def delete_user(user_id):
    """
    Delete a user.

    This page can be requested in both GET and POST methods:

    * If this page was requested with GET method, a form that confirms that this user should be removed is returned.
    * If this page was requested with POST method, the validation form is checked. If it is validated successfully.
        Later (even if the user was not deleted) the user is redirected to the management page (see
        :meth:`~edsudoku.server.manage_users.manage_users`).

    :param user_id: The user ID to be deleted.
    :type user_id: int
    :return: As explained above.
    :rtype: flask.Response
    """
    user_to_delete = User.get_by_id(user_id)
    if not user_to_delete:
        flash('User not found', 'danger')
        return redirect(url_for('manage_users'))

    if request.method == 'POST':
        user_id2 = int(request.form.get('user_id', -1))
        approved = bool(request.form.get('approved', False))

        if approved and user_id == user_id2:
            user_to_delete.delete()
            commit()
            flash('User %s has been deleted successfully' % user_to_delete.display, 'success')
        else:
            flash('User not deleted', 'warning')
        return redirect(url_for('manage_users'))

    user = User.get_by_id(session['user'])
    return render_template('delete_user.html', user=user, user_to_delete=user_to_delete)

    def post(self, entry_id):
        if entry_id is None:
            # Add a new entry
            form_class = self.create_form(config=current_app.config)
            form = form_class()
            if form.validate_on_submit():
                image = request.files['image']
                self.model.bl.save_image(
                    image=image,
                    img_category=form.data['img_category'],
                    title=form.data['title'],
                    description=form.data['description'],
                )
                return redirect(url_for("admin." + self.success_url))

        else:
            # Update an old entry
            instance = self.model.bl.get(entry_id)
            form_class = self.update_form(
                config=current_app.config,
                is_update=True,
            )
            form = form_class(obj=instance)
            if form.validate_on_submit():
                instance.bl.update(form.data)
                return redirect(url_for("admin." + self.success_url))

        return self.render_response(entry_form=form)

def login():
    if session.get("usid"):
        return redirect("/user_home")
    
    if request.method == "POST":
        email = request.form.get("email")
        password = request.form["password"]
        
        cnx = db_connect()
        cur = cnx.cursor()
        
        stmt_select = "select uid, firstname, pwdhash from users where email = %s;"
        names = [email]
        
        cur.execute(stmt_select, names)
        row = cur.fetchone()
     
        if row:
            data = {
                "uid":row[0],
                "firstname":row[1],
                "pwdhash":row[2],
            }
            
            if password == data["pwdhash"]:
                session["usid"] = data["uid"]
                session["firstname"] = data["firstname"]
                return redirect("/user_home")
            else:
                return render_template("login.html", pwdwrong = True)
        else:
            return render_template("login.html", emailwrong = True) 
          
    elif request.method == "GET":
        return render_template("login.html")

def login():
    """
    Show the login page and handle login requests.

    :return: The login page.
    :rtype: flask.Response
    """
    if request.method == 'POST':
        try:
            username = request.form.get('username', None)
            password = request.form.get('password', None)

            if username is None or password is None:
                flash('Invalid data', 'danger')
                return redirect(url_for('login'))

            user = User.query().filter_by(username=username).first()
            if user is None or not user.check_password(password):
                flash('Invalid login credentials', 'danger')
            else:
                flash('You were logged in successfully!', 'success')
                session['logged_in'] = True
                session['user'] = user.id

                if request.args.get('next', None):
                    return redirect(request.args['next'])
                return redirect(url_for('main_page'))
        except KeyError:
            flash('Missing username or password', 'info')
    return render_template('login.html')

def reset_password():
    if current_user.is_authenticated:  # Prevent password reset if already logged in
        return redirect(url_for('index'))
    form = PasswordResetForm()
    if form.validate_on_submit() and session['settings']['mail']:  # pragma: no cover
        user = UserMapper.get_by_email(form.email.data)
        if not user:
            logger.log('info', 'password', 'Password reset for non existing ' + form.email.data)
            flash(_('error non existing email'), 'error')
        else:
            code = UserMapper.generate_password()
            user.password_reset_code = code
            user.password_reset_date = datetime.datetime.now()
            user.update()
            link = request.scheme + '://' + request.headers['Host']
            link += url_for('reset_confirm', code=code)
            subject = _('Password reset request for %(site_name)s',
                        site_name=session['settings']['site_name'])
            body = _('We received a password reset request for %(username)s',
                     username=user.username)
            body += ' ' + _('at') + ' '
            body += request.headers['Host'] + '\n\n' + _('reset password link') + ':\n\n'
            body += link + '\n\n' + _('The link is valid for') + ' '
            body += str(session['settings']['reset_confirm_hours']) + ' ' + _('hours') + '.'
            if send_mail(subject, body, form.email.data):
                flash(_('A password reset confirmation mail was send to %(email)s.',
                        email=form.email.data), 'info')
            else:
                flash(_('Failed to send password reset confirmation mail to %(email)s.',
                        email=form.email.data), 'error')
            return redirect(url_for('login'))
    return render_template('login/reset_password.html', form=form)

