2015-02-23 00:53:57 +00:00
|
|
|
import datetime
|
2013-02-13 22:10:43 +00:00
|
|
|
import itertools
|
2015-03-27 19:07:35 +00:00
|
|
|
import os
|
2008-07-31 20:47:53 +00:00
|
|
|
import re
|
2015-01-28 12:35:27 +00:00
|
|
|
from importlib import import_module
|
2018-08-17 21:43:00 +00:00
|
|
|
from unittest import mock
|
2017-12-19 19:05:10 +00:00
|
|
|
from urllib.parse import quote
|
2008-08-23 18:20:49 +00:00
|
|
|
|
2014-02-01 16:37:08 +00:00
|
|
|
from django.apps import apps
|
2014-12-17 21:10:57 +00:00
|
|
|
from django.conf import settings
|
2012-10-24 15:11:41 +00:00
|
|
|
from django.contrib.admin.models import LogEntry
|
2017-03-08 00:52:26 +00:00
|
|
|
from django.contrib.auth import (
|
|
|
|
BACKEND_SESSION_KEY, REDIRECT_FIELD_NAME, SESSION_KEY,
|
|
|
|
)
|
2015-01-28 12:35:27 +00:00
|
|
|
from django.contrib.auth.forms import (
|
|
|
|
AuthenticationForm, PasswordChangeForm, SetPasswordForm,
|
|
|
|
)
|
2018-09-13 13:08:41 +00:00
|
|
|
from django.contrib.auth.models import Permission, User
|
2016-07-20 16:32:19 +00:00
|
|
|
from django.contrib.auth.views import (
|
2017-01-13 14:17:54 +00:00
|
|
|
INTERNAL_RESET_SESSION_TOKEN, LoginView, logout_then_login,
|
|
|
|
redirect_to_login,
|
2016-07-20 16:32:19 +00:00
|
|
|
)
|
2018-09-13 13:08:41 +00:00
|
|
|
from django.contrib.contenttypes.models import ContentType
|
2015-01-28 12:35:27 +00:00
|
|
|
from django.contrib.sessions.middleware import SessionMiddleware
|
|
|
|
from django.contrib.sites.requests import RequestSite
|
2008-07-31 20:47:53 +00:00
|
|
|
from django.core import mail
|
2015-02-12 17:14:19 +00:00
|
|
|
from django.db import connection
|
2017-12-19 19:05:10 +00:00
|
|
|
from django.http import HttpRequest
|
2015-04-24 06:24:38 +00:00
|
|
|
from django.middleware.csrf import CsrfViewMiddleware, get_token
|
2017-01-13 14:17:54 +00:00
|
|
|
from django.test import Client, TestCase, override_settings
|
2018-03-12 15:48:46 +00:00
|
|
|
from django.test.client import RedirectCycleError
|
2015-12-30 15:51:16 +00:00
|
|
|
from django.urls import NoReverseMatch, reverse, reverse_lazy
|
2018-03-16 01:33:15 +00:00
|
|
|
from django.utils.http import urlsafe_base64_encode
|
2011-12-15 16:12:46 +00:00
|
|
|
|
2017-01-13 14:17:54 +00:00
|
|
|
from .client import PasswordResetConfirmClient
|
2016-02-04 16:47:51 +00:00
|
|
|
from .models import CustomUser, UUIDUser
|
2014-12-17 21:10:57 +00:00
|
|
|
from .settings import AUTH_TEMPLATES
|
2008-07-31 20:47:53 +00:00
|
|
|
|
2011-09-24 19:48:27 +00:00
|
|
|
|
2012-03-31 16:03:09 +00:00
|
|
|
@override_settings(
|
2016-02-05 20:56:52 +00:00
|
|
|
LANGUAGES=[('en', 'English')],
|
2012-03-31 16:03:09 +00:00
|
|
|
LANGUAGE_CODE='en',
|
2014-12-17 21:10:57 +00:00
|
|
|
TEMPLATES=AUTH_TEMPLATES,
|
2015-02-10 14:17:08 +00:00
|
|
|
ROOT_URLCONF='auth_tests.urls',
|
2012-03-31 16:03:09 +00:00
|
|
|
)
|
2009-04-10 15:50:51 +00:00
|
|
|
class AuthViewsTestCase(TestCase):
|
|
|
|
"""
|
|
|
|
Helper base class for all the follow test cases.
|
|
|
|
"""
|
2015-02-23 00:53:57 +00:00
|
|
|
|
|
|
|
@classmethod
|
|
|
|
def setUpTestData(cls):
|
2016-02-05 20:56:52 +00:00
|
|
|
cls.u1 = User.objects.create_user(username='testclient', password='password', email='testclient@example.com')
|
|
|
|
cls.u3 = User.objects.create_user(username='staff', password='password', email='staffmember@example.com')
|
2008-08-23 18:20:49 +00:00
|
|
|
|
2014-04-01 00:16:09 +00:00
|
|
|
def login(self, username='testclient', password='password'):
|
2010-09-10 19:38:57 +00:00
|
|
|
response = self.client.post('/login/', {
|
2014-04-01 00:16:09 +00:00
|
|
|
'username': username,
|
2011-12-15 16:12:46 +00:00
|
|
|
'password': password,
|
2013-10-18 09:02:43 +00:00
|
|
|
})
|
2014-10-28 10:02:56 +00:00
|
|
|
self.assertIn(SESSION_KEY, self.client.session)
|
2013-05-19 10:57:06 +00:00
|
|
|
return response
|
2010-09-10 19:38:57 +00:00
|
|
|
|
2012-10-24 15:11:41 +00:00
|
|
|
def logout(self):
|
|
|
|
response = self.client.get('/admin/logout/')
|
|
|
|
self.assertEqual(response.status_code, 200)
|
2014-10-28 10:02:56 +00:00
|
|
|
self.assertNotIn(SESSION_KEY, self.client.session)
|
2012-10-24 15:11:41 +00:00
|
|
|
|
2013-02-13 22:10:43 +00:00
|
|
|
def assertFormError(self, response, error):
|
|
|
|
"""Assert that error is found in response.context['form'] errors"""
|
|
|
|
form_errors = list(itertools.chain(*response.context['form'].errors.values()))
|
2017-01-24 11:22:42 +00:00
|
|
|
self.assertIn(str(error), form_errors)
|
2011-12-15 16:12:46 +00:00
|
|
|
|
2011-09-24 19:48:27 +00:00
|
|
|
|
2014-04-05 06:04:46 +00:00
|
|
|
@override_settings(ROOT_URLCONF='django.contrib.auth.urls')
|
2011-09-24 19:48:27 +00:00
|
|
|
class AuthViewNamedURLTests(AuthViewsTestCase):
|
|
|
|
|
|
|
|
def test_named_urls(self):
|
|
|
|
"Named URLs should be reversible"
|
|
|
|
expected_named_urls = [
|
|
|
|
('login', [], {}),
|
|
|
|
('logout', [], {}),
|
|
|
|
('password_change', [], {}),
|
|
|
|
('password_change_done', [], {}),
|
|
|
|
('password_reset', [], {}),
|
|
|
|
('password_reset_done', [], {}),
|
|
|
|
('password_reset_confirm', [], {
|
2013-06-21 20:59:33 +00:00
|
|
|
'uidb64': 'aaaaaaa',
|
2011-09-24 19:48:27 +00:00
|
|
|
'token': '1111-aaaaa',
|
|
|
|
}),
|
|
|
|
('password_reset_complete', [], {}),
|
|
|
|
]
|
|
|
|
for name, args, kwargs in expected_named_urls:
|
2017-03-07 21:00:43 +00:00
|
|
|
with self.subTest(name=name):
|
|
|
|
try:
|
|
|
|
reverse(name, args=args, kwargs=kwargs)
|
|
|
|
except NoReverseMatch:
|
|
|
|
self.fail("Reversal of url named '%s' failed with NoReverseMatch" % name)
|
2011-09-24 19:48:27 +00:00
|
|
|
|
|
|
|
|
2009-04-10 15:50:51 +00:00
|
|
|
class PasswordResetTest(AuthViewsTestCase):
|
|
|
|
|
2017-01-13 14:17:54 +00:00
|
|
|
def setUp(self):
|
|
|
|
self.client = PasswordResetConfirmClient()
|
|
|
|
|
2008-07-31 20:47:53 +00:00
|
|
|
def test_email_not_found(self):
|
2013-02-23 12:39:21 +00:00
|
|
|
"""If the provided email is not registered, don't raise any error but
|
|
|
|
also don't send any email."""
