1 import os

     2 import re

     3 import urllib

     4 

     5 from django.conf import settings

     6 from django.contrib.auth import SESSION_KEY, REDIRECT_FIELD_NAME

     7 from django.contrib.auth.forms import AuthenticationForm

     8 from django.contrib.sites.models import Site, RequestSite

     9 from django.contrib.auth.models import User

    10 from django.test import TestCase

    11 from django.core import mail

    12 from django.core.urlresolvers import reverse

    13 

    14 class AuthViewsTestCase(TestCase):

    15     """

    16     Helper base class for all the follow test cases.

    17     """

    18     fixtures = ['authtestdata.json']

    19     urls = 'django.contrib.auth.urls'

    20 

    21     def setUp(self):

    22         self.old_LANGUAGES = settings.LANGUAGES

    23         self.old_LANGUAGE_CODE = settings.LANGUAGE_CODE

    24         settings.LANGUAGES = (('en', 'English'),)

    25         settings.LANGUAGE_CODE = 'en'

    26         self.old_TEMPLATE_DIRS = settings.TEMPLATE_DIRS

    27         settings.TEMPLATE_DIRS = (

    28             os.path.join(

    29                 os.path.dirname(__file__),

    30                 'templates'

    31             )

    32         ,)

    33 

    34     def tearDown(self):

    35         settings.LANGUAGES = self.old_LANGUAGES

    36         settings.LANGUAGE_CODE = self.old_LANGUAGE_CODE

    37         settings.TEMPLATE_DIRS = self.old_TEMPLATE_DIRS

    38 

    39 class PasswordResetTest(AuthViewsTestCase):

    40 

    41     def test_email_not_found(self):

    42         "Error is raised if the provided email address isn't currently registered"

    43         response = self.client.get('/password_reset/')

    44         self.assertEquals(response.status_code, 200)

    45         response = self.client.post('/password_reset/', {'email': 'not_a_real_email@email.com'})

    46         self.assertContains(response, "That e-mail address doesn't have an associated user account")

    47         self.assertEquals(len(mail.outbox), 0)

    48 

    49     def test_email_found(self):

    50         "Email is sent if a valid email address is provided for password reset"

    51         response = self.client.post('/password_reset/', {'email': 'staffmember@example.com'})

    52         self.assertEquals(response.status_code, 302)

    53         self.assertEquals(len(mail.outbox), 1)

    54         self.assert_("http://" in mail.outbox[0].body)

    55 

    56     def _test_confirm_start(self):

    57         # Start by creating the email

    58         response = self.client.post('/password_reset/', {'email': 'staffmember@example.com'})

    59         self.assertEquals(response.status_code, 302)

    60         self.assertEquals(len(mail.outbox), 1)

    61         return self._read_signup_email(mail.outbox[0])

    62 

    63     def _read_signup_email(self, email):

    64         urlmatch = re.search(r"https?://[^/]*(/.*reset/\S*)", email.body)

    65         self.assert_(urlmatch is not None, "No URL found in sent email")

    66         return urlmatch.group(), urlmatch.groups()[0]

    67 

    68     def test_confirm_valid(self):

    69         url, path = self._test_confirm_start()

    70         response = self.client.get(path)

    71         # redirect to a 'complete' page:

    72         self.assertEquals(response.status_code, 200)

    73         self.assert_("Please enter your new password" in response.content)

    74 

    75     def test_confirm_invalid(self):

    76         url, path = self._test_confirm_start()

    77         # Let's munge the token in the path, but keep the same length,

    78         # in case the URLconf will reject a different length.

    79         path = path[:-5] + ("0"*4) + path[-1]

    80 

    81         response = self.client.get(path)

    82         self.assertEquals(response.status_code, 200)

    83         self.assert_("The password reset link was invalid" in response.content)

    84 

    85     def test_confirm_invalid_post(self):

    86         # Same as test_confirm_invalid, but trying

    87         # to do a POST instead.