 def on_admin_toggle_pin(self, request):
     if request.cookies.get('cookie_name') is None:
         return redirect('/')
     img_id = request.args.get('id')
     if img_id is not None:
         cvtools.toggle_pinned(img_id)
     return redirect(request.referrer)

    def on_index(self, request):
        if request.cookies.get('cookie_name') is not None and request.cookies.get('cookie_name') != '':
            return redirect('/admin_list/')
        
        error = None
        sid = request.cookies.get('cookie_name')
        if sid is None:
            request.session = session_store.new()
        else:
            request.session = session_store.get(sid)
            
        action = request.args.get('action')
        user = request.cookies.get('cookie_user')
        
        if action == "Signout":
            response = redirect('/')
            response.set_cookie('cookie_name', '')
            return response

        username = request.form.get('username')
        password = request.form.get('password')
        logged_in, user_id = cvtools.admin_login(username, password)
        if logged_in:
            session_store.save(request.session)
            response = redirect('/admin_list')
            response.set_cookie('cookie_name', request.session.sid)
            response.set_cookie('cookie_user', username)
            return response
        return self.render_template('index.html', page="index", error=error, sid=sid, user=user)

def login():
    form = UserLogin()

    if request.method == "POST":
        email = thwart(request.form["email"])
        password = thwart(request.form["password"])

        if re.match(r"^[A-Za-z0-9\.\+_-][email protected][A-Za-z0-9\._-]+\.[a-zA-Z]*$", email):
            if not check_new_user_email(email):
                user = get_user_id(email)

                check = comfirm_password(user[0], email, password)
                password = random.random()

                if check:
                    session["username"] = user[1]
                    session["userid"] = user[0]
                    session["logged_in"] = True
                    flash("Welcome back " + session["username"] + ".")
                    return redirect(url_for("index"))

                else:
                    flash("Please check your login details")
                    return redirect(url_for("login"))
            else:
                flash("Please check your login details")
                return redirect(url_for("login"))
        else:
            flash("Please check your login details")
            return redirect(url_for("login"))

    return render_template("users/login.html", form=form)

def create_new_account():
    if request.method == 'POST':
        first_name = request.form['first_name']
        last_name = request.form['last_name']
        email = request.form['email']
        password = request.form['password'].encode('utf-8')
        retype_password = request.form['retype_password'].encode('utf-8')
        # if the same email was used to log in
        if email == UserExternalLogin.query.filter_by(email=email).first():
            provider = UserExternalLogin.query.filter_by(email=email).join(ExternalAuthenticationProvider).first()
            flash('This email was already used to login with' + str(provider.name))
        if password == retype_password:
            password_salt = bcrypt.gensalt()  # generate salt
            password_hash = bcrypt.hashpw(password, password_salt)  # generate password hash

            user_details = UserDetails(first_name=first_name, last_name=last_name, email=email,
                                       password_hash=password_hash,
                                       password_salt=password_salt)
            db.session.add(user_details)
            db.session.commit()

            new_user = UserAccount(screen_user_name=first_name + ' ' + last_name, user_details_id=user_details.id)
            db.session.add(new_user)
            db.session.commit()
            login_user(new_user)
            return redirect(url_for('success'))
        else:
            flash('Passwords don\'t match')
            return redirect(url_for('/signup'))
    else:
        return render_template('signup-form.html')

def paymentSuccess():
    # Paypal redirects the user to this URL once the user has approved the payment.
    # Now we still need to execute the payment.

    try:
        payment, prt = pp1.execute_payment(request.args)

        # amount = payment["transactions"][0]["amount"]["total"]  # get total amount from the Paypal return message
        amount = prt.final_fee + prt.donation