|
2008-07-31 20:47:53 +00:00
|
|
|
response = self.client.get('/password_reset/')
|
2011-03-03 15:04:39 +00:00
|
|
|
self.assertEqual(response.status_code, 200)
|
2008-07-31 20:47:53 +00:00
|
|
|
response = self.client.post('/password_reset/', {'email': 'not_a_real_email@email.com'})
|
2013-02-23 12:39:21 +00:00
|
|
|
self.assertEqual(response.status_code, 302)
|
2011-03-03 15:04:39 +00:00
|
|
|
self.assertEqual(len(mail.outbox), 0)
|
2008-08-23 18:20:49 +00:00
|
|
|
|
2008-07-31 20:47:53 +00:00
|
|
|
def test_email_found(self):
|
|
|
|
"Email is sent if a valid email address is provided for password reset"
|
|
|
|
response = self.client.post('/password_reset/', {'email': 'staffmember@example.com'})
|
2011-03-03 15:04:39 +00:00
|
|
|
self.assertEqual(response.status_code, 302)
|
|
|
|
self.assertEqual(len(mail.outbox), 1)
|
2014-10-28 10:02:56 +00:00
|
|
|
self.assertIn("http://", mail.outbox[0].body)
|
2011-03-03 15:04:39 +00:00
|
|
|
self.assertEqual(settings.DEFAULT_FROM_EMAIL, mail.outbox[0].from_email)
|
2013-07-31 02:29:34 +00:00
|
|
|
# optional multipart text/html email has been added. Make sure original,
|
|
|
|
# default functionality is 100% the same
|
|
|
|
self.assertFalse(mail.outbox[0].message().is_multipart())
|
|
|
|
|
2015-06-18 12:49:35 +00:00
|
|
|
def test_extra_email_context(self):
|
|
|
|
"""
|
|
|
|
extra_email_context should be available in the email template context.
|
|
|
|
"""
|
|
|
|
response = self.client.post(
|
|
|
|
'/password_reset_extra_email_context/',
|
|
|
|
{'email': 'staffmember@example.com'},
|
|
|
|
)
|
|
|
|
self.assertEqual(response.status_code, 302)
|
|
|
|
self.assertEqual(len(mail.outbox), 1)
|
|
|
|
self.assertIn('Email email context: "Hello!"', mail.outbox[0].body)
|
2019-05-23 12:22:41 +00:00
|
|
|
self.assertIn('http://custom.example.com/reset/', mail.outbox[0].body)
|
2015-06-18 12:49:35 +00:00
|
|
|
|
2013-07-31 02:29:34 +00:00
|
|
|
def test_html_mail_template(self):
|
|
|
|
"""
|
|
|
|
A multipart email with text/plain and text/html is sent
|
|
|
|
if the html_email_template parameter is passed to the view
|
|
|
|
"""
|
|
|
|
response = self.client.post('/password_reset/html_email_template/', {'email': 'staffmember@example.com'})
|
|
|
|
self.assertEqual(response.status_code, 302)
|
|
|
|
self.assertEqual(len(mail.outbox), 1)
|
|
|
|
message = mail.outbox[0].message()
|
|
|
|
self.assertEqual(len(message.get_payload()), 2)
|
|
|
|
self.assertTrue(message.is_multipart())
|
|
|
|
self.assertEqual(message.get_payload(0).get_content_type(), 'text/plain')
|
|
|
|
self.assertEqual(message.get_payload(1).get_content_type(), 'text/html')
|
2014-10-28 10:02:56 +00:00
|
|
|
self.assertNotIn('<html>', message.get_payload(0).get_payload())
|
|
|
|
self.assertIn('<html>', message.get_payload(1).get_payload())
|
2010-09-12 22:38:01 +00:00
|
|
|
|
|
|
|
def test_email_found_custom_from(self):
|
|
|
|
"Email is sent if a valid email address is provided for password reset when a custom from_email is provided."
|
|
|
|
response = self.client.post('/password_reset_from_email/', {'email': 'staffmember@example.com'})
|
2011-03-03 15:04:39 +00:00
|
|
|
self.assertEqual(response.status_code, 302)
|
|
|
|
self.assertEqual(len(mail.outbox), 1)
|
|
|
|
self.assertEqual("staffmember@example.com", mail.outbox[0].from_email)
|
2008-07-31 20:47:53 +00:00
|
|
|
|
2012-10-29 16:26:10 +00:00
|
|
|
# Skip any 500 handler action (like sending more mail...)
|
|
|
|
@override_settings(DEBUG_PROPAGATE_EXCEPTIONS=True)
|
2012-10-17 21:36:41 +00:00
|
|
|
def test_poisoned_http_host(self):
|
|
|
|
"Poisoned HTTP_HOST headers can't be used for reset emails"
|
|
|
|
# This attack is based on the way browsers handle URLs. The colon
|
|
|
|
# should be used to separate the port, but if the URL contains an @,
|
|
|
|
# the colon is interpreted as part of a username for login purposes,
|
|
|
|
# making 'evil.com' the request domain. Since HTTP_HOST is used to
|
|
|
|
# produce a meaningful reset URL, we need to be certain that the
|
|
|
|
# HTTP_HOST header isn't poisoned. This is done as a check when get_host()
|
|
|
|
# is invoked, but we check here as a practical consequence.
|
2018-04-28 13:20:27 +00:00
|
|
|
with self.assertLogs('django.security.DisallowedHost', 'ERROR'):
|
2013-10-19 23:33:10 +00:00
|
|
|
response = self.client.post(
|
|
|
|
'/password_reset/',
|
|
|
|
{'email': 'staffmember@example.com'},
|
|
|
|
HTTP_HOST='www.example:dr.frankenstein@evil.tld'
|
2013-10-18 09:02:43 +00:00
|
|
|
)
|
2018-04-28 13:20:27 +00:00
|
|
|
self.assertEqual(response.status_code, 400)
|
|
|
|
self.assertEqual(len(mail.outbox), 0)