    88         url, path = self._test_confirm_start()

    89         path = path[:-5] + ("0"*4) + path[-1]

    90 

    91         response = self.client.post(path, {'new_password1': 'anewpassword',

    92                                            'new_password2':' anewpassword'})

    93         # Check the password has not been changed

    94         u = User.objects.get(email='staffmember@example.com')

    95         self.assert_(not u.check_password("anewpassword"))

    96 

    97     def test_confirm_complete(self):

    98         url, path = self._test_confirm_start()

    99         response = self.client.post(path, {'new_password1': 'anewpassword',

   100                                            'new_password2': 'anewpassword'})

   101         # It redirects us to a 'complete' page:

   102         self.assertEquals(response.status_code, 302)

   103         # Check the password has been changed

   104         u = User.objects.get(email='staffmember@example.com')

   105         self.assert_(u.check_password("anewpassword"))

   106 

   107         # Check we can't use the link again

   108         response = self.client.get(path)

   109         self.assertEquals(response.status_code, 200)

   110         self.assert_("The password reset link was invalid" in response.content)

   111 

   112     def test_confirm_different_passwords(self):

   113         url, path = self._test_confirm_start()

   114         response = self.client.post(path, {'new_password1': 'anewpassword',

   115                                            'new_password2':' x'})

   116         self.assertEquals(response.status_code, 200)

   117         self.assert_("The two password fields didn't match" in response.content)

   118 

   119 class ChangePasswordTest(AuthViewsTestCase):

   120 

   121     def login(self, password='password'):

   122         response = self.client.post('/login/', {

   123             'username': 'testclient',

   124             'password': password

   125             }

   126         )

   127         self.assertEquals(response.status_code, 302)

   128         self.assert_(response['Location'].endswith(settings.LOGIN_REDIRECT_URL))

   129 

   130     def fail_login(self, password='password'):

   131         response = self.client.post('/login/', {

   132             'username': 'testclient',

   133             'password': password

   134             }

   135         )

   136         self.assertEquals(response.status_code, 200)

   137         self.assert_("Please enter a correct username and password. Note that both fields are case-sensitive." in response.content)

   138 

   139     def logout(self):

   140         response = self.client.get('/logout/')

   141 

   142     def test_password_change_fails_with_invalid_old_password(self):

   143         self.login()

   144         response = self.client.post('/password_change/', {

   145             'old_password': 'donuts',

   146             'new_password1': 'password1',

   147             'new_password2': 'password1',

   148             }

   149         )

   150         self.assertEquals(response.status_code, 200)

   151         self.assert_("Your old password was entered incorrectly. Please enter it again." in response.content)

   152 

   153     def test_password_change_fails_with_mismatched_passwords(self):

   154         self.login()

   155         response = self.client.post('/password_change/', {

   156             'old_password': 'password',

   157             'new_password1': 'password1',

   158             'new_password2': 'donuts',

   159             }

   160         )

   161         self.assertEquals(response.status_code, 200)

   162         self.assert_("The two password fields didn't match." in response.content)

   163 

   164     def test_password_change_succeeds(self):

   165         self.login()

   166         response = self.client.post('/password_change/', {

   167             'old_password': 'password',

   168             'new_password1': 'password1',

   169             'new_password2': 'password1',

   170             }

   171         )

   172         self.assertEquals(response.status_code, 302)

   173         self.assert_(response['Location'].endswith('/password_change/done/'))

   174         self.fail_login()

   175         self.login(password='password1')

   176 

   177 class LoginTest(AuthViewsTestCase):

   178 

   179     def test_current_site_in_context_after_login(self):

   180         response = self.client.get(reverse('django.contrib.auth.views.login'))

   181         self.assertEquals(response.status_code, 200)

   182         site = Site.objects.get_current()

   183         self.assertEquals(response.context['site'], site)

