### 本次升级、修复，请使用最新版：

+ 升级Python版本为3.8
+ 升级Django到3.2
+ 修复用户名中使用\被转义的问题
+ 重写了dingding模块，因为dingding开发者平台接口鉴权的一些变动，之前的一些接口不能再使用，本次重写。
+ 重写了ad模块，修改账号的一些判断逻辑。
+ 重写了用户账号的格式兼容，现在用户账号可以兼容：username、DOMAIN\username、username@abc.com这三种格式。
+ 优化了整体的代码逻辑，去掉一些冗余重复的代码。

resetpwd/admin.py

@@ -1,3 +0,0 @@
-from django.contrib import admin
-
-# Register your models here.

resetpwd/form.py

@@ -17,7 +17,7 @@ class CheckForm(c_forms.Form):
     )
     old_password = c_fields.CharField(error_messages={'required': '确认密码不能为空'})
     ensure_password = c_fields.CharField(error_messages={'required': '确认密码不能为空'})
-    user_email = c_fields.CharField(error_messages={'required': '邮箱不能为空', 'invalid': '邮箱格式错误'})
+    username = c_fields.CharField(error_messages={'required': '账号不能为空', 'invalid': '账号格式错误'})
 
     def clean(self):
         pwd0 = self.cleaned_data.get('old_password')

resetpwd/models.py

@@ -1,4 +0,0 @@
-from django.db import models
-from django import forms
-from django.contrib import auth
-

resetpwd/utils/ad.py

@@ -1,144 +0,0 @@
-from ldap3 import *
-from pwdselfservice.local_settings import *
-
-
-def __ad_connect():
-    """
-    AD连接器
-    :return:
-    """
-    username = str(AD_LOGIN_USER).lower()
-    server = Server(host=AD_HOST, use_ssl=True, port=636, get_info='ALL')
-    try:
-        conn = Connection(server, auto_bind=True, user=username, password=AD_LOGIN_USER_PWD, authentication='NTLM')
-        return conn
-    except Exception:
-        raise Exception('Server Error. Could not connect to Domain Controller')
-
-
-def ad_ensure_user_by_sam(username):
-    """
-    通过sAMAccountName查询某个用户是否在AD中
-    :param username:  除去@domain.com 的部分
-    :return: True or False
-    """
-    conn = __ad_connect()
-    base_dn = BASE_DN
-    condition = '(&(objectclass=person)(mail=' + username + '))'
-    attributes = ['sAMAccountName']
-    result = conn.search(base_dn, condition, attributes=attributes)
-    conn.unbind()
-    return result
-
-
-def ad_ensure_user_by_mail(user_mail_addr):
-    """
-    通过mail查询某个用户是否在AD中
-    :param user_mail_addr:
-    :return: True or False
-    """
-    conn = __ad_connect()
-    base_dn = BASE_DN
-    condition = '(&(objectclass=person)(mail=' + user_mail_addr + '))'
-    attributes = ['mail']
-    result = conn.search(base_dn, condition, attributes=attributes)
-    conn.unbind()
-    return result
-
-
-def ad_get_user_displayname_by_mail(user_mail_addr):
-    """
-    通过mail查询某个用户的显示名
-    :param user_mail_addr:
-    :return: user_displayname
-    """
-    conn = __ad_connect()
-    conn.search(BASE_DN, '(&(objectclass=person)(mail=' + user_mail_addr + '))', attributes=[
-        'displayName'])
-    user_displayname = conn.entries[0]['displayName']
-    conn.unbind()
-    return user_displayname
-
-
-def ad_get_user_dn_by_mail(user_mail_addr):
-    """
-    通过mail查询某个用户的完整DN
-    :param user_mail_addr:
-    :return: DN
-    """
-    conn = __ad_connect()
-    conn.search(BASE_DN,
-                '(&(objectclass=person)(mail=' + user_mail_addr + '))', attributes=['distinguishedName'])
-    user_dn = conn.entries[0]['distinguishedName']
-    conn.unbind()
-    return user_dn
-
-
-def ad_get_user_status_by_mail(user_mail_addr):
-    """
-    通过mail查询某个用户的账号状态
-    :param user_mail_addr:
-    :return: user_account_control code
-    """
-    conn = __ad_connect()
-    conn.search(BASE_DN,
-                '(&(objectclass=person)(mail=' + user_mail_addr + '))', attributes=['userAccountControl'])
-    user_account_control = conn.entries[0]['userAccountControl']
-    conn.unbind()
-    return user_account_control
-
-
-def ad_unlock_user_by_mail(user_mail_addr):
-    """
-    通过mail解锁某个用户
-    :param user_mail_addr:
-    :return:
-    """
-    conn = __ad_connect()
-    user_dn = ad_get_user_dn_by_mail(user_mail_addr)
-    result = conn.extend.microsoft.unlock_account(user="%s" % user_dn)
-    conn.unbind()
-    return result
-
-
-def ad_reset_user_pwd_by_mail(user_mail_addr, new_password):
-    """
-    通过mail重置某个用户的密码
-    :param user_mail_addr:
-    :return:
-    """
-    conn = __ad_connect()
-    user_dn = ad_get_user_dn_by_mail(user_mail_addr)
-    result = conn.extend.microsoft.modify_password(user="%s" % user_dn, new_password="%s" % new_password)
-    conn.unbind()
-    return result
-
-
-def ad_modify_user_pwd_by_mail(user_mail_addr, old_password, new_password):
-    """
-    通过mail修改某个用户的密码
-    :param user_mail_addr:
-    :return:
-    """
-    conn = __ad_connect()
-    user_dn = ad_get_user_dn_by_mail(user_mail_addr)
-    result = conn.extend.microsoft.modify_password(user="%s" % user_dn, new_password="%s" % new_password,
-                                                   old_password="%s" % old_password)
-    conn.unbind()
-    return result
-
-
-def ad_get_user_locked_status_by_mail(user_mail_addr):
-    """
-    通过mail获取某个用户账号是否被锁定
-    :param user_mail_addr:
-    :return: 如果结果是1601-01-01说明账号未锁定，返回0
-    """
-    conn = __ad_connect()
-    conn.search(BASE_DN, '(&(objectclass=person)(mail=' + user_mail_addr + '))', attributes=['lockoutTime'])
-    locked_status = conn.entries[0]['lockoutTime']
-    conn.unbind()
-    if '1601-01-01' in str(locked_status):
-        return 0
-    else:
-        return locked_status