|
2012-10-17 21:36:41 +00:00
|
|
|
|
2012-10-29 16:26:10 +00:00
|
|
|
# Skip any 500 handler action (like sending more mail...)
|
|
|
|
@override_settings(DEBUG_PROPAGATE_EXCEPTIONS=True)
|
2012-10-17 21:36:41 +00:00
|
|
|
def test_poisoned_http_host_admin_site(self):
|
|
|
|
"Poisoned HTTP_HOST headers can't be used for reset emails on admin views"
|
2018-04-28 13:20:27 +00:00
|
|
|
with self.assertLogs('django.security.DisallowedHost', 'ERROR'):
|
2013-10-19 23:33:10 +00:00
|
|
|
response = self.client.post(
|
|
|
|
'/admin_password_reset/',
|
|
|
|
{'email': 'staffmember@example.com'},
|
|
|
|
HTTP_HOST='www.example:dr.frankenstein@evil.tld'
|
2013-10-18 09:02:43 +00:00
|
|
|
)
|
2018-04-28 13:20:27 +00:00
|
|
|
self.assertEqual(response.status_code, 400)
|
|
|
|
self.assertEqual(len(mail.outbox), 0)
|
2013-05-15 23:14:28 +00:00
|
|
|
|
2008-07-31 20:47:53 +00:00
|
|
|
def _test_confirm_start(self):
|
|
|
|
# Start by creating the email
|
2013-08-04 16:17:10 +00:00
|
|
|
self.client.post('/password_reset/', {'email': 'staffmember@example.com'})
|
2011-03-03 15:04:39 +00:00
|
|
|
self.assertEqual(len(mail.outbox), 1)
|
2008-07-31 20:47:53 +00:00
|
|
|
return self._read_signup_email(mail.outbox[0])
|
|
|
|
|
|
|
|
def _read_signup_email(self, email):
|
|
|
|
urlmatch = re.search(r"https?://[^/]*(/.*reset/\S*)", email.body)
|
2014-10-28 10:02:56 +00:00
|
|
|
self.assertIsNotNone(urlmatch, "No URL found in sent email")
|
2008-07-31 20:47:53 +00:00
|
|
|
return urlmatch.group(), urlmatch.groups()[0]
|
|
|
|
|
|
|
|
def test_confirm_valid(self):
|
|
|
|
url, path = self._test_confirm_start()
|
|
|
|
response = self.client.get(path)
|
|
|
|
# redirect to a 'complete' page:
|
2012-04-14 13:35:25 +00:00
|
|
|
self.assertContains(response, "Please enter your new password")
|
2008-07-31 20:47:53 +00:00
|
|
|
|
|
|
|
def test_confirm_invalid(self):
|
|
|
|
url, path = self._test_confirm_start()
|
2009-03-31 16:07:07 +00:00
|
|
|
# Let's munge the token in the path, but keep the same length,
|
|
|
|
# in case the URLconf will reject a different length.
|
2011-12-15 16:12:46 +00:00
|
|
|
path = path[:-5] + ("0" * 4) + path[-1]
|
2008-07-31 20:47:53 +00:00
|
|
|
|
|
|
|
response = self.client.get(path)
|
2012-04-14 13:35:25 +00:00
|
|
|
self.assertContains(response, "The password reset link was invalid")
|
2008-07-31 20:47:53 +00:00
|
|
|
|
2010-11-04 12:36:55 +00:00
|
|
|
def test_confirm_invalid_user(self):
|
2017-02-03 01:43:21 +00:00
|
|
|
# A nonexistent user returns a 200 response, not a 404.
|
2013-06-21 20:59:33 +00:00
|
|
|
response = self.client.get('/reset/123456/1-1/')
|
|
|
|
self.assertContains(response, "The password reset link was invalid")
|
|
|
|
|
2011-01-24 08:02:40 +00:00
|
|
|
def test_confirm_overflow_user(self):
|
2016-10-27 07:53:39 +00:00
|
|
|
# A base36 user id that overflows int returns a 200 response.
|
2013-06-21 20:59:33 +00:00
|
|
|
response = self.client.get('/reset/zzzzzzzzzzzzz/1-1/')
|
|
|
|
self.assertContains(response, "The password reset link was invalid")
|
|
|
|
|
2008-07-31 20:47:53 +00:00
|
|
|
def test_confirm_invalid_post(self):
|
2016-10-27 07:53:39 +00:00
|
|
|
# Same as test_confirm_invalid, but trying to do a POST instead.
|
2008-07-31 20:47:53 +00:00
|
|
|
url, path = self._test_confirm_start()
|
2011-12-15 16:12:46 +00:00
|
|
|
path = path[:-5] + ("0" * 4) + path[-1]
|
2008-07-31 20:47:53 +00:00
|
|
|
|
2011-12-15 16:12:46 +00:00
|
|
|
self.client.post(path, {
|
|
|
|
'new_password1': 'anewpassword',
|
|
|
|
'new_password2': ' anewpassword',
|
|
|
|
})
|
2008-08-23 18:20:49 +00:00
|
|
|
# Check the password has not been changed
|
2008-07-31 20:47:53 +00:00
|
|
|
u = User.objects.get(email='staffmember@example.com')
|
2011-03-03 15:04:39 +00:00
|
|
|
self.assertTrue(not u.check_password("anewpassword"))
|
2008-07-31 20:47:53 +00:00
|
|
|
|
2016-11-21 16:21:43 +00:00
|
|
|
def test_confirm_invalid_hash(self):
|
|
|
|
"""A POST with an invalid token is rejected."""
|
|
|
|
u = User.objects.get(email='staffmember@example.com')
|
|
|
|
original_password = u.password
|
|
|
|
url, path = self._test_confirm_start()
|
|
|
|
path_parts = path.split('-')
|
|
|
|
path_parts[-1] = ("0") * 20 + '/'
|
|
|
|
path = '-'.join(path_parts)
|
|
|
|
|
|
|
|
response = self.client.post(path, {
|
|
|
|
'new_password1': 'anewpassword',
|
|
|
|
'new_password2': 'anewpassword',
|
|
|
|
})
|
|
|
|
self.assertIs(response.context['validlink'], False)
|
|
|
|
u.refresh_from_db()
|
|
|
|
self.assertEqual(original_password, u.password) # password hasn't changed
|
|
|
|
|
2008-07-31 20:47:53 +00:00
|
|
|
def test_confirm_complete(self):
|
|
|
|
url, path = self._test_confirm_start()
|
2016-04-08 02:04:45 +00:00
|
|
|
response = self.client.post(path, {'new_password1': 'anewpassword', 'new_password2': 'anewpassword'})
|
2008-08-23 18:20:49 +00:00
|
|
|
# Check the password has been changed
|
2008-07-31 20:47:53 +00:00
|
|
|
u = User.objects.get(email='staffmember@example.com')
|
2011-03-03 15:04:39 +00:00
|
|
|
self.assertTrue(u.check_password("anewpassword"))
