Mercurial > p > roundup > code

annotate test/test_userauditor.py @ 4289:7275e3dec0e0

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Fix security-problem: If user hasn't permission on a message... ...(notably files and content properties) and is on the nosy list, the content was sent via email. We now check that user has permission on the message content and files properties. Also add a regression test for this.
author Ralf Schlatterbeck <schlatterbeck@users.sourceforge.net>
date Mon, 30 Nov 2009 14:45:44 +0000
parents 1d0d1921f083
children 6e3e4f24c753
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
3902
21420ba64b0d fuller email validition (request [SF#216291])
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3888
diff changeset
1 # $Id: test_userauditor.py,v 1.4 2007-09-12 21:11:14 jpend Exp $
3873
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
2
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
3 import os, unittest, shutil
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
4 from db_test_base import setupTracker
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
5
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
6 class UserAuditorTest(unittest.TestCase):
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
7 def setUp(self):
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
8 self.dirname = '_test_user_auditor'
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
9 self.instance = setupTracker(self.dirname)
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
10 self.db = self.instance.open('admin')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
11
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
12 try:
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
13 import pytz
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
14 self.pytz = True
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
15 except ImportError:
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
16 self.pytz = False
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
17
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
18 self.db.user.create(username='kyle', address='kyle@example.com',
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
19 realname='Kyle Broflovski', roles='User')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
20
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
21 def tearDown(self):
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
22 self.db.close()
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
23 try:
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
24 shutil.rmtree(self.dirname)
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
25 except OSError, error:
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
26 if error.errno not in (errno.ENOENT, errno.ESRCH): raise
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
27
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
28 def testBadTimezones(self):
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
29 self.assertRaises(ValueError, self.db.user.create, username='eric', timezone='24')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
30
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
31 userid = self.db.user.lookup('kyle')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
32
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
33 self.assertRaises(ValueError, self.db.user.set, userid, timezone='3000')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
34 self.assertRaises(ValueError, self.db.user.set, userid, timezone='24')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
35 self.assertRaises(ValueError, self.db.user.set, userid, timezone='-24')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
36 self.assertRaises(ValueError, self.db.user.set, userid, timezone='-3000')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
37
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
38 if self.pytz:
4087
1d0d1921f083 Adjust to interface change in pytz.
Stefan Seefeld <stefan@seefeld.name>
parents: 3902
diff changeset
39 try:
1d0d1921f083 Adjust to interface change in pytz.
Stefan Seefeld <stefan@seefeld.name>
parents: 3902
diff changeset
40 from pytz import UnknownTimeZoneError
1d0d1921f083 Adjust to interface change in pytz.
Stefan Seefeld <stefan@seefeld.name>
parents: 3902
diff changeset
41 except:
1d0d1921f083 Adjust to interface change in pytz.
Stefan Seefeld <stefan@seefeld.name>
parents: 3902
diff changeset
42 UnknownTimeZoneError = ValueError
1d0d1921f083 Adjust to interface change in pytz.
Stefan Seefeld <stefan@seefeld.name>
parents: 3902
diff changeset
43 self.assertRaises(UnknownTimeZoneError, self.db.user.set, userid, timezone='MiddleOf/Nowhere')
3873
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
44
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
45 def testGoodTimezones(self):
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
46 self.db.user.create(username='test_user01', timezone='12')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
47
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
48 if self.pytz:
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
49 self.db.user.create(username='test_user02', timezone='MST')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
50
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
51 userid = self.db.user.lookup('kyle')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
52
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
53 # TODO: roundup should accept non-integer offsets since those are valid
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
54 # this is the offset for Tehran, Iran
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
55 #self.db.user.set(userid, timezone='3.5')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
56
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
57 self.db.user.set(userid, timezone='-23')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
58 self.db.user.set(userid, timezone='23')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
59 self.db.user.set(userid, timezone='0')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
60
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
61 if self.pytz:
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
62 self.db.user.set(userid, timezone='US/Eastern')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
63
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
64 def testBadEmailAddresses(self):
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
65 userid = self.db.user.lookup('kyle')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