resetpwd/utils/crypto.py

@@ -1,29 +0,0 @@
-import os
-import random
-
-try:
-    from cryptography.fernet import Fernet
-except ImportError:
-    os.system('pip3 install cryptography')
-    from cryptography.fernet import Fernet
-
-
-class Crypto(object):
-    """docstring for ClassName"""
-    def __init__(self, key):
-        self.factory = Fernet(key)
-
-    # 加密
-    def encrypt(self, string):
-        token = str(self.factory.encrypt(string.encode('utf-8')), 'utf-8')
-        return token
-
-    # 解密
-    def decrypt(self, token):
-        string = self.factory.decrypt(bytes(token.encode('utf-8'))).decode('utf-8')
-        return string
-
-
-if __name__ == '__main__':
-    key = Fernet.generate_key()
-    print(key)

resetpwd/utils/form.py

@@ -1,34 +0,0 @@
-from django.forms import fields as c_fields
-from django import forms as c_forms
-from django.core.exceptions import ValidationError
-
-
-class CheckForm(c_forms.Form):
-    new_password = c_fields.RegexField(
-        '(?=.*[0-9])(?=.*[a-zA-Z])(?=.*[^a-zA-Z0-9]).{8,30}',
-        # 密码必须同时包含大写、小写、数字和特殊字符其中三项且至少8位
-        strip=True,
-        min_length=8,
-        max_length=30,
-        error_messages={'required': '新密码不能为空.',
-                        'invalid': '密码必须包含数字，字母、特殊字符',
-                        'min_length': "密码长度不能小于8个字符",
-                        'max_length': "密码长度不能大于30个字符"}
-    )
-    old_password = c_fields.CharField(error_messages={'required': '确认密码不能为空'})
-    ensure_password = c_fields.CharField(error_messages={'required': '确认密码不能为空'})
-    user_email = c_fields.CharField(error_messages={'required': '邮箱不能为空', 'invalid': '邮箱格式错误'})
-
-    def clean(self):
-        pwd0 = self.cleaned_data.get('old_password')
-        pwd1 = self.cleaned_data.get('new_password')
-        pwd2 = self.cleaned_data.get('ensure_password')
-        if pwd1 == pwd2:
-            pass
-        elif pwd0 == pwd1:
-            # 这里异常模块导入要放在函数里面，放到文件开头有时会报错，找不到
-            from django.core.exceptions import ValidationError
-            raise ValidationError('新旧密码不能一样')
-        else:
-            from django.core.exceptions import ValidationError
-            raise ValidationError('新密码和确认密码输入不一致')