   184         self.assertEquals(response.context['site_name'], site.name)

   185         self.assert_(isinstance(response.context['form'], AuthenticationForm), 

   186                      'Login form is not an AuthenticationForm')

   187 

   188     def test_security_check(self, password='password'):

   189         login_url = reverse('django.contrib.auth.views.login')

   190 

   191         # Those URLs should not pass the security check

   192         for bad_url in ('http://example.com',

   193                         'https://example.com',

   194                         'ftp://exampel.com',

   195                         '//example.com'):

   196 

   197             nasty_url = '%(url)s?%(next)s=%(bad_url)s' % {

   198                 'url': login_url,

   199                 'next': REDIRECT_FIELD_NAME,

   200                 'bad_url': urllib.quote(bad_url)

   201             }

   202             response = self.client.post(nasty_url, {

   203                 'username': 'testclient',

   204                 'password': password,

   205                 }

   206             )

   207             self.assertEquals(response.status_code, 302)

   208             self.assertFalse(bad_url in response['Location'], "%s should be blocked" % bad_url)

   209 

   210         # Now, these URLs have an other URL as a GET parameter and therefore

   211         # should be allowed

   212         for url_ in ('http://example.com', 'https://example.com',

   213                     'ftp://exampel.com',  '//example.com'):

   214             safe_url = '%(url)s?%(next)s=/view/?param=%(safe_param)s' % {

   215                 'url': login_url,

   216                 'next': REDIRECT_FIELD_NAME,

   217                 'safe_param': urllib.quote(url_)

   218             }

   219             response = self.client.post(safe_url, {

   220                     'username': 'testclient',

   221                     'password': password,

   222                 }

   223             )

   224             self.assertEquals(response.status_code, 302)

   225             self.assertTrue('/view/?param=%s' % url_ in response['Location'], "/view/?param=%s should be allowed" % url_)

   226 

   227         

   228 class LogoutTest(AuthViewsTestCase):

   229     urls = 'django.contrib.auth.tests.urls'

   230 

   231     def login(self, password='password'):

   232         response = self.client.post('/login/', {

   233             'username': 'testclient',

   234             'password': password

   235             }

   236         )

   237         self.assertEquals(response.status_code, 302)

   238         self.assert_(response['Location'].endswith(settings.LOGIN_REDIRECT_URL))

   239         self.assert_(SESSION_KEY in self.client.session)

   240 

   241     def confirm_logged_out(self):

   242         self.assert_(SESSION_KEY not in self.client.session)

   243 

   244     def test_logout_default(self):

   245         "Logout without next_page option renders the default template"

   246         self.login()

   247         response = self.client.get('/logout/')

   248         self.assertEquals(200, response.status_code)

   249         self.assert_('Logged out' in response.content)

   250         self.confirm_logged_out()

   251 

   252     def test_logout_with_next_page_specified(self): 

   253         "Logout with next_page option given redirects to specified resource"

   254         self.login()

   255         response = self.client.get('/logout/next_page/')

   256         self.assertEqual(response.status_code, 302)

   257         self.assert_(response['Location'].endswith('/somewhere/'))

   258         self.confirm_logged_out()

   259 

   260     def test_logout_with_redirect_argument(self):

   261         "Logout with query string redirects to specified resource"

   262         self.login()

   263         response = self.client.get('/logout/?next=/login/')

   264         self.assertEqual(response.status_code, 302)

   265         self.assert_(response['Location'].endswith('/login/'))

   266         self.confirm_logged_out()

   267 

   268     def test_logout_with_custom_redirect_argument(self):

   269         "Logout with custom query string redirects to specified resource"

   270         self.login()

   271         response = self.client.get('/logout/custom_query/?follow=/somewhere/')

   272         self.assertEqual(response.status_code, 302)

   273         self.assert_(response['Location'].endswith('/somewhere/'))

   274         self.confirm_logged_out()