-
Notifications
You must be signed in to change notification settings - Fork 0
/
models.py
86 lines (71 loc) · 2.83 KB
/
models.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
from random import randint
import urllib2, json
from pushbullet import PushBullet
from os import environ
from cartodb_sql import mark_login_attempt
from cartodb_sql import location_intersects
import pwnedcheck
'''
Checks if the current login attempt is a security threat or not.
Performs the required action in each case
'''
def is_safe(form, ip, geocoded_ip, mandrill):
ip = ip
latitude = form.get('latitude', None)
longitude = form.get('longitude', None)
os = form.get('os', None)
mobile = form.get('isMobile', None)
browser = form.get('browser', None)
email = form.get('email', None)
# TODO: This will toggle depending if company forces geocoding
force_geocoding = True
is_geocoded_ip = False
if latitude == None and longitude == None and 'lat' in geocoded_ip.keys():
latitude = geocoded_ip['lat']
longitude = geocoded_ip['lon']
is_geocoded_ip = True
result = location_intersects(float(latitude), float(longitude))
if force_geocoding and is_geocoded_ip:
safety_status = -2
else:
if result == True:
safety_status = 1
elif result == False:
safety_status = -1
else:
safety_status = 0
mark_login_attempt(ip=ip, latitude=latitude,
longitude=longitude, os=os, mobile=mobile, browser=browser, result=safety_status)
auth_code = '%06d' % randint(0,999999)
if safety_status == 0:
send_push("Access confirmation", "Please confirm your access with the code: %s" % (auth_code), pushbullet_token=environ.get('PUSHBULLET_TOKEN'))
return {
'safety_code': safety_status,
'token': auth_code,
'pwned': is_pwned(email)
}
def send_push(message, body, pushbullet_token=environ.get('PUSHBULLET_TOKEN')):
""" Sends a foo location to Pushbullet """
print pushbullet_token
pb = PushBullet(pushbullet_token)
success, push = pb.push_note(message, body)
return success
def send_mail(mandrill, to, latitude, longitude, ip, safety_code):
gmaps_uri = "http://maps.googleapis.com/maps/api/staticmap?center=%s,%s&zoom=15&size=400x400&markers=color:red%%7Clabel:S%%7C%s,%s&sensor=true" % (latitude, longitude, latitude, longitude)
mandrill.send_email(
from_email='someone@yourdomain.com',
subject='[LogLock] Suspicious login attempt detected',
to=[{'email': to}],
html='''
An access attempt has been logged from a suspicious location:
<p><img src="%s" /></p>
<p>IP address: %s</p>
''' %(gmaps_uri, ip, safety_code)
)
def geocode_ip(ip_addr):
""" Geocodes a given IP Address """
data = json.load(urllib2.urlopen("http://ip-api.com/json/%s" % ip_addr))
print "Geocoded data: %s" % data
return data
def is_pwned(email):
return pwnedcheck.check(email)