resetpwd/utils/pwdcheck.py

@@ -1,30 +0,0 @@
-from django.shortcuts import render, reverse, HttpResponsePermanentRedirect, redirect
-from django.http import *
-from django.contrib import messages
-from dingtalk import *
-from resetpwd.models import *
-from .crypto import Crypto
-from resetpwd.utils.ad import ad_get_user_locked_status_by_mail, ad_unlock_user_by_mail, ad_reset_user_pwd_by_mail, \
-    ad_get_user_status_by_mail, ad_ensure_user_by_mail, ad_modify_user_pwd_by_mail
-from .dingding import ding_get_userinfo_detail, ding_get_userid_by_unionid, ding_get_userinfo_by_code, \
-    ding_get_persistent_code, ding_get_access_token
-from pwdselfservice.local_settings import *
-from resetpwd.form import *
-
-
-class CustomPasswortValidator(object):
-
-    def __init__(self, min_length=1, max_length=30):
-        self.min_length = min_length
-
-    def validate(self, password):
-        special_characters = "[~\!@#\$%\^&\*\(\)_\+{}\":;'\[\]]"
-        if not any(char.isdigit() for char in password):
-            raise ValidationError(_('Password must contain at least %(min_length)d digit.') % {'min_length': self.min_length})
-        if not any(char.isalpha() for char in password):
-            raise ValidationError(_('Password must contain at least %(min_length)d letter.') % {'min_length': self.min_length})
-        if not any(char in special_characters for char in password):
-            raise ValidationError(_('Password must contain at least %(min_length)d special character.') % {'min_length': self.min_length})
-
-    def get_help_text(self):
-        return ""

resetpwd/views.py

@@ -1,129 +1,89 @@
-from django.shortcuts import render
-from django.http import *
-from resetpwd.utils.crypto import Crypto
-from resetpwd.utils.ad import ad_get_user_locked_status_by_mail, ad_unlock_user_by_mail, ad_reset_user_pwd_by_mail, \
-    ad_get_user_status_by_mail, ad_ensure_user_by_mail, ad_modify_user_pwd_by_mail
-from resetpwd.utils.dingding import ding_get_userinfo_detail, ding_get_userid_by_unionid, \
-    ding_get_persistent_code, ding_get_access_token
-from pwdselfservice.local_settings import *
-from .form import CheckForm
 import logging
+import sys
 
-msg_template = 'msg.html'
+from django.http import *
+from django.shortcuts import render
+
+from utils.ad_ops import *
+from utils.crypto import Crypto
+from utils.dingding_ops import *
+from utils.format_username import format2username
+from .form import CheckForm
+
+msg_template = 'messages.html'
 logger = logging.getLogger('django')
 
+ad_ops = AdOps()
+ding_ops = DingDingOps()
 
-def resetpwd_index(request):
+
+def index(request):
     """
-    用户修改密码
+    用户自行修改密码
     :param request:
     :return:
     """
     home_url = '%s://%s' % (request.scheme, HOME_URL)
-    app_id = DING_SELF_APP_ID
+    app_id = DING_MO_APP_ID
     if request.method == 'GET':
         return render(request, 'index.html', locals())
     else:
         logger.error('[异常]  请求方法：%s，请求路径：%s' % (request.method, request.path))
 