        # send confirmation email
        body = render_template("application_confirmation.txt", amount=int(amount), prt=prt, eventname=event_name,
                               shortname=event_shortname, final_fee=int(prt.final_fee), currency_symbol=currency_symbol)
        print(body)
        ehbmail.send([prt.id], "Application confirmed", [body], "Application page")

        return render_template("payment_confirmation.html", title="Apply!", amount=int(amount), data=prt, name=event_name, shortname=event_shortname, application_fee=int(application_fee))

    except ParticipantNotFoundException as e:
        # print("pnfe " + e.token)
        return "Unable to resolve the Paypal token '%s' to a participant. Please try resubmitting your application, or contact the organizers." % e.token
    except PaymentNotFoundException as e:
        # print("pm nfe " + e.paymentId)
        flash("Unable to resolve the Paypal payment ID '%s' to a payment. Please try resubmitting your application, or contact the organizers." % e.paymentId)
        flask_session['sn_code'] = generate_confirmation_token(prt.email)
        return redirect("confirm.html")
    except DuplicatePaymentException as e:
        amount = application_fee + e.prt.donation
        return render_template("payment_confirmation.html", title="Apply!", amount=amount, data=e.prt, name=event_name, shortname=event_shortname, application_fee=("%.2f" % application_fee))
    except PaymentFailedException as e:
        flash("Something went wrong with your Paypal payment. Please contact the organizers.")
        flask_session['sn_code'] = generate_confirmation_token(prt.email)
        return redirect("confirm.html")

def hierarchy_update(id_):
    root = g.nodes[id_]
    if root.system:
        abort(403)
    form = build_form(HierarchyForm, 'hierarchy', root)
    form.forms.choices = NodeMapper.get_form_choices(root)
    if root.value_type:
        del form.multiple
    elif root.multiple:
        form.multiple.render_kw = {'disabled': 'disabled'}
    if form.validate_on_submit():
        if form.name.data != root.name and NodeMapper.get_nodes(form.name.data):
            flash(_('error name exists'), 'error')
            return redirect(url_for('node_index') + '#tab-' + str(root.id))
        save(form, root)
        flash(_('info update'), 'info')
        return redirect(url_for('node_index') + '#tab-' + str(root.id))
    form.multiple = root.multiple
    table = {'id': 'used_forms', 'show_pager': False, 'data': [], 'sort': 'sortList: [[0, 0]]',
             'header': ['form', 'count']}
    for form_id, form_ in root.forms.items():
        url = url_for('hierarchy_remove_form', id_=root.id, remove_id=form_id)
        link = '<a href="' + url + '">' + uc_first(_('remove')) + '</a>'
        count = NodeMapper.get_form_count(root, form_id)
        table['data'].append([form_['name'], format_number(count) if count else link])
    return render_template('hierarchy/update.html', node=root, form=form, table=table,
                           forms=[form.id for form in form.forms])

def process_event_cfs_speaker(identifier, via_hash=False):
    if request.method == 'GET':
        event = get_published_event_or_abort(identifier)
        placeholder_images = DataGetter.get_event_default_images()
        if event.sub_topic:
            custom_placeholder = DataGetter.get_custom_placeholder_by_name(event.sub_topic)
        elif event.topic:
            custom_placeholder = DataGetter.get_custom_placeholder_by_name(event.topic)
        else:
            custom_placeholder = DataGetter.get_custom_placeholder_by_name('Other')
        if not event.has_session_speakers:
            abort(404)

        call_for_speakers = DataGetter.get_call_for_papers(event.id).first()

        if not call_for_speakers or (not via_hash and call_for_speakers.privacy == 'private'):
            abort(404)

        form_elems = DataGetter.get_custom_form_elements(event.id)
        speaker_form = json.loads(form_elems.speaker_form)
        session_form = json.loads(form_elems.session_form)

        now = datetime.now(pytz.timezone(event.timezone
                                                  if (event.timezone and event.timezone != '') else 'UTC'))
        start_date = pytz.timezone(event.timezone).localize(call_for_speakers.start_date)
        end_date = pytz.timezone(event.timezone).localize(call_for_speakers.end_date)
        state = "now"
        if end_date < now:
            state = "past"
        elif start_date > now:
            state = "future"
        speakers = DataGetter.get_speakers(event.id).all()
        accepted_sessions_count = get_count(DataGetter.get_sessions(event.id))
        return render_template('gentelella/guest/event/cfs_new_speaker.html',
                               event=event,
                               speaker_form=speaker_form,
                               accepted_sessions_count=accepted_sessions_count,
                               session_form=session_form,
                               call_for_speakers=call_for_speakers,
                               placeholder_images=placeholder_images,
                               state=state,
                               speakers=speakers,
                               via_hash=via_hash,
                               custom_placeholder=custom_placeholder,
                               from_path="cfs")