|
2017-01-13 14:17:54 +00:00
|
|
|
# The reset token is deleted from the session.
|
|
|
|
self.assertNotIn(INTERNAL_RESET_SESSION_TOKEN, self.client.session)
|
2008-07-31 20:47:53 +00:00
|
|
|
|
|
|
|
# Check we can't use the link again
|
|
|
|
response = self.client.get(path)
|
2012-04-14 13:35:25 +00:00
|
|
|
self.assertContains(response, "The password reset link was invalid")
|
2008-07-31 20:47:53 +00:00
|
|
|
|
|
|
|
def test_confirm_different_passwords(self):
|
|
|
|
url, path = self._test_confirm_start()
|
2016-04-08 02:04:45 +00:00
|
|
|
response = self.client.post(path, {'new_password1': 'anewpassword', 'new_password2': 'x'})
|
2013-02-13 22:10:43 +00:00
|
|
|
self.assertFormError(response, SetPasswordForm.error_messages['password_mismatch'])
|
2011-12-15 16:12:46 +00:00
|
|
|
|
2013-05-19 10:57:06 +00:00
|
|
|
def test_reset_redirect_default(self):
|
2016-04-08 02:04:45 +00:00
|
|
|
response = self.client.post('/password_reset/', {'email': 'staffmember@example.com'})
|
2016-10-28 15:52:52 +00:00
|
|
|
self.assertRedirects(response, '/password_reset/done/', fetch_redirect_response=False)
|
2013-05-19 10:57:06 +00:00
|
|
|
|
|
|
|
def test_reset_custom_redirect(self):
|
2016-04-08 02:04:45 +00:00
|
|
|
response = self.client.post('/password_reset/custom_redirect/', {'email': 'staffmember@example.com'})
|
2016-10-28 15:52:52 +00:00
|
|
|
self.assertRedirects(response, '/custom/', fetch_redirect_response=False)
|
2013-05-19 10:57:06 +00:00
|
|
|
|
|
|
|
def test_reset_custom_redirect_named(self):
|
2016-04-08 02:04:45 +00:00
|
|
|
response = self.client.post('/password_reset/custom_redirect/named/', {'email': 'staffmember@example.com'})
|
2016-10-28 15:52:52 +00:00
|
|
|
self.assertRedirects(response, '/password_reset/', fetch_redirect_response=False)
|
2013-05-19 10:57:06 +00:00
|
|
|
|
|
|
|
def test_confirm_redirect_default(self):
|
|
|
|
url, path = self._test_confirm_start()
|
2016-04-08 02:04:45 +00:00
|
|
|
response = self.client.post(path, {'new_password1': 'anewpassword', 'new_password2': 'anewpassword'})
|
2016-10-28 15:52:52 +00:00
|
|
|
self.assertRedirects(response, '/reset/done/', fetch_redirect_response=False)
|
2013-05-19 10:57:06 +00:00
|
|
|
|
|
|
|
def test_confirm_redirect_custom(self):
|
|
|
|
url, path = self._test_confirm_start()
|
|
|
|
path = path.replace('/reset/', '/reset/custom/')
|
2016-04-08 02:04:45 +00:00
|
|
|
response = self.client.post(path, {'new_password1': 'anewpassword', 'new_password2': 'anewpassword'})
|
2016-10-28 15:52:52 +00:00
|
|
|
self.assertRedirects(response, '/custom/', fetch_redirect_response=False)
|
2013-05-19 10:57:06 +00:00
|
|
|
|
|
|
|
def test_confirm_redirect_custom_named(self):
|
|
|
|
url, path = self._test_confirm_start()
|
|
|
|
path = path.replace('/reset/', '/reset/custom/named/')
|
2016-04-08 02:04:45 +00:00
|
|
|
response = self.client.post(path, {'new_password1': 'anewpassword', 'new_password2': 'anewpassword'})
|
2016-10-28 15:52:52 +00:00
|
|
|
self.assertRedirects(response, '/password_reset/', fetch_redirect_response=False)
|
2013-05-19 10:57:06 +00:00
|
|
|
|
2019-05-23 12:18:49 +00:00
|
|
|
def test_confirm_custom_reset_url_token(self):
|
|
|
|
url, path = self._test_confirm_start()
|
|
|
|
path = path.replace('/reset/', '/reset/custom/token/')
|
|
|
|
self.client.reset_url_token = 'set-passwordcustom'
|
|
|
|
response = self.client.post(
|
|
|
|
path,
|
|
|
|
{'new_password1': 'anewpassword', 'new_password2': 'anewpassword'},
|
|
|
|
)
|
|
|
|
self.assertRedirects(response, '/reset/done/', fetch_redirect_response=False)
|
|
|
|
|
2016-07-27 22:33:07 +00:00
|
|
|
def test_confirm_login_post_reset(self):
|
|
|
|
url, path = self._test_confirm_start()
|
|
|
|
path = path.replace('/reset/', '/reset/post_reset_login/')
|
|
|
|
response = self.client.post(path, {'new_password1': 'anewpassword', 'new_password2': 'anewpassword'})
|
2016-10-28 15:52:52 +00:00
|
|
|
self.assertRedirects(response, '/reset/done/', fetch_redirect_response=False)
|
2016-07-27 22:33:07 +00:00
|
|
|
self.assertIn(SESSION_KEY, self.client.session)
|
|
|
|
|
2017-03-08 00:52:26 +00:00
|
|
|
@override_settings(
|
|
|
|
AUTHENTICATION_BACKENDS=[
|
|
|
|
'django.contrib.auth.backends.ModelBackend',
|
|
|
|
'django.contrib.auth.backends.AllowAllUsersModelBackend',
|
|
|
|
]
|
|
|
|
)
|
|
|
|
def test_confirm_login_post_reset_custom_backend(self):
|
2018-12-07 22:52:28 +00:00
|
|
|
# This backend is specified in the URL pattern.
|
2017-03-08 00:52:26 +00:00
|
|
|
backend = 'django.contrib.auth.backends.AllowAllUsersModelBackend'
|
|
|
|
url, path = self._test_confirm_start()
|
|
|
|
path = path.replace('/reset/', '/reset/post_reset_login_custom_backend/')
|
|
|
|
response = self.client.post(path, {'new_password1': 'anewpassword', 'new_password2': 'anewpassword'})
|
|
|
|
self.assertRedirects(response, '/reset/done/', fetch_redirect_response=False)
|
|
|
|
self.assertIn(SESSION_KEY, self.client.session)
|
|
|
|
self.assertEqual(self.client.session[BACKEND_SESSION_KEY], backend)
|
|
|
|
|
2017-02-14 22:35:42 +00:00
|
|
|
def test_confirm_login_post_reset_already_logged_in(self):
|
|
|
|
url, path = self._test_confirm_start()
|
|
|
|
path = path.replace('/reset/', '/reset/post_reset_login/')
|
|
|
|
self.login()
|
|
|
|
response = self.client.post(path, {'new_password1': 'anewpassword', 'new_password2': 'anewpassword'})
|
|
|
|
self.assertRedirects(response, '/reset/done/', fetch_redirect_response=False)
|
|
|
|
self.assertIn(SESSION_KEY, self.client.session)
|
|
|
|
|
2013-10-02 17:28:15 +00:00
|
|
|
def test_confirm_display_user_from_form(self):
|
|
|
|
url, path = self._test_confirm_start()
|
|
|
|
response = self.client.get(path)
|
2016-10-27 07:53:39 +00:00
|
|
|
# The password_reset_confirm() view passes the user object to the
|
|
|
|
# SetPasswordForm``, even on GET requests (#16919). For this test,
|
|
|
|
# {{ form.user }}`` is rendered in the template
|
|
|
|
# registration/password_reset_confirm.html.
|
2013-10-02 17:28:15 +00:00
|
|
|
username = User.objects.get(email='staffmember@example.com').username
|
|
|
|
self.assertContains(response, "Hello, %s." % username)
|
|
|
|
# However, the view should NOT pass any user object on a form if the
|
|
|
|
# password reset link was invalid.
|
|
|
|
response = self.client.get('/reset/zzzzzzzzzzzzz/1-1/')
|
|
|
|
self.assertContains(response, "Hello, .")
|
|
|
|
|
2017-01-13 14:17:54 +00:00
|
|
|
def test_confirm_link_redirects_to_set_password_page(self):
|
|
|
|
url, path = self._test_confirm_start()
|
|
|
|
# Don't use PasswordResetConfirmClient (self.client) here which
|
|
|
|
# automatically fetches the redirect page.
|
|
|
|
client = Client()
|
|
|
|
response = client.get(path)
|
|
|
|
token = response.resolver_match.kwargs['token']
|
|
|
|
uuidb64 = response.resolver_match.kwargs['uidb64']
|
|
|
|
self.assertRedirects(response, '/reset/%s/set-password/' % uuidb64)
|
|
|
|
self.assertEqual(client.session['_password_reset_token'], token)
|
|
|
|
|
2019-05-23 12:18:49 +00:00
|
|
|
def test_confirm_custom_reset_url_token_link_redirects_to_set_password_page(self):
|
|
|
|
url, path = self._test_confirm_start()
|
|
|
|
path = path.replace('/reset/', '/reset/custom/token/')
|
|
|
|
client = Client()
|
|
|
|
response = client.get(path)
|
|
|
|
token = response.resolver_match.kwargs['token']
|
|
|
|
uuidb64 = response.resolver_match.kwargs['uidb64']
|
|
|
|
self.assertRedirects(response, '/reset/custom/token/%s/set-passwordcustom/' % uuidb64)
|
|
|
|
self.assertEqual(client.session['_password_reset_token'], token)
|
|
|
|
|
2017-01-13 14:17:54 +00:00
|
|
|
def test_invalid_link_if_going_directly_to_the_final_reset_password_url(self):
|
|
|
|
url, path = self._test_confirm_start()
|
|
|
|
_, uuidb64, _ = path.strip('/').split('/')
|
|
|
|
response = Client().get('/reset/%s/set-password/' % uuidb64)
|
|
|
|
self.assertContains(response, 'The password reset link was invalid')
|
|
|
|
|
2008-07-31 20:47:53 +00:00
|
|
|
|
2016-02-04 16:47:51 +00:00
|
|
|
@override_settings(AUTH_USER_MODEL='auth_tests.CustomUser')
|
Fixed #3011 -- Added swappable auth.User models.
