
|
|
96
|
|
|
# OpenID provider URL to be used for login. |
97
|
|
|
OPENID_PROVIDER: https://openid.stackexchange.com |
98
|
|
|
|
99
|
|
|
# Enables or disables login with Twitter |
100
|
|
|
LOGIN_TWITTER: False |
101
|
|
|
|
102
|
|
|
# OAuth application credentials for Twitter |
103
|
|
|
LOGIN_TWITTER_OAUTH_KEY: |
104
|
|
|
LOGIN_TWITTER_OAUTH_SECRET: |
105
|
|
|
|
106
|
|
|
# Enables or disables login with Google |
107
|
|
|
LOGIN_GOOGLE: False |
108
|
|
|
|
109
|
|
|
# OAuth application credentials for Google |
110
|
|
|
LOGIN_GOOGLE_OAUTH_KEY: |
111
|
|
|
LOGIN_GOOGLE_OAUTH_SECRET: |
112
|
|
|
|
113
|
|
|
# Enables or disables login with GitHub |
114
|
|
|
LOGIN_GITHUB: False |
115
|
|
|
|
116
|
|
|
# OAuth application credentials for GitHub |
117
|
|
|
LOGIN_GITHUB_OAUTH_KEY: |
118
|
|
|
LOGIN_GITHUB_OAUTH_SECRET: |
119
|
|
|
|
120
|
|
|
# Enables or diables login through Apache 2.4 mod_shib authentication |
121
|
|
|
LOGIN_SHIB: False |
122
|
|
|
LOGIN_SHIB_DESCRIPTION: Shibboleth |
123
|
|
|
''' |
124
|
|
|
|
125
|
|
|
def django_admin(args): |
126
|
|
|
''' |
127
|
|
|
Run something like it would be done through Django's manage.py. |
128
|
|
|
''' |
129
|
|
|
from django.core.management import execute_from_command_line |
130
|
|
|
from django.core.exceptions import ImproperlyConfigured |
131
|
|
|
os.environ.setdefault("DJANGO_SETTINGS_MODULE", "opensubmit.settings") |
132
|
|
|
try: |
133
|
|
|
execute_from_command_line([sys.argv[0]]+args) |
134
|
|
|
except ImproperlyConfigured as e: |
135
|
|
|
print(str(e)) |
136
|
|
|
exit(-1) |
137
|
|
|
|
138
|
|
|
def apache_config(config, outputfile): |
139
|
|
|
''' |
140
|
|
|
Generate a valid Apache configuration file, based on the given settings. |
141
|
|
|
''' |
142
|
|
|
if os.path.exists(outputfile): |
143
|
|
|
os.rename(outputfile, outputfile+".old") |
144
|
|
|
print("Renamed existing Apache config file to "+outputfile+".old") |
145
|
|
|
|
146
|
|
|
from opensubmit import settings |
147
|
|
|
f = open(outputfile,'w') |
148
|
|
|
print("Generating Apache configuration in "+outputfile) |
149
|
|
|
subdir = (len(settings.HOST_DIR)>0) |
150
|
|
|
text = """ |
151
|
|
|
# OpenSubmit Configuration for Apache 2.4 |
152
|
|
|
# These directives are expected to live in some <VirtualHost> block |
153
|
|
|
""" |
154
|
|
|
if subdir: |
155
|
|
|
text += "Alias /%s/static/ %s\n"%(settings.HOST_DIR, settings.STATIC_ROOT) |
156
|
|
|
text += " WSGIScriptAlias /%s %s/wsgi.py\n"%(settings.HOST_DIR, settings.SCRIPT_ROOT) |
157
|
|
|
else: |
158
|
|
|
text += "Alias /static/ %s\n"%(settings.STATIC_ROOT) |
159
|
|
|
text += " WSGIScriptAlias / %s/wsgi.py"%(settings.SCRIPT_ROOT) |
160
|
|
|
text += """ |
161
|
|
|
WSGIPassAuthorization On |
162
|
|
|
<Directory {static_path}> |
163
|
|
|
Require all granted |
164
|
|
|
</Directory> |
165
|
|
|
<Directory {install_path}> |
166
|
|
|
<Files wsgi.py> |
167
|
|
|
Require all granted |
168
|
|
|
</Files> |
169
|
|
|
</Directory> |
170
|
|
|
""".format(static_path=settings.STATIC_ROOT, install_path=settings.SCRIPT_ROOT) |
171
|
|
|
|
172
|
|
|
f.write(text) |
173
|
|
|
f.close() |
174
|
|
|
|
175
|
|
|
def check_path(directory): |
176
|
|
|
''' |
177
|
|
|
Checks if the directories for this path exist, and creates them in case. |
178
|
|
|
''' |
179
|
|
|
try: |
180
|
|
|
if directory != '': |
181
|
|
|
if not os.path.exists(directory): |
182
|
|
|
os.makedirs(directory, 0o775) # rwxrwxr-x |
183
|
|
|
except: |
184
|
|
|
print("ERROR: Could not create {0}. Please use sudo or become root.".format(directory)) |