     if request.method == 'POST':
-        # 对前端提交的数据进行二次验证，防止恶意提交简单密码或串改账号。
+        # 对前端提交的数据进行二次验证，防止恶意提交简单密码或篡改账号。
         check_form = CheckForm(request.POST)
         if check_form.is_valid():
             form_obj = check_form.cleaned_data
-            user_email = form_obj.get("user_email")
+            username = form_obj.get("username")
             old_password = form_obj.get("old_password")
             new_password = form_obj.get("new_password")
         else:
-            msg = check_form.as_p().errors
-            logger.error('[异常]  请求方法：%s，请求路径：%s，错误信息：%s' % (request.method, request.path, msg))
+            _msg = check_form.as_p().errors
+            logger.error('[异常]  请求方法：%s，请求路径：%s，错误信息：%s' % (request.method, request.path, _msg))
             context = {
-                'msg': msg,
+                'msg': _msg,
                 'button_click': "window.location.href='%s'" % home_url,
                 'button_display': "返回主页"
             }
             return render(request, msg_template, context)
-
-        if user_email and old_password and new_password:
-            try:
-                # 判断账号是否被锁定
-                if ad_get_user_locked_status_by_mail(user_mail_addr=user_email) is not 0:
-                    context = {
-                        'msg': "此账号己被锁定，请先解锁账号。",
-                        'button_click': "window.history.back()",
-                        'button_display': "返回"
-                    }
-                    return render(request, msg_template, context)
-
-                # 514 66050是AD中账号被禁用的特定代码，这个可以在微软官网查到。
-                if ad_get_user_status_by_mail(user_mail_addr=user_email) == 514 or ad_get_user_status_by_mail(
-                        user_mail_addr=user_email) == 66050:
-                    context = {
-                        'msg': "此账号状态为己禁用，请联系HR确认账号是否正确。",
-                        'button_click': "window.location.href='%s'" % home_url,
-                        'button_display': "返回主页"
-                    }
-                    return render(request, msg_template, context)
-
-                try:
-                    result = ad_modify_user_pwd_by_mail(user_mail_addr=user_email, old_password=old_password,
-                                                        new_password=new_password)
-                    if result:
-                        context = {
-                            'msg': "密码己修改成功，请妥善保管密码。你可直接关闭此页面！",
-                            'button_click': "window.location.href='%s'" % home_url,
-                            'button_display': "返回主页"
-                        }
-                        return render(request, msg_template, context)
-
-                    else:
-                        context = {
-                            'msg': "密码未修改成功，请确认旧密码是否正确。",
-                            'button_click': "window.history.back()",
-                            'button_display': "返回"
-                        }
-                        return render(request, msg_template, context)
-
-                except IndexError:
-                    context = {
-                        'msg': "请确认邮箱账号[%s]是否正确？未能在Active Directory中检索到相关信息。" % user_email,
-                        'button_click': "window.location.href='%s'" % home_url,
-                        'button_display': "返回主页"
-                    }
-                    return render(request, msg_template, context)
-
-                except Exception as e:
-                    context = {
-                        'msg': "出现未预期的错误[%s]，请与管理员联系~" % str(e),
-                        'button_click': "window.location.href='%s'" % home_url,
-                        'button_display': "返回主页"
-                    }
-                    return render(request, msg_template, context)
-
-            except IndexError:
-                context = {
-                    'msg': "请确认邮箱账号[%s]是否正确？未能在Active Directory中检索到相关信息。" % user_email,
-                    'button_click': "window.location.href='%s'" % home_url,
-                    'button_display': "返回主页"
-                }
-                return render(request, msg_template, context)
-
-            except Exception as e:
-                context = {
-                    'msg': "出现未预期的错误[%s]，请与管理员联系~" % str(e),
-                    'button_click': "window.history.back()",
-                    'button_display': "返回"
-                }
-                return render(request, msg_template, context)
-
-        else:
+        # 格式化用户名
+        username = format2username(username)
+        # 检测账号状态
+        auth_status, auth_result = ad_ops.ad_auth_user(username=username, password=old_password)
+        if not auth_status:
             context = {
-                'msg': "用户名、旧密码、新密码参数不正确，请重新确认后输入。",
+                'msg': str(auth_result),
                 'button_click': "window.history.back()",
                 'button_display': "返回"
             }
             return render(request, msg_template, context)
 
+        # 514 66050是AD中账号被禁用的特定代码，这个可以在微软官网查到。
+        # 可能不是太准确
+        if ad_ops.ad_get_user_status_by_account(username) == 514 or ad_ops.ad_get_user_status_by_account(username) == 66050:
+            context = {
+                'msg': "此账号状态为己禁用，请联系HR确认账号是否正确。",
+                'button_click': "window.location.href='%s'" % home_url,
+                'button_display': "返回主页"
+            }
+            return render(request, msg_template, context)
+
+        reset_status, reset_result = ad_ops.ad_reset_user_pwd_by_account(username=username, new_password=new_password)
+        if reset_status:
+            context = {
+                'msg': "密码己修改成功，新密码稍后生效，请妥善保管。您可直接关闭此页面！",
+                'button_click': "window.location.href='%s'" % home_url,
+                'button_display': "返回主页"
+            }
+            return render(request, msg_template, context)
+        else:
+            context = {
+                'msg': "密码未修改成功，原因：{}" .format(reset_result),
+                'button_click': "window.history.back()",
+                'button_display': "返回"
+            }
+            return render(request, msg_template, context)
     else:
         context = {
             'msg': "请从主页进行修改密码操作或扫码验证用户信息。",
@@ -133,10 +93,9 @@ def resetpwd_index(request):
         return render(request, msg_template, context)
 
