Mercurial > p > roundup > code
comparison test/test_actions.py @ 6684:9ca5cbffa0c4
Switch off using blank passwords for login
There is now a config.ini setting [web] login_empty_passwords to
enable logins for users without a password set. By default it's off
and every user must have a password.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Mon, 23 May 2022 17:31:50 -0400 |
| parents | 8269e89530e5 |
| children | 273c8c2b5042 |
comparison
equal
deleted
inserted
replaced
| 6683:12c5ddf865b1 | 6684:9ca5cbffa0c4 |
|---|---|
| 25 self.client.db.Otk = MockNull() | 25 self.client.db.Otk = MockNull() |
| 26 self.client.db.Otk.data = {} | 26 self.client.db.Otk.data = {} |
| 27 self.client.db.Otk.getall = self.data_get | 27 self.client.db.Otk.getall = self.data_get |
| 28 self.client.db.Otk.set = self.data_set | 28 self.client.db.Otk.set = self.data_set |
| 29 self.client.db.config.WEB_LOGIN_ATTEMPTS_MIN = 20 | 29 self.client.db.config.WEB_LOGIN_ATTEMPTS_MIN = 20 |
| 30 self.client.db.config.WEB_LOGIN_EMPTY_PASSWORDS = 0 | |
| 30 self.client._ok_message = [] | 31 self.client._ok_message = [] |
| 31 self.client._error_message = [] | 32 self.client._error_message = [] |
| 32 self.client.add_error_message = lambda x, escape=True: add_message( | 33 self.client.add_error_message = lambda x, escape=True: add_message( |
| 33 self.client._error_message, x, escape=escape) | 34 self.client._error_message, x, escape=escape) |
| 34 self.client.add_ok_message = lambda x : add_message( | 35 self.client.add_ok_message = lambda x : add_message( |
| 369 self.assertEqual(username, 'foo') | 370 self.assertEqual(username, 'foo') |
| 370 self.client.opendb = opendb | 371 self.client.opendb = opendb |
| 371 | 372 |
| 372 self.assertLoginLeavesMessages([], 'foo', 'right') | 373 self.assertLoginLeavesMessages([], 'foo', 'right') |
| 373 | 374 |
| 375 def testBlankPasswordLogin(self): | |
| 376 self.client.db.security.hasPermission = lambda *args, **kwargs: True | |
| 377 | |
| 378 self.client.db.user.get = lambda a,b: None | |
| 379 | |
| 380 def opendb(username): | |
| 381 self.assertEqual(username, 'blank') | |
| 382 self.client.opendb = opendb | |
| 383 | |
| 384 self.assertEqual(self.client.db.config.WEB_LOGIN_EMPTY_PASSWORDS, 0) | |
| 385 self.assertLoginLeavesMessages(['Invalid login'], 'blank', '' ) | |
| 386 | |
| 387 self.client.db.config.WEB_LOGIN_EMPTY_PASSWORDS = 1 | |
| 388 self.form.value[:] = [] # reset form | |
| 389 self.client._error_message = [] # reset errors | |
| 390 self.assertLoginLeavesMessages([], 'blank', '' ) | |
| 391 | |
| 392 # reset | |
| 393 self.client.db.user.get = lambda a,b: 'right' | |
| 394 self.client.db.config.WEB_LOGIN_EMPTY_PASSWORDS = 0 | |
| 395 | |
| 374 def testCorrectLoginRedirect(self): | 396 def testCorrectLoginRedirect(self): |
| 375 self.client.db.security.hasPermission = lambda *args, **kwargs: True | 397 self.client.db.security.hasPermission = lambda *args, **kwargs: True |
| 376 def opendb(username): | 398 def opendb(username): |
| 377 self.assertEqual(username, 'foo') | 399 self.assertEqual(username, 'foo') |
| 378 self.client.opendb = opendb | 400 self.client.opendb = opendb |
| 429 Default limit is 3/min, but that means we sleep for 20 | 451 Default limit is 3/min, but that means we sleep for 20 |
| 430 seconds so I override the default limit to speed this up. | 452 seconds so I override the default limit to speed this up. |
| 431 ''' | 453 ''' |
| 432 # Do the first login setting an invalid login name | 454 # Do the first login setting an invalid login name |
| 433 self.assertLoginLeavesMessages(['Invalid login'], 'nouser') | 455 self.assertLoginLeavesMessages(['Invalid login'], 'nouser') |
| 434 # use up the rest of the 20 login attempts | 456 # use up the rest of the 20 login attempts. Login name |
| 457 # persists. | |
| 435 for i in range(19): | 458 for i in range(19): |
| 436 self.client._error_message = [] | 459 self.client._error_message = [] |
| 437 self.assertLoginLeavesMessages(['Invalid login']) | 460 self.assertLoginLeavesMessages(['Invalid login']) |
| 438 | 461 |
| 439 self.assertRaisesMessage(Reject, LoginAction(self.client).handle, | 462 self.assertRaisesMessage(Reject, LoginAction(self.client).handle, |