radremedy/radremedy — pull request #140 by radioprotector (2014-10-25 01:55:48+00:00)
Title: Restrict admin views to administrators

Closes #108.

In the process of this change, I noticed that the regular user registration process was broken because we were checking for a non-null password on the User model instead of the password provided to the User constructor. I probably broke that a while back.

I also made the following changes:
- The main nav bar now includes context-sensitive links (Login/Logout/My Profile/Admin) as appropriate
- The `csrf_token()` function is now available for templates that don't have associated WTForms - this was needed to get logout links working properly with CSRF protection
- I updated the registration/login pages to use `form-control`, `form-remedy`, and `btn` classes as needed
- Attempting to go to the registration or login pages when you're already logged in kicks you back to the index
- Attempting to sign in with an inactive account no longer works
- Errors with login/signup are now flashed appropriately
- Validation for Admin user creation was inconsistent with the regular view with regards to password length, which would be an issue once invalid accounts tried to log in

This also means that people will need to create admin accounts in their database instance to ensure that they can access them. This is something of a chicken-and-egg problem because you can only flag accounts as admins through the administrative interface.
However, something like the following will set you up with an admin account with a password of 'password':

```sql
Insert Into user
(username, password, email, admin, active, date_created)
Values
('admin', '$2a$12$ntp/Q1EpOzmNETME2l5COeAtiTGLmfhhq.sdbFFpC612Pbpjp/ciG', 'info@radremedy.org', 1, 1, '2014-10-24')
```

You can also create a regular account and use something like [DB Browser for SQLite](http://sourceforge.net/projects/sqlitebrowser/) to mark the account as an admin.