 
-def resetpwd_check_userinfo(request):
+def callback_check(request):
     """
-    钉钉扫码回调数据对用户在AD中进行验证
-    扫码之后从钉钉中取出用户的unionid
+    钉钉扫码回调数据之后，将用户账号在AD中进行验证，如果通过，则返回钉钉中取出用户的union_id
     :param request:
     :return:
     """
@@ -147,45 +106,48 @@ def resetpwd_check_userinfo(request):
     else:
         logger.error('[异常]  请求方法：%s，请求路径：%s，未能拿到CODE。' % (request.method, request.path))
     try:
-        unionid = ding_get_persistent_code(code, ding_get_access_token())
-        # 判断 unionid 在本企业钉钉中是否存在
-        if not unionid:
-            logger.error('[异常]  请求方法：%s，请求路径：%s，未能拿到unionid。' % (request.method, request.path))
+        union_status, union_id = ding_ops.ding_get_union_id_by_code(code)
+        # 判断 union_id 在本企业钉钉中是否存在
+        if not union_status:
+            logger.error('[异常]  请求方法：%s，请求路径：%s，未能拿到union_id。' % (request.method, request.path))
             context = {
-                'msg': '未能在钉钉企业通讯录中检索到相关信息，请确认当前登录钉钉的账号已在企业中注册！',
+                'msg': '未能在企业钉钉中检索到用户信息，错误信息：{}' .format(union_id),
                 'button_click': "window.location.href='%s'" % home_url,
                 'button_display': "返回主页"
             }
             return render(request, msg_template, context)
-
-        ding_user_info = ding_get_userinfo_detail(ding_get_userid_by_unionid(unionid))
-        try:
-            # 钉钉中此账号是否可用
-            if ding_user_info['active']:
-                crypto = Crypto(CRYPTO_KEY)
-                # 对unionid进行加密，因为unionid基本上固定不变的，为了防止unionid泄露而导致重复使用，进行加密后再传回。
-                unionid_cryto = crypto.encrypt(unionid)
-                # 配置cookie，通过cookie把加密后的用户unionid传到重置密码页面，并重定向到重置密码页面。
-                set_cookie = HttpResponseRedirect('resetpwd')
-                set_cookie.set_cookie('tmpid', unionid_cryto, expires=TMPID_COOKIE_AGE)
-                return set_cookie
-            else:
-                context = {
-                    'msg': '邮箱是[%s]的用户在钉钉中未激活或可能己离职' % ding_user_info['email'],
-                    'button_click': "window.location.href='%s'" % home_url,
-                    'button_display': "返回主页"
-                }
-                return render(request, msg_template, context)
-        except IndexError:
+        userid_status, user_result = ding_ops.ding_get_userid_by_union_id(union_id)
+        if not userid_status:
             context = {
-                'msg': "用户不存在或己离职",
+                'msg': '获取钉钉userid失败，错误信息：{}'.format(user_result),
+                'button_click': "window.location.href='%s'" % home_url,
+                'button_display': "返回主页"
+            }
+            return render(request, msg_template, context)
+        detail_status, ding_user_info = ding_ops.ding_get_userinfo_detail(user_result)
+        if not detail_status:
+            context = {
+                'msg': '获取钉钉用户信息失败，错误信息：{}'.format(ding_user_info),
+                'button_click': "window.location.href='%s'" % home_url,
+                'button_display': "返回主页"
+            }
+            return render(request, msg_template, context)
+        # 钉钉中此账号是否可用
+        if ding_user_info['active']:
+            crypto = Crypto(CRYPTO_KEY)
+            # 对union_id进行加密，因为union_id基本上固定不变的，为了防止union_id泄露而导致重复使用，进行加密后再传回。
+            union_id_cryto = crypto.encrypt(union_id)
+            # 配置cookie，通过cookie把加密后的用户union_id传到重置密码页面，并重定向到重置密码页面。
+            set_cookie = HttpResponseRedirect('resetPassword')
+            set_cookie.set_cookie('tmpid', union_id_cryto, expires=TMPID_COOKIE_AGE)
+            return set_cookie
+        else:
+            context = {
+                'msg': '[%s]在钉钉中未激活或可能己离职' % format2username(ding_user_info['name']),
                 'button_click': "window.location.href='%s'" % home_url,
                 'button_display': "返回主页"
             }
             return render(request, msg_template, context)
-        except Exception as e:
-            logger.error('[异常] ：%s' % str(e))
-
     except KeyError:
         context = {
             'msg': "错误，钉钉临时Code己失效，请从主页重新扫码。",
@@ -205,21 +167,22 @@ def resetpwd_check_userinfo(request):
         return render(request, msg_template, context)
 
