|
0
|
1 |
import os |
|
|
2 |
import re |
|
29
|
3 |
import urllib |
|
0
|
4 |
|
|
|
5 |
from django.conf import settings |
|
29
|
6 |
from django.contrib.auth import SESSION_KEY, REDIRECT_FIELD_NAME |
|
0
|
7 |
from django.contrib.auth.forms import AuthenticationForm |
|
|
8 |
from django.contrib.sites.models import Site, RequestSite |
|
|
9 |
from django.contrib.auth.models import User |
|
|
10 |
from django.test import TestCase |
|
|
11 |
from django.core import mail |
|
|
12 |
from django.core.urlresolvers import reverse |
|
|
13 |
|
|
|
14 |
class AuthViewsTestCase(TestCase): |
|
|
15 |
""" |
|
|
16 |
Helper base class for all the follow test cases. |
|
|
17 |
""" |
|
|
18 |
fixtures = ['authtestdata.json'] |
|
|
19 |
urls = 'django.contrib.auth.urls' |
|
|
20 |
|
|
|
21 |
def setUp(self): |
|
|
22 |
self.old_LANGUAGES = settings.LANGUAGES |
|
|
23 |
self.old_LANGUAGE_CODE = settings.LANGUAGE_CODE |
|
|
24 |
settings.LANGUAGES = (('en', 'English'),) |
|
|
25 |
settings.LANGUAGE_CODE = 'en' |
|
|
26 |
self.old_TEMPLATE_DIRS = settings.TEMPLATE_DIRS |
|
|
27 |
settings.TEMPLATE_DIRS = ( |
|
|
28 |
os.path.join( |
|
|
29 |
os.path.dirname(__file__), |
|
|
30 |
'templates' |
|
|
31 |
) |
|
|
32 |
,) |
|
|
33 |
|
|
|
34 |
def tearDown(self): |
|
|
35 |
settings.LANGUAGES = self.old_LANGUAGES |
|
|
36 |
settings.LANGUAGE_CODE = self.old_LANGUAGE_CODE |
|
|
37 |
settings.TEMPLATE_DIRS = self.old_TEMPLATE_DIRS |
|
|
38 |
|
|
|
39 |
class PasswordResetTest(AuthViewsTestCase): |
|
|
40 |
|
|
|
41 |
def test_email_not_found(self): |
|
|
42 |
"Error is raised if the provided email address isn't currently registered" |
|
|
43 |
response = self.client.get('/password_reset/') |
|
|
44 |
self.assertEquals(response.status_code, 200) |
|
|
45 |
response = self.client.post('/password_reset/', {'email': 'not_a_real_email@email.com'}) |
|
|
46 |
self.assertContains(response, "That e-mail address doesn't have an associated user account") |
|
|
47 |
self.assertEquals(len(mail.outbox), 0) |
|
|
48 |
|
|
|
49 |
def test_email_found(self): |
|
|
50 |
"Email is sent if a valid email address is provided for password reset" |
|
|
51 |
response = self.client.post('/password_reset/', {'email': 'staffmember@example.com'}) |
|
|
52 |
self.assertEquals(response.status_code, 302) |
|
|
53 |
self.assertEquals(len(mail.outbox), 1) |
|
|
54 |
self.assert_("http://" in mail.outbox[0].body) |
|
|
55 |
|
|
|
56 |
def _test_confirm_start(self): |
|
|
57 |
# Start by creating the email |
|
|
58 |
response = self.client.post('/password_reset/', {'email': 'staffmember@example.com'}) |
|
|
59 |
self.assertEquals(response.status_code, 302) |
|
|
60 |
self.assertEquals(len(mail.outbox), 1) |
|
|
61 |
return self._read_signup_email(mail.outbox[0]) |
|
|
62 |
|
|
|
63 |
def _read_signup_email(self, email): |
|
|
64 |
urlmatch = re.search(r"https?://[^/]*(/.*reset/\S*)", email.body) |
|
|
65 |
self.assert_(urlmatch is not None, "No URL found in sent email") |
|
|
66 |
return urlmatch.group(), urlmatch.groups()[0] |
|
|
67 |
|
|
|
68 |
def test_confirm_valid(self): |
|
|
69 |
url, path = self._test_confirm_start() |