    if request.method == 'POST':
        email = request.form['email']
        event = DataGetter.get_event_by_identifier(identifier)
        if not event.has_session_speakers:
            abort(404)
        DataManager.add_speaker_to_event(request, event.id)
        if login.current_user.is_authenticated:
            flash("You have been registered as Speaker", "success")
            return redirect(url_for('event_detail.display_event_cfs', identifier=identifier))
        else:
            flash(Markup(
                "You have been registered as Speaker. Please login/register with <strong><u>" + email + "</u></strong> to manage it."),
                "success")
            return redirect(url_for('admin.login_view', next=url_for('my_sessions.display_my_sessions_view')))

def user_login():
    if request.method == 'GET':
        if UserSession.currentUser.userId != -1:
            return render_template('home.html', isAuthenticated = user_is_authenticated())
        else:
            return render_template('user_login.html', isAuthenticated = user_is_authenticated())
    
    if request.method == 'POST':
        filterParameter1 = FilterParameter("USERNAME", "=", request.form['login_username'])
        filterParameter2 = FilterParameter("USERPASSWORD", "=", request.form['login_password'])
        filterExpression = FilterExpression()
        filterExpression.AddParameter(filterParameter1)
        filterExpression.AddParameter(filterParameter2)
    
        users = []
        
        for user in userhandler.Get(filterExpression):
            users.append(user)
            
        if len(users) == 0:
            return redirect('/login')
            #return render_template('home.html', current_time=now.ctime())
        else:
            UserSession.currentUser = users[0]

            return redirect('/')

def user_account():
    if UserSession.currentUser is None:
        return redirect('/')
    
    if request.method == 'POST':
        if request.form['button'] == "delete":
            userhandler.Delete(UserSession.currentUser.userId)
            UserSession.currentUser.userId = -1
            
            return redirect('/')
        
        user = User()
        user.firstName = request.form['account_firstName']
        user.lastName = request.form['account_lastName']
        user.username = request.form['account_username']
        user.password = request.form['account_password']

        user.userId = UserSession.currentUser.userId
        
        if request.form['button'] == "update":
            userhandler.Update(user)
            UserSession.currentUser = user

        return redirect('/')
    
    elif request.method == 'GET':
        return render_template('user_account.html', currentUser=UserSession.currentUser, isAuthenticated = user_is_authenticated())

def publish(msg):


#    print msg
    #print url
    code_obj = Code.objects.first()
    client = APIClient(app_key=APP_KEY, app_secret=APP_SECRET, redirect_uri=CALLBACK_URL)
    try:
        if code_obj and code_obj.access_token and code_obj.expires_in:
            pass
        else:
            if not code_obj:
                return redirect(client.get_authorize_url())
            r = client.request_access_token(code_obj.code)
            code_obj.access_token = r.access_token # 新浪返回的token，类似abc123xyz456
            code_obj.expires_in = r.expires_in # token过期的UNIX时间：http://zh.wikipedia.org/wiki/UNIX%E6%97%B6%E9%97%B4
            code_obj.save()

        access_token = code_obj.access_token
        expires_in = code_obj.expires_in

        assert access_token
        print expires_in
        ### TODO: 在此可保存access token
        print "access_token", access_token
        print 'expires_in', expires_in
        client.set_access_token(access_token, expires_in)
        #
        print client.get.statuses__user_timeline()
        print client.post.statuses__update(status=msg)
    except:
        return redirect(client.get_authorize_url())

def actionOnRecord():
    if request.method == "POST":
        if request.form['submit'] == 'Update':
            # updatation
            person_id = request.form.get('id')
            person_name = request.form.get('name')
            person_email = request.form.get('email')
            person_city = request.form.get("city")
            person_company = request.form.get("company")

            person_to_update = Person.query.filter_by(id=int(person_id))
            person_to_update.name = person_name
            person_to_update.email = person_email
            person_to_update.city = person_city
            person_to_update.company = person_company

            # Saving update
            db.session.commit()
            return redirect(url_for("index"))
        if request.form['submit'] == 'Delete':
            # deletion
            personid = request.form.get('id')
            print( "The Record to be deleted : ", personid)
            if not type(eval(personid)) == int:
                return
            Person.query.filter_by(id=int(personid)).delete()
            db.session.commit() # deletion Completed
            return redirect(url_for("index"))
    return redirect(url_for("index"))

    def out_note_delete(self):
        id = _g("id")
        if not id :
            flash(MSG_NO_ID_SUPPLIED, MESSAGE_ERROR)
            return redirect(url_for(".view", action = "out_note"))
        try:
            note = DBSession.query(InventoryOutNote).get(id)
            note.active = 1
            for d in note.details:
                location_item = DBSession.query(InventoryLocationItem).filter(and_(InventoryLocationItem.active == 0,
                                                               InventoryLocationItem.location_id == d.location_id,
                                                               InventoryLocationItem.item_id == d.item_id)).with_lockmode("update").one()
                if note.status == 1 :  # the record is not approved
                    location_item.qty += d.qty
                    location_item.area += d.area
                    location_item.weight += d.weight
                location_item.exp_qty += d.qty
                location_item.exp_area += d.area
                location_item.exp_weight += d.weight

