small fixes

uffd/selfservice/__init__.py

-from .views import bp as bp_ui
+from .views import bp as bp_ui, send_passwordreset
 
 bp = [bp_ui]

uffd/selfservice/templates/mailverification.mail.txt

 Hi {{ user.displayname }},
 
 you have requested to change your mail address.
-To do so, visit this url: {{ url_for('.self_token_mail', token=token, _external=True) }} 
+To do so, visit this url: {{ url_for('selfservice.self_token_mail', token=token, _external=True) }} 
 **Please note this link is only valid for 48h**
 
 If you did not request a mail address change, you should change your password asap because somebody else logged in and requested this.

uffd/selfservice/templates/passwordreset.mail.txt

 Hi {{ user.displayname }},
 
 you have requested a password reset.
-To reset your password, visit this url: {{ url_for('.self_token_password', token=token, _external=True) }} 
+To reset your password, visit this url: {{ url_for('selfservice.self_token_password', token=token, _external=True) }} 
 **Please note this link is only valid for 48h**
 
 If you did not request a password reset, you do not need to do anything.

uffd/selfservice/templates/self.html

 {% extends 'base.html' %}
 
 {% block body %}
-<form action="{{ url_for(".self_update") }}" method="POST" onInput="password2.setCustomValidity(password1.value != password2.value ? 'Passwords do not match.' : '')">
+<form action="{{ url_for(".self_update") }}" method="POST"
+	onInput="password2.setCustomValidity(password1.value != password2.value ? 'Passwords do not match.' : ''); password1.setCustomValidity(password1.value.length < 8 ? 'Password is too short' : '')">
 <div class="align-self-center row">
 	<div class="form-group col-md-6">
 		<label for="user-uid">uid</label>
@@ -35,40 +36,6 @@
 	<div class="form-group col-md-12">
 		<button type="submit" class="btn btn-primary float-right"><i class="fa fa-save" aria-hidden="true"></i> Save</button>
 	</div>
-	<div class="form-group col-md-12" "id="accordion">
-		<div class="card">
-			<div class="card-header" id="user-group">
-				<h5 class="mb-0">
-					<a class="btn btn-link collapsed" data-toggle="collapse" data-target="#user-group-body" aria-expanded="false" aria-controls="user-group">
-						groups
-					</a>
-				</h5>
-			</div>
-			<div id="user-group-body" class="collapse" aria-labelledby="user-group" data-parent="#accordion">
-				<div class="card-body">
-					<ul class="list-group">
-					{% for group in user.get_groups() %}
-					<li class="list-group-item"><a href="{{ url_for("group.group_show", gid=group.gid) }}">{{ group.name }}</a></li>
-					{% endfor %}
-					</ul>
-				</div>
-			</div>
-		</div>
-		<div class="card">
-			<div class="card-header" id="user-role">
-				<h5 class="mb-0">
-					<a class="btn btn-link" data-toggle="collapse" data-target="#user-role-body" aria-expanded="true" aria-controls="user-role">
-						roles
-					</a>
-				</h5>
-			</div>
-			<div id="user-role-body" class="collapse show" aria-labelledby="user-role" data-parent="#accordion">
-				<div class="card-body">
-					roles.
-				</div>
-			</div>
-		</div>
-	</div>
 </div>
 </form>
 {% endblock %}

uffd/selfservice/views.py

@@ -46,7 +46,6 @@ def self_update():
 	return redirect(url_for('.self_index'))
 
 @bp.route("/passwordreset", methods=(['GET', 'POST']))
-@csrf_protect(blueprint=bp)
 def self_forgot_password():
 	if request.method == 'GET':
 		return render_template('forgot_password.html')

uffd/user/templates/user.html

@@ -22,13 +22,14 @@
 		<label for="user-loginname">display name</label>
 		<input type="text" class="form-control" id="user-displayname" name="displayname" value="{{ user.displayname }}">
 		<small class="form-text text-muted">
-			At most 128, at least 2 characters. No character restrictions.
+			If you leave this empty it will be set to the login name. At most 128, at least 2 characters. No character restrictions.
 		</small>
 	</div>
 	<div class="form-group col">
 		<label for="user-mail">mail</label>
 		<input type="email" class="form-control" id="user-mail" name="mail" value="{{ user.mail }}">
 		<small class="form-text text-muted">
+			Do a sanity check here. A user can take over another account if both have the same mail address set.
 		</small>
 	</div>
 	<div class="form-group col">
@@ -42,6 +43,7 @@
 			At least 8 characters, no other special requirements. But please don't be stupid and use a password manager.
 		</small>
 	</div>
+	{% if user.uid %}
 	<div class="form-group col "id="accordion">
 		<div class="card">
 			<div class="card-header" id="user-ldif">
@@ -90,6 +92,7 @@
 			</div>
 		</div>
 	</div>
+	{% endif %}
 	<div class="form-group col">
 		<button type="submit" class="btn btn-primary"><i class="fa fa-save" aria-hidden="true"></i> Save</button>
 		<a href="{{ url_for(".user_list") }}" class="btn btn-secondary">Cancle</a>

uffd/user/views.py

@@ -2,6 +2,7 @@ from flask import Blueprint, render_template, request, url_for, redirect, flash,
 
 from uffd.navbar import register_navbar
 from uffd.csrf import csrf_protect
+from uffd.selfservice import send_passwordreset
 from uffd.ldap import get_conn, escape_filter_chars
 from uffd.session import login_required, is_valid_session, get_current_user
 
@@ -47,25 +48,30 @@ def user_show(uid=None):
 @csrf_protect(blueprint=bp_user)
 def user_update(uid=False):
 	conn = get_conn()
-	if uid:
-		conn.search(current_app.config["LDAP_BASE_USER"], '(&(objectclass=person)(uidNumber={}))'.format((escape_filter_chars(uid))))
-		assert len(conn.entries) == 1
-		user = User.from_ldap(conn.entries[0])
-	else:
-		# new user
+	is_newuser = bool(not uid)
+	if is_newuser:
 		user = User()
 		if not user.set_loginname(request.form['loginname']):
 			flash('Login name does not meet requirements')
 			return url_for('.user_show')
+	else:
+		conn.search(current_app.config["LDAP_BASE_USER"], '(&(objectclass=person)(uidNumber={}))'.format((escape_filter_chars(uid))))
+		assert len(conn.entries) == 1
+		user = User.from_ldap(conn.entries[0])
 	user.mail = request.form['mail']
-	if not user.set_displayname(request.form['displayname']):
+	new_displayname = request.form['displayname'] if request.form['displayname'] else request.form['loginname']
+	if not user.set_displayname(new_displayname):
 		flash('Display name does not meet requirements')
 		return url_for('.user_show')
 	new_password = request.form.get('password')
-	if new_password:
+	if new_password and not is_newuser:
 		user.set_password(new_password)
-	if user.to_ldap(new=(not uid)):
-		flash('User updated')
+	if user.to_ldap(new=is_newuser):
+		if is_newuser:
+			send_passwordreset(user.loginname)
+			flash('User created. We sent the user a password reset link by mail')
+		else:
+			flash('User updated')
 	else:
 		flash('Error updating user: {}'.format(conn.result['message']))
 	return redirect(url_for('.user_list'))