|
|
70 |
response = self.client.get(path) |
|
|
71 |
# redirect to a 'complete' page: |
|
|
72 |
self.assertEquals(response.status_code, 200) |
|
|
73 |
self.assert_("Please enter your new password" in response.content) |
|
|
74 |
|
|
|
75 |
def test_confirm_invalid(self): |
|
|
76 |
url, path = self._test_confirm_start() |
|
|
77 |
# Let's munge the token in the path, but keep the same length, |
|
|
78 |
# in case the URLconf will reject a different length. |
|
|
79 |
path = path[:-5] + ("0"*4) + path[-1] |
|
|
80 |
|
|
|
81 |
response = self.client.get(path) |
|
|
82 |
self.assertEquals(response.status_code, 200) |
|
|
83 |
self.assert_("The password reset link was invalid" in response.content) |
|
|
84 |
|
|
|
85 |
def test_confirm_invalid_post(self): |
|
|
86 |
# Same as test_confirm_invalid, but trying |
|
|
87 |
# to do a POST instead. |
|
|
88 |
url, path = self._test_confirm_start() |
|
|
89 |
path = path[:-5] + ("0"*4) + path[-1] |
|
|
90 |
|
|
|
91 |
response = self.client.post(path, {'new_password1': 'anewpassword', |
|
|
92 |
'new_password2':' anewpassword'}) |
|
|
93 |
# Check the password has not been changed |
|
|
94 |
u = User.objects.get(email='staffmember@example.com') |
|
|
95 |
self.assert_(not u.check_password("anewpassword")) |
|
|
96 |
|
|
|
97 |
def test_confirm_complete(self): |
|
|
98 |
url, path = self._test_confirm_start() |
|
|
99 |
response = self.client.post(path, {'new_password1': 'anewpassword', |
|
|
100 |
'new_password2': 'anewpassword'}) |
|
|
101 |
# It redirects us to a 'complete' page: |
|
|
102 |
self.assertEquals(response.status_code, 302) |
|
|
103 |
# Check the password has been changed |
|
|
104 |
u = User.objects.get(email='staffmember@example.com') |
|
|
105 |
self.assert_(u.check_password("anewpassword")) |
|
|
106 |
|
|
|
107 |
# Check we can't use the link again |
|
|
108 |
response = self.client.get(path) |
|
|
109 |
self.assertEquals(response.status_code, 200) |
|
|
110 |
self.assert_("The password reset link was invalid" in response.content) |
|
|
111 |
|
|
|
112 |
def test_confirm_different_passwords(self): |
|
|
113 |
url, path = self._test_confirm_start() |
|
|
114 |
response = self.client.post(path, {'new_password1': 'anewpassword', |
|
|
115 |
'new_password2':' x'}) |
|
|
116 |
self.assertEquals(response.status_code, 200) |
|
|
117 |
self.assert_("The two password fields didn't match" in response.content) |
|
|
118 |
|
|
|
119 |
class ChangePasswordTest(AuthViewsTestCase): |
|
|
120 |
|
|
|
121 |
def login(self, password='password'): |
|
|
122 |
response = self.client.post('/login/', { |
|
|
123 |
'username': 'testclient', |
|
|
124 |
'password': password |
|
|
125 |
} |
|
|
126 |
) |
|
|
127 |
self.assertEquals(response.status_code, 302) |
|
|
128 |
self.assert_(response['Location'].endswith(settings.LOGIN_REDIRECT_URL)) |
|
|
129 |
|
|
|
130 |
def fail_login(self, password='password'): |
|
|
131 |
response = self.client.post('/login/', { |
|
|
132 |
'username': 'testclient', |
|
|
133 |
'password': password |
|
|
134 |
} |
|
|
135 |
) |
|
|
136 |
self.assertEquals(response.status_code, 200) |