 
-def resetpwd_reset(request):
+def reset_pwd_by_ding_callback(request):
     """
-    钉钉扫码并验证信息之后，在重置密码页面将用户邮箱进行绑定
+    钉钉扫码并验证信息通过之后，在重置密码页面将用户账号进行绑定
     :param request:
     :return:
     """
-    global unionid_crypto
+    global union_id_crypto
     home_url = '%s://%s' % (request.scheme, HOME_URL)
-    # 从cookie中提取unionid，并解密，然后对当前unionid的用户进行重置密码
+    # 从cookie中提取union_id，并解密，然后对当前union_id的用户进行重置密码
     if request.method == 'GET':
         try:
-            unionid_crypto = request.COOKIES.get('tmpid')
+            union_id_crypto = request.COOKIES.get('tmpid')
         except Exception as e:
+            union_id_crypto = None
             logger.error('[异常] ：%s' % str(e))
-        if not unionid_crypto:
+        if not union_id_crypto:
             logger.error('[异常]  请求方法：%s，请求路径：%s，未能拿到CODE或CODE己超时。' % (request.method, request.path))
             context = {
                 'msg': "会话己超时，请重新扫码验证用户信息。",
@@ -229,20 +192,35 @@ def resetpwd_reset(request):
             return render(request, msg_template, context)
         # 解密
         crypto = Crypto(CRYPTO_KEY)
-        unionid = crypto.decrypt(unionid_crypto)
-        # 通过unionid在钉钉中拿到用户的邮箱
-        user_email = ding_get_userinfo_detail(ding_get_userid_by_unionid(unionid))['email']
-        # 如果邮箱在钉钉中能提取，则提交到前端绑定
-        if user_email:
+        union_id = crypto.decrypt(union_id_crypto)
+        # 通过union_id在钉钉中拿到用户的邮箱，并格式化为username
+        userid_status, user_result = ding_ops.ding_get_userid_by_union_id(union_id)
+        if not userid_status:
             context = {
-                'user_email': user_email,
+                'msg': '获取钉钉userid失败，错误信息：{}'.format(user_result),
+                'button_click': "window.location.href='%s'" % home_url,
+                'button_display': "返回主页"
             }
-            return render(request, 'resetpwd.html', context)
+            return render(request, msg_template, context)
+        detail_status, ding_user_info = ding_ops.ding_get_userinfo_detail(user_result)
+        if not detail_status:
+            context = {
+                'msg': '获取钉钉用户信息失败，错误信息：{}'.format(ding_user_info),
+                'button_click': "window.location.href='%s'" % home_url,
+                'button_display': "返回主页"
+            }
+            return render(request, msg_template, context)
+        username = format2username(ding_user_info['email'])
+        # 如果邮箱在钉钉中能提取到，则格式化之后，提取出账号提交到前端绑定
+        if username:
+            context = {
+                'username': username,
+            }
+            return render(request, 'resetPassword.html', context)
         # 否则就是钉钉中此用户未配置邮箱，返回相关提示
         else:
             context = {
-                'msg': "%s 您好，企业钉钉中未能找到您账号的邮箱配置，请联系HR完善信息。" % ding_get_userinfo_detail(ding_get_userid_by_unionid(
-                    unionid))['name'],
+                'msg': "%s，您好，企业钉钉中未能找到您账号的邮箱配置，请联系HR完善信息。" % ding_user_info['name'],
                 'button_click': "window.location.href='%s'" % home_url,
                 'button_display': "返回主页"
             }
@@ -250,10 +228,14 @@ def resetpwd_reset(request):
 
     # 重置密码页面，输入新密码后点击提交
     elif request.method == 'POST':
-        new_password = request.POST.get('new_password').strip()
-        unionid_crypto = request.COOKIES.get('tmpid')
-        # 对cookie中的unionid进行超时验证，如果页面超时就不再做处理。
-        if not unionid_crypto:
+        _new_password = request.POST.get('new_password').strip()
+        try:
+            union_id_crypto = request.COOKIES.get('tmpid')
+        except Exception as e:
+            union_id_crypto = None
+            logger.error('[异常] ：%s' % str(e))
+        if not union_id_crypto:
+            logger.error('[异常]  请求方法：%s，请求路径：%s，未能拿到CODE或CODE己超时。' % (request.method, request.path))
             context = {
                 'msg': "会话己超时，请重新扫码验证用户信息。",
                 'button_click': "window.location.href='%s'" % home_url,
@@ -261,17 +243,32 @@ def resetpwd_reset(request):
             }
             return render(request, msg_template, context)
         crypto = Crypto(CRYPTO_KEY)
-        unionid = crypto.decrypt(unionid_crypto)
-        user_email = ding_get_userinfo_detail(ding_get_userid_by_unionid(unionid))['email']
-        if ad_ensure_user_by_mail(user_mail_addr=user_email) is False:
+        union_id = crypto.decrypt(union_id_crypto)
+        userid_status, user_result = ding_ops.ding_get_userid_by_union_id(union_id)
+        if not userid_status:
             context = {
-                'msg': "账号[%s]在AD中不存在，请确认当前钉钉扫码账号绑定的邮箱是否和您正在使用的邮箱一致？或者该邮箱账号己被禁用！\n猜测：您的邮箱是否是带有数字或其它字母区分？" % user_email,
+                'msg': '获取钉钉userid失败，错误信息：{}'.format(user_result),
                 'button_click': "window.location.href='%s'" % home_url,
                 'button_display': "返回主页"
             }
             return render(request, msg_template, context)
-        if ad_get_user_status_by_mail(user_mail_addr=user_email) == 514 or ad_get_user_status_by_mail(
-                user_mail_addr=user_email) == 66050:
+        detail_status, ding_user_info = ding_ops.ding_get_userinfo_detail(user_result)
+        if not detail_status:
+            context = {
+                'msg': '获取钉钉用户信息失败，错误信息：{}'.format(ding_user_info),
+                'button_click': "window.location.href='%s'" % home_url,
+                'button_display': "返回主页"
+            }
+            return render(request, msg_template, context)
+        username = format2username(ding_user_info['email'])
+        if ad_ops.ad_ensure_user_by_account(username) is False:
+            context = {
+                'msg': "账号[%s]在AD中不存在，请确认当前钉钉扫码账号绑定的邮箱是否和您正在使用的邮箱一致？或者该账号己被禁用！\n猜测：您的账号或邮箱是否是带有数字或其它字母区分？" % username,
+                'button_click': "window.location.href='%s'" % home_url,
+                'button_display': "返回主页"
+            }
+            return render(request, msg_template, context)
+        if ad_ops.ad_get_user_status_by_account(username) == 514 or ad_ops.ad_get_user_status_by_account(username) == 66050:
             context = {
                 'msg': "此账号状态为己禁用，请联系HR确认账号是否正确。",
                 'button_click': "window.location.href='%s'" % home_url,
@@ -279,34 +276,20 @@ def resetpwd_reset(request):
             }
             return render(request, msg_template, context)
 
