← Back to branch summary

~ubuntu-branches/ubuntu/quantal/python-django/quantal-security

« back to all changes in this revision

Viewing changes to django/contrib/auth/tests/views.py

  • Committer: Bazaar Package Importer
  • Author(s): Chris Lamb
  • Date: 2010-05-21 07:52:55 UTC
  • mfrom: (1.3.6 upstream)
  • mto: This revision was merged to the branch mainline in revision 28.
  • Revision ID: james.westby@ubuntu.com-20100521075255-ii78v1dyfmyu3uzx
Tags: upstream-1.2
Import upstream version 1.2

Show diffs side-by-side

added added

removed removed

Lines of Context:
django/contrib/auth/tests/views.py
1
1
import os
2
2
import re
 
3
import urllib
3
4
 
4
5
from django.conf import settings
5
 
from django.contrib.auth import SESSION_KEY
 
6
from django.contrib.auth import SESSION_KEY, REDIRECT_FIELD_NAME
6
7
from django.contrib.auth.forms import AuthenticationForm
7
8
from django.contrib.sites.models import Site, RequestSite
8
9
from django.contrib.auth.models import User
37
38
 
38
39
class PasswordResetTest(AuthViewsTestCase):
39
40
 
40
 
    def setUp(self):
41
 
        self.old_LANGUAGES = settings.LANGUAGES
42
 
        self.old_LANGUAGE_CODE = settings.LANGUAGE_CODE
43
 
        settings.LANGUAGES = (('en', 'English'),)
44
 
        settings.LANGUAGE_CODE = 'en'
45
 
 
46
 
    def tearDown(self):
47
 
        settings.LANGUAGES = self.old_LANGUAGES
48
 
        settings.LANGUAGE_CODE = self.old_LANGUAGE_CODE
49
 
 
50
41
    def test_email_not_found(self):
51
42
        "Error is raised if the provided email address isn't currently registered"
52
43
        response = self.client.get('/password_reset/')
193
184
        self.assertEquals(response.context['site_name'], site.name)
194
185
        self.assert_(isinstance(response.context['form'], AuthenticationForm), 
195
186
                     'Login form is not an AuthenticationForm')
 
187
 
 
188
    def test_security_check(self, password='password'):
 
189
        login_url = reverse('django.contrib.auth.views.login')
 
190
 
 
191
        # Those URLs should not pass the security check
 
192
        for bad_url in ('http://example.com',
 
193
                        'https://example.com',
 
194
                        'ftp://exampel.com',
 
195
                        '//example.com'):
 
196
 
 
197
            nasty_url = '%(url)s?%(next)s=%(bad_url)s' % {
 
198
                'url': login_url,
 
199
                'next': REDIRECT_FIELD_NAME,
 
200
                'bad_url': urllib.quote(bad_url)
 
201
            }
 
202
            response = self.client.post(nasty_url, {
 
203
                'username': 'testclient',
 
204
                'password': password,
 
205
                }
 
206
            )
 
207
            self.assertEquals(response.status_code, 302)
 
208
            self.assertFalse(bad_url in response['Location'], "%s should be blocked" % bad_url)
 
209
 
 
210
        # Now, these URLs have an other URL as a GET parameter and therefore
 
211
        # should be allowed
 
212
        for url_ in ('http://example.com', 'https://example.com',
 
213
                    'ftp://exampel.com',  '//example.com'):
 
214
            safe_url = '%(url)s?%(next)s=/view/?param=%(safe_param)s' % {
 
215
                'url': login_url,
 
216
                'next': REDIRECT_FIELD_NAME,
 
217
                'safe_param': urllib.quote(url_)
 
218
            }
 
219
            response = self.client.post(safe_url, {
 
220
                    'username': 'testclient',
 
221
                    'password': password,
 
222
                }
 
223
            )
 
224
            self.assertEquals(response.status_code, 302)
 
225
            self.assertTrue('/view/?param=%s' % url_ in response['Location'], "/view/?param=%s should be allowed" % url_)
 
226
 
196
227
        
197
228
class LogoutTest(AuthViewsTestCase):
198
229
    urls = 'django.contrib.auth.tests.urls'