|
|
137 |
self.assert_("Please enter a correct username and password. Note that both fields are case-sensitive." in response.content) |
|
|
138 |
|
|
|
139 |
def logout(self): |
|
|
140 |
response = self.client.get('/logout/') |
|
|
141 |
|
|
|
142 |
def test_password_change_fails_with_invalid_old_password(self): |
|
|
143 |
self.login() |
|
|
144 |
response = self.client.post('/password_change/', { |
|
|
145 |
'old_password': 'donuts', |
|
|
146 |
'new_password1': 'password1', |
|
|
147 |
'new_password2': 'password1', |
|
|
148 |
} |
|
|
149 |
) |
|
|
150 |
self.assertEquals(response.status_code, 200) |
|
|
151 |
self.assert_("Your old password was entered incorrectly. Please enter it again." in response.content) |
|
|
152 |
|
|
|
153 |
def test_password_change_fails_with_mismatched_passwords(self): |
|
|
154 |
self.login() |
|
|
155 |
response = self.client.post('/password_change/', { |
|
|
156 |
'old_password': 'password', |
|
|
157 |
'new_password1': 'password1', |
|
|
158 |
'new_password2': 'donuts', |
|
|
159 |
} |
|
|
160 |
) |
|
|
161 |
self.assertEquals(response.status_code, 200) |
|
|
162 |
self.assert_("The two password fields didn't match." in response.content) |
|
|
163 |
|
|
|
164 |
def test_password_change_succeeds(self): |
|
|
165 |
self.login() |
|
|
166 |
response = self.client.post('/password_change/', { |
|
|
167 |
'old_password': 'password', |
|
|
168 |
'new_password1': 'password1', |
|
|
169 |
'new_password2': 'password1', |
|
|
170 |
} |
|
|
171 |
) |
|
|
172 |
self.assertEquals(response.status_code, 302) |
|
|
173 |
self.assert_(response['Location'].endswith('/password_change/done/')) |
|
|
174 |
self.fail_login() |
|
|
175 |
self.login(password='password1') |
|
|
176 |
|
|
|
177 |
class LoginTest(AuthViewsTestCase): |
|
|
178 |
|
|
|
179 |
def test_current_site_in_context_after_login(self): |
|
|
180 |
response = self.client.get(reverse('django.contrib.auth.views.login')) |
|
|
181 |
self.assertEquals(response.status_code, 200) |
|
|
182 |
site = Site.objects.get_current() |
|
|
183 |
self.assertEquals(response.context['site'], site) |
|
|
184 |
self.assertEquals(response.context['site_name'], site.name) |
|
|
185 |
self.assert_(isinstance(response.context['form'], AuthenticationForm), |
|
|
186 |
'Login form is not an AuthenticationForm') |
|
29
|
187 |
|
|
|
188 |
def test_security_check(self, password='password'): |
|
|
189 |
login_url = reverse('django.contrib.auth.views.login') |
|
|
190 |
|
|
|
191 |
# Those URLs should not pass the security check |
|
|
192 |
for bad_url in ('http://example.com', |
|
|
193 |
'https://example.com', |
|
|
194 |
'ftp://exampel.com', |
|
|
195 |
'//example.com'): |
|
|
196 |
|
|
|
197 |
nasty_url = '%(url)s?%(next)s=%(bad_url)s' % { |
|
|
198 |
'url': login_url, |
|
|
199 |
'next': REDIRECT_FIELD_NAME, |
|
|
200 |
'bad_url': urllib.quote(bad_url) |
|
|
201 |
} |
|
|
202 |
response = self.client.post(nasty_url, { |
|
|
203 |
'username': 'testclient', |
|
|
204 |
'password': password, |
|
|
205 |
} |
|
|
206 |
) |
|
|
207 |
self.assertEquals(response.status_code, 302) |
|
|
208 |