Thanks to the many people that contributed to the development and review of
this patch, including (but not limited to) Jacob Kaplan-Moss, Anssi
Kääriäinen, Ramiro Morales, Preston Holmes, Josh Ourisman, Thomas Sutton,
and Roger Barnes, as well as the many, many people who have contributed to
the design discussion around this ticket over many years.
Squashed commit of the following:
commit d84749a0f034a0a6906d20df047086b1219040d0
Merge: 531e771 7c11b1a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Wed Sep 26 18:37:04 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit 531e7715da545f930c49919a19e954d41c59b446
Merge: 29d1abb 1f84b04
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Wed Sep 26 07:09:23 2012 +0800
Merged recent trunk changes.
commit 29d1abbe351fd5da855fe5ce09e24227d90ddc91
Merge: 8a527dd 54c81a1
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Sep 24 07:49:46 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit 8a527dda13c9bec955b1f7e8db5822d1d9b32a01
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Sep 24 07:48:05 2012 +0800
Ensure sequences are reset correctly in the presence of swapped models.
commit e2b6e22f298eb986d74d28b8d9906f37f5ff8eb8
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 23 17:53:05 2012 +0800
Modifications to the handling and docs for auth forms.
commit 98aba856b534620aea9091f824b442b47d2fdb3c
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 23 15:28:57 2012 +0800
Improved error handling and docs for get_user_model()
commit 0229209c844f06dfeb33b0b8eeec000c127695b6
Merge: 6494bf9 8599f64
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 23 14:50:11 2012 +0800
Merged recent Django trunk changes.
commit 6494bf91f2ddaaabec3ec017f2e3131937c35517
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Sep 17 21:38:44 2012 +0800
Improved validation of swappable model settings.
commit 5a04cde342cc860384eb844cfda5af55204564ad
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Sep 17 07:15:14 2012 +0800
Removed some unused imports.
commit ffd535e4136dc54f084b6ac467e81444696e1c8a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 20:31:28 2012 +0800
Corrected attribute access on for get_by_natural_key
commit 913e1ac84c3d9c7c58a9b3bdbbb15ebccd8a8c0a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 20:12:34 2012 +0800
Added test for proxy model safeguards on swappable models.
commit 280bf19e94d0d534d0e51bae485c1842558f4ff4
Merge: dbb3900 935a863
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 18:16:49 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit dbb3900775a99df8b6cb1d7063cf364eab55621a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 18:09:27 2012 +0800
Fixes for Python 3 compatibility.
commit dfd72131d8664615e245aa0f95b82604ba6b3821
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 15:54:30 2012 +0800
Added protection against proxying swapped models.
commit abcb027190e53613e7f1734e77ee185b2587de31
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 15:11:10 2012 +0800
Cleanup and documentation of AbstractUser base class.
commit a9491a87763e307f0eb0dc246f54ac865a6ffb34
Merge: fd8bb4e 08bcb4a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 14:46:49 2012 +0800
Merge commit '08bcb4aec1ed154cefc631b8510ee13e9af0c19d' into t3011
commit fd8bb4e3e498a92d7a8b340f0684d5f088aa4c92
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 14:20:14 2012 +0800
Documentation improvements coming from community review.
commit b550a6d06d016ab6a0198c4cb2dffe9cceabe8a5
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 13:52:47 2012 +0800
Refactored skipIfCustomUser into the contrib.auth tests.
commit 52a02f11107c3f0d711742b8ca65b75175b79d6a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 13:46:10 2012 +0800
Refactored common 'get' pattern into manager method.
commit b441a6bbc7d6065175715cb09316b9f13268171b
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 13:41:33 2012 +0800
Added note about backwards incompatible change to admin login messages.
commit 08bcb4aec1ed154cefc631b8510ee13e9af0c19d
Author: Anssi Kääriäinen <akaariai@gmail.com>
Date: Sat Sep 15 18:30:33 2012 +0300
Splitted User to AbstractUser and User
commit d9f5e5addbad5e1a01f67e7358e4f5091c3cad81
Author: Anssi Kääriäinen <akaariai@gmail.com>
Date: Sat Sep 15 18:30:02 2012 +0300
Reworked REQUIRED_FIELDS + create_user() interaction
commit 579f152e4a6e06671e1ac1e59e2b43cf4d764bf4
Merge: 9184972 93e6733
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 15 20:18:37 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit 918497218c58227f5032873ff97261627b2ceab2
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 15 20:18:19 2012 +0800
Deprecate AUTH_PROFILE_MODULE and get_profile().
commit 334cdfc1bb6a6794791497cdefda843bca2ea57a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 15 20:00:12 2012 +0800
Added release notes for new swappable User feature.
commit 5d7bb22e8d913b51aba1c3360e7af8b01b6c0ab6
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 15 19:59:49 2012 +0800
Ensure swapped models can't be queried.
commit 57ac6e3d32605a67581e875b37ec5b2284711a32
Merge: f2ec915 abfba3b
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 15 14:31:54 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit f2ec915b20f81c8afeaa3df25f80689712f720f8
Merge: 1952656 5e99a3d
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 9 08:29:51 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit 19526563b54fa300785c49cfb625c0c6158ced67
Merge: 2c5e833 c4aa26a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 9 08:22:26 2012 +0800
Merge recent changes from master.
commit 2c5e833a30bef4305d55eacc0703533152f5c427
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 9 07:53:46 2012 +0800
Corrected admin_views tests following removal of the email fallback on admin logins.
commit 20d1892491839d6ef21f37db4ca136935c2076bf
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 9 01:00:37 2012 +0800
Added conditional skips for all tests dependent on the default User model
commit 40ea8b888284775481fc1eaadeff267dbd7e3dfa
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 8 23:47:02 2012 +0800
Added documentation for REQUIRED_FIELDS in custom auth.
commit e6aaf659708cf6491f5485d3edfa616cb9214cc0
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 8 23:20:02 2012 +0800
Added first draft of custom User docs.