-        try:
-            result = ad_reset_user_pwd_by_mail(user_mail_addr=user_email, new_password=new_password)
-            if result:
-                # 重置密码并执行一次解锁，防止重置后账号还是锁定状态。
-                ad_unlock_user_by_mail(user_email)
+        reset_status, result = ad_ops.ad_reset_user_pwd_by_account(username=username, new_password=_new_password)
+        if reset_status:
+            # 重置密码并执行一次解锁，防止重置后账号还是锁定状态。
+            unlock_status, result = ad_ops.ad_unlock_user_by_account(username)
+            if unlock_status:
                 context = {
                     'msg': "密码己重置成功，请妥善保管。你可以点击返回主页或直接关闭此页面！",
                     'button_click': "window.location.href='%s'" % home_url,
                     'button_display': "返回主页"
                 }
                 return render(request, msg_template, context)
-            else:
-                context = {
-                    'msg': "密码未重置成功，确认密码是否满足AD的复杂性要求。",
-                    'button_click': "window.location.href='%s'" % home_url,
-                    'button_display': "返回主页"
-                }
-                return render(request, msg_template, context)
-        except IndexError:
+        else:
             context = {
-                'msg': "请确认邮箱账号[%s]是否正确？未能在AD中检索到相关信息。" % user_email,
-                'button_click': "window.location.href='%s'" % home_url,
-                'button_display': "返回主页"
-            }
-            return render(request, msg_template, context)
-        except Exception as e:
-            context = {
-                'msg': "出现未预期的错误[%s]，请与管理员联系~" % str(e),
+                'msg': "密码未重置成功，错误信息：{}" .format(result),
                 'button_click': "window.location.href='%s'" % home_url,
                 'button_display': "返回主页"
             }
@@ -320,7 +303,7 @@ def resetpwd_reset(request):
         return render(request, msg_template, context)
 
 
-def resetpwd_unlock(request):
+def unlock_account(request):
     """
     解锁账号
     :param request:
@@ -328,8 +311,8 @@ def resetpwd_unlock(request):
     """
     home_url = '%s://%s' % (request.scheme, HOME_URL)
     if request.method == 'GET':
-        unionid_crypto = request.COOKIES.get('tmpid')
-        if not unionid_crypto:
+        _union_id_crypto = request.COOKIES.get('tmpid')
+        if not _union_id_crypto:
             context = {
                 'msg': "会话己超时，请重新扫码验证用户信息。",
                 'button_click': "window.location.href='%s'" % home_url,
@@ -337,16 +320,32 @@ def resetpwd_unlock(request):
             }
             return render(request, msg_template, context)
         crypto = Crypto(CRYPTO_KEY)
-        unionid = crypto.decrypt(unionid_crypto)
-        user_email = ding_get_userinfo_detail(ding_get_userid_by_unionid(unionid))['email']
+        union_id = crypto.decrypt(_union_id_crypto)
+        userid_status, user_result = ding_ops.ding_get_userid_by_union_id(union_id)
+        if not userid_status:
+            context = {
+                'msg': '获取钉钉userid失败，错误信息：{}'.format(user_result),
+                'button_click': "window.location.href='%s'" % home_url,
+                'button_display': "返回主页"
+            }
+            return render(request, msg_template, context)
+        detail_status, ding_user_info = ding_ops.ding_get_userinfo_detail(user_result)
+        if not detail_status:
+            context = {
+                'msg': '获取钉钉用户信息失败，错误信息：{}'.format(ding_user_info),
+                'button_click': "window.location.href='%s'" % home_url,
+                'button_display': "返回主页"
+            }
+            return render(request, msg_template, context)
+        username = format2username(ding_user_info['email'])
         context = {
-            'user_email': user_email,
+            'username': username,
         }
-        return render(request, 'resetpwd.html', context)
+        return render(request, 'resetPassword.html', context)
 