66 self.assertRaises(ValueError, self.db.user.set, userid, address='kyle @ example.com')
3902
21420ba64b0d fuller email validition (request [SF#216291])
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3888
diff changeset
67 self.assertRaises(ValueError, self.db.user.set, userid, address='one@example.com,two@example.com')
21420ba64b0d fuller email validition (request [SF#216291])
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3888
diff changeset
68 self.assertRaises(ValueError, self.db.user.set, userid, address='weird@@example.com')
21420ba64b0d fuller email validition (request [SF#216291])
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3888
diff changeset
69 self.assertRaises(ValueError, self.db.user.set, userid, address='embedded\nnewline@example.com')
21420ba64b0d fuller email validition (request [SF#216291])
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3888
diff changeset
70 # verify that we check alternates as well
21420ba64b0d fuller email validition (request [SF#216291])
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3888
diff changeset
71 self.assertRaises(ValueError, self.db.user.set, userid, alternate_addresses='kyle @ example.com')
21420ba64b0d fuller email validition (request [SF#216291])
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3888
diff changeset
72 # make sure we accept local style addresses
21420ba64b0d fuller email validition (request [SF#216291])
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3888
diff changeset
73 self.db.user.set(userid, address='kyle')
21420ba64b0d fuller email validition (request [SF#216291])
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3888
diff changeset
74 # verify we are case insensitive
21420ba64b0d fuller email validition (request [SF#216291])
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3888
diff changeset
75 self.db.user.set(userid, address='kyle@EXAMPLE.COM')
3873
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
76
3888
4fcf7a52767e fix [SF#611787]: ensure unique email addresses
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3874
diff changeset
77 def testUniqueEmailAddresses(self):
3902
21420ba64b0d fuller email validition (request [SF#216291])
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3888
diff changeset
78 self.db.user.create(username='kenny', address='kenny@example.com', alternate_addresses='sp_ken@example.com')
3888
4fcf7a52767e fix [SF#611787]: ensure unique email addresses
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3874
diff changeset
79 self.assertRaises(ValueError, self.db.user.create, username='test_user01', address='kenny@example.com')
4fcf7a52767e fix [SF#611787]: ensure unique email addresses
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3874
diff changeset
80 uid = self.db.user.create(username='eric', address='eric@example.com')
4fcf7a52767e fix [SF#611787]: ensure unique email addresses
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3874
diff changeset
81 self.assertRaises(ValueError, self.db.user.set, uid, address='kenny@example.com')
4fcf7a52767e fix [SF#611787]: ensure unique email addresses
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3874
diff changeset
82
3902
21420ba64b0d fuller email validition (request [SF#216291])
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3888
diff changeset
83 # make sure we check alternates
21420ba64b0d fuller email validition (request [SF#216291])
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3888
diff changeset
84 self.assertRaises(ValueError, self.db.user.set, uid, address='kenny@example.com')
21420ba64b0d fuller email validition (request [SF#216291])
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3888
diff changeset
85 self.assertRaises(ValueError, self.db.user.set, uid, address='sp_ken@example.com')
21420ba64b0d fuller email validition (request [SF#216291])
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3888
diff changeset
86 self.assertRaises(ValueError, self.db.user.set, uid, alternate_addresses='kenny@example.com')
21420ba64b0d fuller email validition (request [SF#216291])
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3888
diff changeset
87
3873
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
88 def testBadRoles(self):
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
89 userid = self.db.user.lookup('kyle')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
90 self.assertRaises(ValueError, self.db.user.set, userid, roles='BadRole')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
91 self.assertRaises(ValueError, self.db.user.set, userid, roles='User,BadRole')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
92
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
93 def testGoodRoles(self):
3874
4c8d853017f2 strip rolename & fix rolename unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3873
diff changeset
94 userid = self.db.user.lookup('kyle')
3873
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
95 # make sure we handle commas in weird places
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
96 self.db.user.set(userid, roles='User,')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
97 self.db.user.set(userid, roles=',User')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
98 # make sure we strip whitespace
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
99 self.db.user.set(userid, roles=' User ')
3874
4c8d853017f2 strip rolename & fix rolename unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3873
diff changeset
100 # check for all-whitespace (treat as no role)
4c8d853017f2 strip rolename & fix rolename unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3873
diff changeset
101 self.db.user.set(userid, roles=' ')
3873
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
102
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
103 def test_suite():
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
104 suite = unittest.TestSuite()
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
105 suite.addTest(unittest.makeSuite(UserAuditorTest))
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
106 return suite
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
107
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
108 if __name__ == '__main__':
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
109 runner = unittest.TextTestRunner()
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
110 unittest.main(testRunner=runner)
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
111
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
112 # vim: filetype=python sts=4 sw=4 et si
Roundup Issue Tracker: http://roundup-tracker.org/