Thanks to Greg Turner for the initial text.
commit 75118bd242eec87649da2859e8c50a199a8a1dca
Author: Thomas Sutton <me@thomas-sutton.id.au>
Date: Mon Aug 20 11:17:26 2012 +0800
Admin app should not allow username discovery
The admin app login form should not allow users to discover the username
associated with an email address.
commit d088b3af58dad7449fc58493193a327725c57c22
Author: Thomas Sutton <me@thomas-sutton.id.au>
Date: Mon Aug 20 10:32:13 2012 +0800
Admin app login form should use swapped user model
commit 7e82e83d67ee0871a72e1a3a723afdd214fcefc3
Merge: e29c010 39aa890
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Fri Sep 7 23:45:03 2012 +0800
Merged master changes.
commit e29c010beb96ca07697c4e3e0c0d5d3ffdc4c0a3
Merge: 8e3fd70 30bdf22
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Aug 20 13:12:57 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit 8e3fd703d02c31a4c3ac9f51f5011d03c0bd47f6
Merge: 507bb50 26e0ba0
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Aug 20 13:09:09 2012 +0800
Merged recent changes from trunk.
commit 507bb50a9291bfcdcfa1198f9fea21d4e3b1e762
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Jun 4 20:41:37 2012 +0800
Modified auth app so that login with alternate auth app is possible.
commit dabe3628362ab7a4a6c9686dd874803baa997eaa
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Jun 4 20:10:51 2012 +0800
Modified auth management commands to handle custom user definitions.
commit 7cc0baf89d490c92ef3f1dc909b8090191a1294b
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Jun 4 14:17:28 2012 +0800
Added model Meta option for swappable models, and made auth.User a swappable model
2012-09-26 10:48:09 +00:00
|
|
|
class CustomUserPasswordResetTest(AuthViewsTestCase):
|
2015-02-13 14:12:30 +00:00
|
|
|
user_email = 'staffmember@example.com'
|
Fixed #3011 -- Added swappable auth.User models.
Thanks to the many people that contributed to the development and review of
this patch, including (but not limited to) Jacob Kaplan-Moss, Anssi
Kääriäinen, Ramiro Morales, Preston Holmes, Josh Ourisman, Thomas Sutton,
and Roger Barnes, as well as the many, many people who have contributed to
the design discussion around this ticket over many years.
Squashed commit of the following:
commit d84749a0f034a0a6906d20df047086b1219040d0
Merge: 531e771 7c11b1a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Wed Sep 26 18:37:04 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit 531e7715da545f930c49919a19e954d41c59b446
Merge: 29d1abb 1f84b04
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Wed Sep 26 07:09:23 2012 +0800
Merged recent trunk changes.
commit 29d1abbe351fd5da855fe5ce09e24227d90ddc91
Merge: 8a527dd 54c81a1
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Sep 24 07:49:46 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit 8a527dda13c9bec955b1f7e8db5822d1d9b32a01
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Sep 24 07:48:05 2012 +0800
Ensure sequences are reset correctly in the presence of swapped models.
commit e2b6e22f298eb986d74d28b8d9906f37f5ff8eb8
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 23 17:53:05 2012 +0800
Modifications to the handling and docs for auth forms.
commit 98aba856b534620aea9091f824b442b47d2fdb3c
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 23 15:28:57 2012 +0800
Improved error handling and docs for get_user_model()
commit 0229209c844f06dfeb33b0b8eeec000c127695b6
Merge: 6494bf9 8599f64
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 23 14:50:11 2012 +0800
Merged recent Django trunk changes.
commit 6494bf91f2ddaaabec3ec017f2e3131937c35517
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Sep 17 21:38:44 2012 +0800
Improved validation of swappable model settings.
commit 5a04cde342cc860384eb844cfda5af55204564ad
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Sep 17 07:15:14 2012 +0800
Removed some unused imports.
commit ffd535e4136dc54f084b6ac467e81444696e1c8a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 20:31:28 2012 +0800
Corrected attribute access on for get_by_natural_key
commit 913e1ac84c3d9c7c58a9b3bdbbb15ebccd8a8c0a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 20:12:34 2012 +0800
Added test for proxy model safeguards on swappable models.
commit 280bf19e94d0d534d0e51bae485c1842558f4ff4
Merge: dbb3900 935a863
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 18:16:49 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit dbb3900775a99df8b6cb1d7063cf364eab55621a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 18:09:27 2012 +0800
Fixes for Python 3 compatibility.
commit dfd72131d8664615e245aa0f95b82604ba6b3821
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 15:54:30 2012 +0800
Added protection against proxying swapped models.
commit abcb027190e53613e7f1734e77ee185b2587de31
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 15:11:10 2012 +0800
Cleanup and documentation of AbstractUser base class.
commit a9491a87763e307f0eb0dc246f54ac865a6ffb34
Merge: fd8bb4e 08bcb4a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 14:46:49 2012 +0800
Merge commit '08bcb4aec1ed154cefc631b8510ee13e9af0c19d' into t3011
commit fd8bb4e3e498a92d7a8b340f0684d5f088aa4c92
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 14:20:14 2012 +0800
Documentation improvements coming from community review.
commit b550a6d06d016ab6a0198c4cb2dffe9cceabe8a5
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 13:52:47 2012 +0800
Refactored skipIfCustomUser into the contrib.auth tests.
commit 52a02f11107c3f0d711742b8ca65b75175b79d6a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 13:46:10 2012 +0800
Refactored common 'get' pattern into manager method.
commit b441a6bbc7d6065175715cb09316b9f13268171b
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 13:41:33 2012 +0800
Added note about backwards incompatible change to admin login messages.
commit 08bcb4aec1ed154cefc631b8510ee13e9af0c19d
Author: Anssi Kääriäinen <akaariai@gmail.com>
Date: Sat Sep 15 18:30:33 2012 +0300
Splitted User to AbstractUser and User
commit d9f5e5addbad5e1a01f67e7358e4f5091c3cad81
Author: Anssi Kääriäinen <akaariai@gmail.com>
Date: Sat Sep 15 18:30:02 2012 +0300
Reworked REQUIRED_FIELDS + create_user() interaction
commit 579f152e4a6e06671e1ac1e59e2b43cf4d764bf4
Merge: 9184972 93e6733
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 15 20:18:37 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit 918497218c58227f5032873ff97261627b2ceab2
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 15 20:18:19 2012 +0800
Deprecate AUTH_PROFILE_MODULE and get_profile().
commit 334cdfc1bb6a6794791497cdefda843bca2ea57a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 15 20:00:12 2012 +0800
Added release notes for new swappable User feature.
commit 5d7bb22e8d913b51aba1c3360e7af8b01b6c0ab6
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 15 19:59:49 2012 +0800
Ensure swapped models can't be queried.
commit 57ac6e3d32605a67581e875b37ec5b2284711a32
Merge: f2ec915 abfba3b
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 15 14:31:54 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit f2ec915b20f81c8afeaa3df25f80689712f720f8
Merge: 1952656 5e99a3d
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 9 08:29:51 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit 19526563b54fa300785c49cfb625c0c6158ced67
Merge: 2c5e833 c4aa26a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 9 08:22:26 2012 +0800
Merge recent changes from master.
commit 2c5e833a30bef4305d55eacc0703533152f5c427
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 9 07:53:46 2012 +0800
Corrected admin_views tests following removal of the email fallback on admin logins.
commit 20d1892491839d6ef21f37db4ca136935c2076bf
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 9 01:00:37 2012 +0800
Added conditional skips for all tests dependent on the default User model
commit 40ea8b888284775481fc1eaadeff267dbd7e3dfa
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 8 23:47:02 2012 +0800
Added documentation for REQUIRED_FIELDS in custom auth.
commit e6aaf659708cf6491f5485d3edfa616cb9214cc0
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 8 23:20:02 2012 +0800
Added first draft of custom User docs.