     elif request.method == 'POST':
-        unionid_crypto = request.COOKIES.get('tmpid')
-        if not unionid_crypto:
+        _union_id_crypto = request.COOKIES.get('tmpid')
+        if not _union_id_crypto:
             context = {
                 'msg': "会话己超时，请重新扫码验证用户信息。",
                 'button_click': "window.location.href='%s'" % home_url,
@@ -354,43 +353,44 @@ def resetpwd_unlock(request):
             }
             return render(request, msg_template, context)
         crypto = Crypto(CRYPTO_KEY)
-        unionid = crypto.decrypt(unionid_crypto)
-        user_email = ding_get_userinfo_detail(ding_get_userid_by_unionid(unionid))['email']
-        if ad_ensure_user_by_mail(user_mail_addr=user_email) is False:
+        union_id = crypto.decrypt(_union_id_crypto)
+        userid_status, user_result = ding_ops.ding_get_userid_by_union_id(union_id)
+        if not userid_status:
             context = {
-                'msg': "账号[%s]在AD中未能正确检索到，请确认当前钉钉扫码账号绑定的邮箱是否和您正在使用的邮箱一致？或者该邮箱账号己被禁用！\n猜测：您的邮箱是否是带有数字或其它字母区分？" %
-                       user_email,
+                'msg': '获取钉钉userid失败，错误信息：{}'.format(user_result),
+                'button_click': "window.location.href='%s'" % home_url,
+                'button_display': "返回主页"
+            }
+            return render(request, msg_template, context)
+        detail_status, ding_user_info = ding_ops.ding_get_userinfo_detail(user_result)
+        if not detail_status:
+            context = {
+                'msg': '获取钉钉用户信息失败，错误信息：{}'.format(ding_user_info),
+                'button_click': "window.location.href='%s'" % home_url,
+                'button_display': "返回主页"
+            }
+            return render(request, msg_template, context)
+        username = format2username(ding_user_info['email'])
+        if ad_ops.ad_ensure_user_by_account(username=username) is False:
+            context = {
+                'msg': "账号[%s]在AD中未能正确检索到，请确认当前钉钉扫码账号绑定的邮箱是否和您正在使用的邮箱一致？或者该账号己被禁用！\n猜测：您的账号或邮箱是否是带有数字或其它字母区分？" %
+                       username,
                 'button_click': "window.location.href='%s'" % home_url,
                 'button_display': "返回主页"
             }
             return render(request, msg_template, context)
         else:
-            try:
-                result = ad_unlock_user_by_mail(user_email)
-                if result:
-                    context = {
-                        'msg': "账号己解锁成功。你可以点击返回主页或直接关闭此页面！",
-                        'button_click': "window.location.href='%s'" % home_url,
-                        'button_display': "返回主页"
-                    }
-                    return render(request, msg_template, context)
-                else:
-                    context = {
-                        'msg': "账号未能解锁，请联系管理员确认该账号在AD的是否己禁用。",
-                        'button_click': "window.location.href='%s'" % home_url,
-                        'button_display': "返回主页"
-                    }
-                    return render(request, msg_template, context)
-            except IndexError:
+            unlock_status, result = ad_ops.ad_unlock_user_by_account(username)
+            if unlock_status:
                 context = {
-                    'msg': "请确认邮箱账号[%s]是否正确？未能在AD中检索到相关信息。" % user_email,
+                    'msg': "账号己解锁成功。你可以点击返回主页或直接关闭此页面！",
                     'button_click': "window.location.href='%s'" % home_url,
                     'button_display': "返回主页"
                 }
                 return render(request, msg_template, context)
-            except Exception as e:
+            else:
                 context = {
-                    'msg': "出现未预期的错误[%s]，请与管理员联系~" % str(e),
+                    'msg': "账号未能解锁，错误信息：{}" .format(result),
                     'button_click': "window.location.href='%s'" % home_url,
                     'button_display': "返回主页"
                 }
@@ -404,12 +404,12 @@ def resetpwd_unlock(request):
         return render(request, msg_template, context)
 
 
-def reset_msg(request):
-    msg = request.GET.get('msg')
+def messages(request):
+    _msg = request.GET.get('msg')
     button_click = request.GET.get('button_click')
     button_display = request.GET.get('button_display')
     context = {
-        'msg': msg,
+        'msg': _msg,
         'button_click': button_click,
         'button_display': button_display
     }