185
|
|
|
|
186
|
|
|
def check_file(filepath): |
187
|
|
|
''' |
188
|
|
|
- Checks if the parent directories for this path exist. |
189
|
|
|
- Checks that the file exists. |
190
|
|
|
- Donates the file to the web server user. |
191
|
|
|
|
192
|
|
|
TODO: This is Debian / Ubuntu specific. |
193
|
|
|
''' |
194
|
|
|
check_path(os.path.dirname(filepath)) |
195
|
|
|
if not os.path.exists(filepath): |
196
|
|
|
print("WARNING: File does not exist. Creating it: %s"%filepath) |
197
|
|
|
open(filepath, 'a').close() |
198
|
|
|
try: |
199
|
|
|
print("Setting access rights for %s for www-data user"%(filepath)) |
200
|
|
|
uid = pwd.getpwnam("www-data").pw_uid |
201
|
|
|
gid = grp.getgrnam("www-data").gr_gid |
202
|
|
|
os.chown(filepath, uid, gid) |
203
|
|
|
os.chmod(filepath, 0o660) # rw-rw--- |
204
|
|
|
except: |
205
|
|
|
print("WARNING: Could not adjust file system permissions for %s. Make sure your web server can write into it."%filepath) |
206
|
|
|
|
207
|
|
|
def check_web_config_consistency(config): |
208
|
|
|
''' |
209
|
|
|
Check the web application config file for consistency. |
210
|
|
|
''' |
211
|
|
|
login_conf_deps = { |
212
|
|
|
'LOGIN_TWITTER': ['LOGIN_TWITTER_OAUTH_KEY','LOGIN_TWITTER_OAUTH_SECRET'], |
213
|
|
|
'LOGIN_GOOGLE': ['LOGIN_GOOGLE_OAUTH_KEY', 'LOGIN_GOOGLE_OAUTH_SECRET'], |
214
|
|
|
'LOGIN_GITHUB': ['LOGIN_GITHUB_OAUTH_KEY', 'LOGIN_GITHUB_OAUTH_SECRET'] |
215
|
|
|
} |
216
|
|
|
|
217
|
|
|
print("Checking configuration of the OpenSubmit web application...") |
218
|
|
|
# Let Django's manage.py load the settings file, to see if this works in general |
219
|
|
|
django_admin(["check"]) |
220
|
|
|
# Check configured host |
221
|
|
|
try: |
222
|
|
|
urllib.request.urlopen(config.get("server", "HOST")) |
223
|
|
|
except Exception as e: |
224
|
|
|
# This may be ok, when the admin is still setting up to server |
225
|
|
|
print("The configured HOST seems to be invalid at the moment: "+str(e)) |
226
|
|
|
# Check configuration dependencies |
227
|
|
|
for k, v in list(login_conf_deps.items()): |
228
|
|
|
if config.getboolean('login', k): |
229
|
|
|
for needed in v: |
230
|
|
|
if len(config.get('login', needed)) < 1: |
231
|
|
|
print("ERROR: You have enabled %s in settings.ini, but %s is not set."%(k, needed)) |
232
|
|
|
return False |
233
|
|
|
# Check media path |
234
|
|
|
check_path(config.get('server', 'MEDIA_ROOT')) |
235
|
|
|
# Prepare empty log file, in case the web server has no creation rights |
236
|
|
|
log_file = config.get('server', 'LOG_FILE') |
237
|
|
|
print("Preparing log file at "+log_file) |
238
|
|
|
check_file(log_file) |
239
|
|
|
# If SQLite database, adjust file system permissions for the web server |
240
|
|
|
if config.get('database','DATABASE_ENGINE') == 'sqlite3': |
241
|
|
|
name = config.get('database','DATABASE_NAME') |
242
|
|
|
if not os.path.isabs(name): |
243
|
|
|
print("ERROR: Your SQLite database name must be an absolute path. The web server must have directory access permissions for this path.") |
244
|
|
|
return False |
245
|
|
|
check_file(config.get('database','DATABASE_NAME')) |
246
|
|
|
# everything ok |
247
|
|
|
return True |
248
|
|
|
|
249
|
|
|
def check_web_config(config_path): |
250
|
|
|
''' |
251
|
|
|
Try to load the Django settings. |
252
|
|
|
If this does not work, than settings file does not exist. |
253
|
|
|
''' |
254
|
|
|
WEB_CONFIG_FILE = config_path+'/settings.ini' |
255
|
|
|
print("Looking for config file at {0} ...".format(WEB_CONFIG_FILE)) |
256
|
|
|
