1 import os |
1 import os |
2 import re |
2 import re |
|
3 import urllib |
3 |
4 |
4 from django.conf import settings |
5 from django.conf import settings |
5 from django.contrib.auth import SESSION_KEY |
6 from django.contrib.auth import SESSION_KEY, REDIRECT_FIELD_NAME |
6 from django.contrib.auth.forms import AuthenticationForm |
7 from django.contrib.auth.forms import AuthenticationForm |
7 from django.contrib.sites.models import Site, RequestSite |
8 from django.contrib.sites.models import Site, RequestSite |
8 from django.contrib.auth.models import User |
9 from django.contrib.auth.models import User |
9 from django.test import TestCase |
10 from django.test import TestCase |
10 from django.core import mail |
11 from django.core import mail |
35 settings.LANGUAGE_CODE = self.old_LANGUAGE_CODE |
36 settings.LANGUAGE_CODE = self.old_LANGUAGE_CODE |
36 settings.TEMPLATE_DIRS = self.old_TEMPLATE_DIRS |
37 settings.TEMPLATE_DIRS = self.old_TEMPLATE_DIRS |
37 |
38 |
38 class PasswordResetTest(AuthViewsTestCase): |
39 class PasswordResetTest(AuthViewsTestCase): |
39 |
40 |
40 def setUp(self): |
|
41 self.old_LANGUAGES = settings.LANGUAGES |
|
42 self.old_LANGUAGE_CODE = settings.LANGUAGE_CODE |
|
43 settings.LANGUAGES = (('en', 'English'),) |
|
44 settings.LANGUAGE_CODE = 'en' |
|
45 |
|
46 def tearDown(self): |
|
47 settings.LANGUAGES = self.old_LANGUAGES |
|
48 settings.LANGUAGE_CODE = self.old_LANGUAGE_CODE |
|
49 |
|
50 def test_email_not_found(self): |
41 def test_email_not_found(self): |
51 "Error is raised if the provided email address isn't currently registered" |
42 "Error is raised if the provided email address isn't currently registered" |
52 response = self.client.get('/password_reset/') |
43 response = self.client.get('/password_reset/') |
53 self.assertEquals(response.status_code, 200) |
44 self.assertEquals(response.status_code, 200) |
54 response = self.client.post('/password_reset/', {'email': 'not_a_real_email@email.com'}) |
45 response = self.client.post('/password_reset/', {'email': 'not_a_real_email@email.com'}) |
191 site = Site.objects.get_current() |
182 site = Site.objects.get_current() |
192 self.assertEquals(response.context['site'], site) |
183 self.assertEquals(response.context['site'], site) |
193 self.assertEquals(response.context['site_name'], site.name) |
184 self.assertEquals(response.context['site_name'], site.name) |
194 self.assert_(isinstance(response.context['form'], AuthenticationForm), |
185 self.assert_(isinstance(response.context['form'], AuthenticationForm), |
195 'Login form is not an AuthenticationForm') |
186 'Login form is not an AuthenticationForm') |
|
187 |
|
188 def test_security_check(self, password='password'): |
|
189 login_url = reverse('django.contrib.auth.views.login') |
|
190 |
|
191 # Those URLs should not pass the security check |
|
192 for bad_url in ('http://example.com', |
|
193 'https://example.com', |
|
194 'ftp://exampel.com', |
|
195 '//example.com'): |
|
196 |
|
197 nasty_url = '%(url)s?%(next)s=%(bad_url)s' % { |
|
198 'url': login_url, |
|
199 'next': REDIRECT_FIELD_NAME, |
|
200 'bad_url': urllib.quote(bad_url) |
|
201 } |
|
202 response = self.client.post(nasty_url, { |
|
203 'username': 'testclient', |
|
204 'password': password, |
|
205 } |
|
206 ) |
|
207 self.assertEquals(response.status_code, 302) |
|
208 self.assertFalse(bad_url in response['Location'], "%s should be blocked" % bad_url) |
|
209 |
|
210 # Now, these URLs have an other URL as a GET parameter and therefore |
|
211 # should be allowed |
|
212 for url_ in ('http://example.com', 'https://example.com', |
|
213 'ftp://exampel.com', '//example.com'): |
|
214 safe_url = '%(url)s?%(next)s=/view/?param=%(safe_param)s' % { |
|
215 'url': login_url, |
|
216 'next': REDIRECT_FIELD_NAME, |
|
217 'safe_param': urllib.quote(url_) |
|
218 } |
|
219 response = self.client.post(safe_url, { |
|
220 'username': 'testclient', |
|
221 'password': password, |
|
222 } |
|
223 ) |
|
224 self.assertEquals(response.status_code, 302) |
|
225 self.assertTrue('/view/?param=%s' % url_ in response['Location'], "/view/?param=%s should be allowed" % url_) |
|
226 |
196 |
227 |
197 class LogoutTest(AuthViewsTestCase): |
228 class LogoutTest(AuthViewsTestCase): |
198 urls = 'django.contrib.auth.tests.urls' |
229 urls = 'django.contrib.auth.tests.urls' |
199 |
230 |
200 def login(self, password='password'): |
231 def login(self, password='password'): |