self.assertFalse(bad_url in response['Location'], "%s should be blocked" % bad_url) |
|
|
209 |
|
|
|
210 |
# Now, these URLs have an other URL as a GET parameter and therefore |
|
|
211 |
# should be allowed |
|
|
212 |
for url_ in ('http://example.com', 'https://example.com', |
|
|
213 |
'ftp://exampel.com', '//example.com'): |
|
|
214 |
safe_url = '%(url)s?%(next)s=/view/?param=%(safe_param)s' % { |
|
|
215 |
'url': login_url, |
|
|
216 |
'next': REDIRECT_FIELD_NAME, |
|
|
217 |
'safe_param': urllib.quote(url_) |
|
|
218 |
} |
|
|
219 |
response = self.client.post(safe_url, { |
|
|
220 |
'username': 'testclient', |
|
|
221 |
'password': password, |
|
|
222 |
} |
|
|
223 |
) |
|
|
224 |
self.assertEquals(response.status_code, 302) |
|
|
225 |
self.assertTrue('/view/?param=%s' % url_ in response['Location'], "/view/?param=%s should be allowed" % url_) |
|
|
226 |
|
|
0
|
227 |
|
|
|
228 |
class LogoutTest(AuthViewsTestCase): |
|
|
229 |
urls = 'django.contrib.auth.tests.urls' |
|
|
230 |
|
|
|
231 |
def login(self, password='password'): |
|
|
232 |
response = self.client.post('/login/', { |
|
|
233 |
'username': 'testclient', |
|
|
234 |
'password': password |
|
|
235 |
} |
|
|
236 |
) |
|
|
237 |
self.assertEquals(response.status_code, 302) |
|
|
238 |
self.assert_(response['Location'].endswith(settings.LOGIN_REDIRECT_URL)) |
|
|
239 |
self.assert_(SESSION_KEY in self.client.session) |
|
|
240 |
|
|
|
241 |
def confirm_logged_out(self): |
|
|
242 |
self.assert_(SESSION_KEY not in self.client.session) |
|
|
243 |
|
|
|
244 |
def test_logout_default(self): |
|
|
245 |
"Logout without next_page option renders the default template" |
|
|
246 |
self.login() |
|
|
247 |
response = self.client.get('/logout/') |
|
|
248 |
self.assertEquals(200, response.status_code) |
|
|
249 |
self.assert_('Logged out' in response.content) |
|
|
250 |
self.confirm_logged_out() |
|
|
251 |
|
|
|
252 |
def test_logout_with_next_page_specified(self): |
|
|
253 |
"Logout with next_page option given redirects to specified resource" |
|
|
254 |
self.login() |
|
|
255 |
response = self.client.get('/logout/next_page/') |
|
|
256 |
self.assertEqual(response.status_code, 302) |
|
|
257 |
self.assert_(response['Location'].endswith('/somewhere/')) |
|
|
258 |
self.confirm_logged_out() |
|
|
259 |
|
|
|
260 |
def test_logout_with_redirect_argument(self): |
|
|
261 |
"Logout with query string redirects to specified resource" |
|
|
262 |
self.login() |
|
|
263 |
response = self.client.get('/logout/?next=/login/') |
|
|
264 |
self.assertEqual(response.status_code, 302) |
|
|
265 |
self.assert_(response['Location'].endswith('/login/')) |
|
|
266 |
self.confirm_logged_out() |
|
|
267 |
|
|
|
268 |
def test_logout_with_custom_redirect_argument(self): |
|
|
269 |
"Logout with custom query string redirects to specified resource" |
|
|
270 |
self.login() |
|
|
271 |
response = self.client.get('/logout/custom_query/?follow=/somewhere/') |
|
|
272 |
self.assertEqual(response.status_code, 302) |
|
|
273 |
self.assert_(response['Location'].endswith('/somewhere/')) |
|
|
274 |
self.confirm_logged_out() |