Thanks to Greg Turner for the initial text.
commit 75118bd242eec87649da2859e8c50a199a8a1dca
Author: Thomas Sutton <me@thomas-sutton.id.au>
Date: Mon Aug 20 11:17:26 2012 +0800
Admin app should not allow username discovery
The admin app login form should not allow users to discover the username
associated with an email address.
commit d088b3af58dad7449fc58493193a327725c57c22
Author: Thomas Sutton <me@thomas-sutton.id.au>
Date: Mon Aug 20 10:32:13 2012 +0800
Admin app login form should use swapped user model
commit 7e82e83d67ee0871a72e1a3a723afdd214fcefc3
Merge: e29c010 39aa890
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Fri Sep 7 23:45:03 2012 +0800
Merged master changes.
commit e29c010beb96ca07697c4e3e0c0d5d3ffdc4c0a3
Merge: 8e3fd70 30bdf22
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Aug 20 13:12:57 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit 8e3fd703d02c31a4c3ac9f51f5011d03c0bd47f6
Merge: 507bb50 26e0ba0
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Aug 20 13:09:09 2012 +0800
Merged recent changes from trunk.
commit 507bb50a9291bfcdcfa1198f9fea21d4e3b1e762
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Jun 4 20:41:37 2012 +0800
Modified auth app so that login with alternate auth app is possible.
commit dabe3628362ab7a4a6c9686dd874803baa997eaa
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Jun 4 20:10:51 2012 +0800
Modified auth management commands to handle custom user definitions.
commit 7cc0baf89d490c92ef3f1dc909b8090191a1294b
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Jun 4 14:17:28 2012 +0800
Added model Meta option for swappable models, and made auth.User a swappable model
2012-09-26 10:48:09 +00:00
|
|
|
|
2015-02-23 00:53:57 +00:00
|
|
|
@classmethod
|
|
|
|
def setUpTestData(cls):
|
|
|
|
cls.u1 = CustomUser.custom_objects.create(
|
2016-02-05 20:56:52 +00:00
|
|
|
email='staffmember@example.com',
|
|
|
|
date_of_birth=datetime.date(1976, 11, 8),
|
2015-02-23 00:53:57 +00:00
|
|
|
)
|
2016-02-05 20:56:52 +00:00
|
|
|
cls.u1.set_password('password')
|
|
|
|
cls.u1.save()
|
2015-02-23 00:53:57 +00:00
|
|
|
|
2017-01-13 14:17:54 +00:00
|
|
|
def setUp(self):
|
|
|
|
self.client = PasswordResetConfirmClient()
|
|
|
|
|
Fixed #3011 -- Added swappable auth.User models.
Thanks to the many people that contributed to the development and review of
this patch, including (but not limited to) Jacob Kaplan-Moss, Anssi
Kääriäinen, Ramiro Morales, Preston Holmes, Josh Ourisman, Thomas Sutton,
and Roger Barnes, as well as the many, many people who have contributed to
the design discussion around this ticket over many years.
Squashed commit of the following:
commit d84749a0f034a0a6906d20df047086b1219040d0
Merge: 531e771 7c11b1a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Wed Sep 26 18:37:04 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit 531e7715da545f930c49919a19e954d41c59b446
Merge: 29d1abb 1f84b04
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Wed Sep 26 07:09:23 2012 +0800
Merged recent trunk changes.
commit 29d1abbe351fd5da855fe5ce09e24227d90ddc91
Merge: 8a527dd 54c81a1
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Sep 24 07:49:46 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit 8a527dda13c9bec955b1f7e8db5822d1d9b32a01
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Sep 24 07:48:05 2012 +0800
Ensure sequences are reset correctly in the presence of swapped models.
commit e2b6e22f298eb986d74d28b8d9906f37f5ff8eb8
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 23 17:53:05 2012 +0800
Modifications to the handling and docs for auth forms.
commit 98aba856b534620aea9091f824b442b47d2fdb3c
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 23 15:28:57 2012 +0800
Improved error handling and docs for get_user_model()
commit 0229209c844f06dfeb33b0b8eeec000c127695b6
Merge: 6494bf9 8599f64
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 23 14:50:11 2012 +0800
Merged recent Django trunk changes.
commit 6494bf91f2ddaaabec3ec017f2e3131937c35517
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Sep 17 21:38:44 2012 +0800
Improved validation of swappable model settings.
commit 5a04cde342cc860384eb844cfda5af55204564ad
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Sep 17 07:15:14 2012 +0800
Removed some unused imports.
commit ffd535e4136dc54f084b6ac467e81444696e1c8a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 20:31:28 2012 +0800
Corrected attribute access on for get_by_natural_key
commit 913e1ac84c3d9c7c58a9b3bdbbb15ebccd8a8c0a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 20:12:34 2012 +0800
Added test for proxy model safeguards on swappable models.
commit 280bf19e94d0d534d0e51bae485c1842558f4ff4
Merge: dbb3900 935a863
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 18:16:49 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit dbb3900775a99df8b6cb1d7063cf364eab55621a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 18:09:27 2012 +0800
Fixes for Python 3 compatibility.
commit dfd72131d8664615e245aa0f95b82604ba6b3821
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 15:54:30 2012 +0800
Added protection against proxying swapped models.
commit abcb027190e53613e7f1734e77ee185b2587de31
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 15:11:10 2012 +0800
Cleanup and documentation of AbstractUser base class.
commit a9491a87763e307f0eb0dc246f54ac865a6ffb34
Merge: fd8bb4e 08bcb4a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 14:46:49 2012 +0800
Merge commit '08bcb4aec1ed154cefc631b8510ee13e9af0c19d' into t3011
commit fd8bb4e3e498a92d7a8b340f0684d5f088aa4c92
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 14:20:14 2012 +0800
Documentation improvements coming from community review.
commit b550a6d06d016ab6a0198c4cb2dffe9cceabe8a5
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 13:52:47 2012 +0800
Refactored skipIfCustomUser into the contrib.auth tests.
commit 52a02f11107c3f0d711742b8ca65b75175b79d6a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 13:46:10 2012 +0800
Refactored common 'get' pattern into manager method.
commit b441a6bbc7d6065175715cb09316b9f13268171b
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 13:41:33 2012 +0800
Added note about backwards incompatible change to admin login messages.
commit 08bcb4aec1ed154cefc631b8510ee13e9af0c19d
Author: Anssi Kääriäinen <akaariai@gmail.com>
Date: Sat Sep 15 18:30:33 2012 +0300
Splitted User to AbstractUser and User
commit d9f5e5addbad5e1a01f67e7358e4f5091c3cad81
Author: Anssi Kääriäinen <akaariai@gmail.com>
Date: Sat Sep 15 18:30:02 2012 +0300
Reworked REQUIRED_FIELDS + create_user() interaction
commit 579f152e4a6e06671e1ac1e59e2b43cf4d764bf4
Merge: 9184972 93e6733
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 15 20:18:37 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit 918497218c58227f5032873ff97261627b2ceab2
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 15 20:18:19 2012 +0800
Deprecate AUTH_PROFILE_MODULE and get_profile().
commit 334cdfc1bb6a6794791497cdefda843bca2ea57a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 15 20:00:12 2012 +0800
Added release notes for new swappable User feature.
commit 5d7bb22e8d913b51aba1c3360e7af8b01b6c0ab6
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 15 19:59:49 2012 +0800
Ensure swapped models can't be queried.
commit 57ac6e3d32605a67581e875b37ec5b2284711a32
Merge: f2ec915 abfba3b
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 15 14:31:54 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit f2ec915b20f81c8afeaa3df25f80689712f720f8
Merge: 1952656 5e99a3d
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 9 08:29:51 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit 19526563b54fa300785c49cfb625c0c6158ced67
Merge: 2c5e833 c4aa26a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 9 08:22:26 2012 +0800
Merge recent changes from master.
commit 2c5e833a30bef4305d55eacc0703533152f5c427
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 9 07:53:46 2012 +0800
Corrected admin_views tests following removal of the email fallback on admin logins.
commit 20d1892491839d6ef21f37db4ca136935c2076bf
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 9 01:00:37 2012 +0800
Added conditional skips for all tests dependent on the default User model
commit 40ea8b888284775481fc1eaadeff267dbd7e3dfa
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 8 23:47:02 2012 +0800
Added documentation for REQUIRED_FIELDS in custom auth.
commit e6aaf659708cf6491f5485d3edfa616cb9214cc0
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 8 23:20:02 2012 +0800
Added first draft of custom User docs.