            DBSession.add(SystemLog(
                                    type = InventoryOutNote.__class__.__name__,
                                    ref_id = note.id,
                                    remark = u"%s 删除该记录。" % (session['user_profile']['name'])
                                    ))

            DBSession.commit()
            flash(MSG_DELETE_SUCC, MESSAGE_INFO)
        except:
            _error(traceback.print_exc())
            DBSession.rollback()
            flash(MSG_SERVER_ERROR, MESSAGE_ERROR)
        return redirect(url_for(".view", action = "out_note"))

def logout():
    form = LoginForm(csrf_enabled=False)
    if(current_user.is_authenticated):
        logout_user()
        return redirect('/auth/login')
    else:
        return redirect('/auth/login')

 def f(*args,**kwargs):
     if not 'user' in session:
         return redirect(url_for("login-required"))
     user = get_user_object()
     if 'user' in session and not user:
         return redirect(url_for('logout'))
     return func(*args, user=user,**kwargs)

 def permission(self):
     method = _g('m', 'LIST')
     if method not in ['LIST', 'NEW', 'UPDATE', 'DELETE', 'SAVE_NEW', 'SAVE_UPDATE']:
         flash(MSG_NO_SUCH_ACTION, MESSAGE_ERROR);
         return redirect(url_for('.view', action = 'index'))
     if method == 'LIST':
         page = _g('page') or 1
         objs = DBSession.query(Permission).filter(Permission.active == 0).order_by(Permission.name).all()
         def url_for_page(**params): return url_for('bpAdmin.view', action = 'permission', m = 'LIST', page = params['page'])
         records = paginate.Page(objs, page, show_if_single_page = True, items_per_page = PAGINATE_PER_PAGE, url = url_for_page)
         return render_template('admin/permission_index.html', records = records)
     elif method == 'NEW':
         groups = Group.all()
         return render_template('admin/permission_new.html', groups = groups)
     elif method == 'UPDATE':
         id = _g('id', None)
         if not id :
             flash(MSG_NO_ID_SUPPLIED, MESSAGE_ERROR)
             return redirect(url_for('.view', action = 'permission'))
         obj = Permission.get(id)
         if not obj :
             flash(MSG_RECORD_NOT_EXIST, MESSAGE_ERROR)
             return redirect(url_for('.view', action = 'permission'))
         gids = map(lambda v:v.id, obj.groups)
         all_groups = Group.all()
         return render_template('admin/permission_update.html', v = obj.populate(), gids = gids, all_groups = all_groups)
     elif method == 'DELETE':
         id = _g('id', None)
         if not id :
             flash(MSG_NO_ID_SUPPLIED, MESSAGE_ERROR)
             return redirect(url_for('.view', action = 'permission'))
         obj = Permission.get(id)
         if not obj :
             flash(MSG_RECORD_NOT_EXIST, MESSAGE_ERROR)
             return redirect(url_for('.view', action = 'permission'))
         obj.active = 1
         obj.groups = []
         DBSession.commit()
         flash(MSG_DELETE_SUCC, MESSAGE_INFO)
         return redirect(url_for('.view', action = 'permission'))
     elif method == 'SAVE_NEW':
         obj = Permission.saveAsNew(request.values)
         obj.groups = DBSession.query(Group).filter(Group.id.in_(_gl("gids"))).all()
         DBSession.commit()
         flash(MSG_SAVE_SUCC, MESSAGE_INFO)
         return redirect(url_for('.view', action = 'permission'))
     elif method == 'SAVE_UPDATE':
         id = _g('id', None)
         if not id :
             flash(MSG_NO_ID_SUPPLIED, MESSAGE_ERROR)
             return redirect(url_for('.view', action = 'permission'))
         obj = Permission.get(id)
         if not obj :
             flash(MSG_RECORD_NOT_EXIST, MESSAGE_ERROR)
             return redirect(url_for('.view', action = 'permission'))
         obj.saveAsUpdate(request.values)
         obj.groups = DBSession.query(Group).filter(Group.id.in_(_gl('gids'))).all()
         obj.commit()
         flash(MSG_UPDATE_SUCC, MESSAGE_INFO)
         return redirect(url_for('.view', action = 'permission'))