config = RawConfigParser() |
257
|
|
|
try: |
258
|
|
|
config.readfp(open(WEB_CONFIG_FILE)) |
259
|
|
|
return config |
260
|
|
|
except IOError: |
261
|
|
|
print("ERROR: Seems like the config file does not exist.") |
262
|
|
|
print(" I am creating a new one. Please edit it and re-run this command.") |
263
|
|
|
# Create fresh config file |
264
|
|
|
try: |
265
|
|
|
check_path(config_path) |
266
|
|
|
f=open(WEB_CONFIG_FILE,'wt') |
267
|
|
|
f.write(DEFAULT_CONFIG) |
268
|
|
|
f.close() |
269
|
|
|
check_file(WEB_CONFIG_FILE) |
270
|
|
|
return None # Manual editing is needed before further proceeding with the fresh file |
271
|
|
|
except FileNotFoundError: |
272
|
|
|
print("ERROR: Could not create config file at {0}. Please use sudo or become root.".format(WEB_CONFIG_FILE)) |
273
|
|
|
return None |
274
|
|
|
|
275
|
|
|
def check_web_db(): |
276
|
|
|
''' |
277
|
|
|
Everything related to database checks and updates. |
278
|
|
|
''' |
279
|
|
|
print("Testing for neccessary database migrations...") |
280
|
|
|
django_admin(["migrate"]) # apply schema migrations |
281
|
|
|
print("Checking the OpenSubmit permission system...") |
282
|
|
|
django_admin(["fixperms"]) # configure permission system, of needed |
283
|
|
|
return True |
284
|
|
|
|
285
|
|
|
def configure(fsroot='/'): |
286
|
|
|
print("Inspecting OpenSubmit configuration ...") |
287
|
|
|
config = check_web_config(fsroot+'etc/opensubmit') |
288
|
|
|
if not config: |
289
|
|
|
return # Let them first fix the config file before trying a DB access |
290
|
|
|
if not check_web_config_consistency(config): |
291
|
|
|
return |
292
|
|
|
if not check_web_db(): |
293
|
|
|
return |
294
|
|
|
print("Preparing static files for web server...") |
295
|
|
|
django_admin(["collectstatic","--noinput","--clear","-v 0"]) |
296
|
|
|
apache_config(config, fsroot+'etc/opensubmit/apache24.conf') |
297
|
|
|
|
298
|
|
|
|
299
|
|
|
def print_help(): |
300
|
|
|
print("configure: Check config files and database for correct installation of the OpenSubmit web server.") |
301
|
|
|
print("createdemo: Install some test data (courses, assignments, users).") |
302
|
|
|
print("fixperms: Check and fix student and tutor permissions") |
303
|
|
|
print("fixchecksums: Re-create all student file checksums (for duplicate detection)") |
304
|
|
|
print("makeadmin <email>: Make this user an admin with backend rights.") |
305
|
|
|
print("makeowner <email>: Make this user a course owner with backend rights.") |
306
|
|
|
print("maketutor <email>: Make this user a course tutor with backend rights.") |
307
|
|
|
print("makestudent <email>: Make this user a student without backend rights.") |
308
|
|
|
|
309
|
|
|
def console_script(fsroot='/'): |
310
|
|
|
''' |
311
|
|
|
The main entry point for the production administration script 'opensubmit-web', installed by setuptools. |
312
|
|
|
The argument allows the test suite to override the root of all paths used in here. |
313
|
|
|
''' |
314
|
|
|
|
315
|
|
|
if len(sys.argv) == 2 and "configure" in sys.argv[1]: |
316
|
|
|
configure(fsroot) |
317
|
|
|
|
318
|
|
|
elif len(sys.argv) == 2 and sys.argv[1] in ['fixperms', 'fixchecksums', 'createdemo']: |
319
|
|
|
django_admin([sys.argv[1]]) |
320
|
|
|
|
321
|
|
|
elif len(sys.argv) == 3 and sys.argv[1] in ['makeadmin', 'makeowner', 'maketutor', 'makestudent']: |
322
|
|
|
django_admin([sys.argv[1], sys.argv[2]]) |
323
|
|
|
|
324
|
|
|
else: |
325
|
|
|
print_help() |
326
|
|
|
|
327
|
|
|
if __name__ == "__main__": |
328
|
|
|
console_script() |
329
|
|
|
|