Thanks to Greg Turner for the initial text.
commit 75118bd242eec87649da2859e8c50a199a8a1dca
Author: Thomas Sutton <me@thomas-sutton.id.au>
Date: Mon Aug 20 11:17:26 2012 +0800
Admin app should not allow username discovery
The admin app login form should not allow users to discover the username
associated with an email address.
commit d088b3af58dad7449fc58493193a327725c57c22
Author: Thomas Sutton <me@thomas-sutton.id.au>
Date: Mon Aug 20 10:32:13 2012 +0800
Admin app login form should use swapped user model
commit 7e82e83d67ee0871a72e1a3a723afdd214fcefc3
Merge: e29c010 39aa890
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Fri Sep 7 23:45:03 2012 +0800
Merged master changes.
commit e29c010beb96ca07697c4e3e0c0d5d3ffdc4c0a3
Merge: 8e3fd70 30bdf22
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Aug 20 13:12:57 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit 8e3fd703d02c31a4c3ac9f51f5011d03c0bd47f6
Merge: 507bb50 26e0ba0
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Aug 20 13:09:09 2012 +0800
Merged recent changes from trunk.
commit 507bb50a9291bfcdcfa1198f9fea21d4e3b1e762
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Jun 4 20:41:37 2012 +0800
Modified auth app so that login with alternate auth app is possible.
commit dabe3628362ab7a4a6c9686dd874803baa997eaa
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Jun 4 20:10:51 2012 +0800
Modified auth management commands to handle custom user definitions.
commit 7cc0baf89d490c92ef3f1dc909b8090191a1294b
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Jun 4 14:17:28 2012 +0800
Added model Meta option for swappable models, and made auth.User a swappable model
2012-09-26 10:48:09 +00:00
|
|
|
def _test_confirm_start(self):
|
|
|
|
# Start by creating the email
|
2015-02-13 14:12:30 +00:00
|
|
|
response = self.client.post('/password_reset/', {'email': self.user_email})
|
Fixed #3011 -- Added swappable auth.User models.
Thanks to the many people that contributed to the development and review of
this patch, including (but not limited to) Jacob Kaplan-Moss, Anssi
Kääriäinen, Ramiro Morales, Preston Holmes, Josh Ourisman, Thomas Sutton,
and Roger Barnes, as well as the many, many people who have contributed to
the design discussion around this ticket over many years.
Squashed commit of the following:
commit d84749a0f034a0a6906d20df047086b1219040d0
Merge: 531e771 7c11b1a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Wed Sep 26 18:37:04 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit 531e7715da545f930c49919a19e954d41c59b446
Merge: 29d1abb 1f84b04
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Wed Sep 26 07:09:23 2012 +0800
Merged recent trunk changes.
commit 29d1abbe351fd5da855fe5ce09e24227d90ddc91
Merge: 8a527dd 54c81a1
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Sep 24 07:49:46 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit 8a527dda13c9bec955b1f7e8db5822d1d9b32a01
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Sep 24 07:48:05 2012 +0800
Ensure sequences are reset correctly in the presence of swapped models.
commit e2b6e22f298eb986d74d28b8d9906f37f5ff8eb8
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 23 17:53:05 2012 +0800
Modifications to the handling and docs for auth forms.
commit 98aba856b534620aea9091f824b442b47d2fdb3c
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 23 15:28:57 2012 +0800
Improved error handling and docs for get_user_model()
commit 0229209c844f06dfeb33b0b8eeec000c127695b6
Merge: 6494bf9 8599f64
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 23 14:50:11 2012 +0800
Merged recent Django trunk changes.
commit 6494bf91f2ddaaabec3ec017f2e3131937c35517
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Sep 17 21:38:44 2012 +0800
Improved validation of swappable model settings.
commit 5a04cde342cc860384eb844cfda5af55204564ad
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Sep 17 07:15:14 2012 +0800
Removed some unused imports.
commit ffd535e4136dc54f084b6ac467e81444696e1c8a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 20:31:28 2012 +0800
Corrected attribute access on for get_by_natural_key
commit 913e1ac84c3d9c7c58a9b3bdbbb15ebccd8a8c0a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 20:12:34 2012 +0800
Added test for proxy model safeguards on swappable models.
commit 280bf19e94d0d534d0e51bae485c1842558f4ff4
Merge: dbb3900 935a863
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 18:16:49 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit dbb3900775a99df8b6cb1d7063cf364eab55621a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 18:09:27 2012 +0800
Fixes for Python 3 compatibility.
commit dfd72131d8664615e245aa0f95b82604ba6b3821
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 15:54:30 2012 +0800
Added protection against proxying swapped models.
commit abcb027190e53613e7f1734e77ee185b2587de31
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 15:11:10 2012 +0800
Cleanup and documentation of AbstractUser base class.
commit a9491a87763e307f0eb0dc246f54ac865a6ffb34
Merge: fd8bb4e 08bcb4a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 14:46:49 2012 +0800
Merge commit '08bcb4aec1ed154cefc631b8510ee13e9af0c19d' into t3011
commit fd8bb4e3e498a92d7a8b340f0684d5f088aa4c92
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 14:20:14 2012 +0800
Documentation improvements coming from community review.
commit b550a6d06d016ab6a0198c4cb2dffe9cceabe8a5
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 13:52:47 2012 +0800
Refactored skipIfCustomUser into the contrib.auth tests.
commit 52a02f11107c3f0d711742b8ca65b75175b79d6a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 13:46:10 2012 +0800
Refactored common 'get' pattern into manager method.
commit b441a6bbc7d6065175715cb09316b9f13268171b
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 13:41:33 2012 +0800
Added note about backwards incompatible change to admin login messages.
commit 08bcb4aec1ed154cefc631b8510ee13e9af0c19d
Author: Anssi Kääriäinen <akaariai@gmail.com>
Date: Sat Sep 15 18:30:33 2012 +0300
Splitted User to AbstractUser and User
commit d9f5e5addbad5e1a01f67e7358e4f5091c3cad81
Author: Anssi Kääriäinen <akaariai@gmail.com>
Date: Sat Sep 15 18:30:02 2012 +0300
Reworked REQUIRED_FIELDS + create_user() interaction
commit 579f152e4a6e06671e1ac1e59e2b43cf4d764bf4
Merge: 9184972 93e6733
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 15 20:18:37 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit 918497218c58227f5032873ff97261627b2ceab2
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 15 20:18:19 2012 +0800
Deprecate AUTH_PROFILE_MODULE and get_profile().
commit 334cdfc1bb6a6794791497cdefda843bca2ea57a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 15 20:00:12 2012 +0800
Added release notes for new swappable User feature.
commit 5d7bb22e8d913b51aba1c3360e7af8b01b6c0ab6
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 15 19:59:49 2012 +0800
Ensure swapped models can't be queried.
commit 57ac6e3d32605a67581e875b37ec5b2284711a32
Merge: f2ec915 abfba3b
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 15 14:31:54 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit f2ec915b20f81c8afeaa3df25f80689712f720f8
Merge: 1952656 5e99a3d
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 9 08:29:51 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit 19526563b54fa300785c49cfb625c0c6158ced67
Merge: 2c5e833 c4aa26a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 9 08:22:26 2012 +0800
Merge recent changes from master.
commit 2c5e833a30bef4305d55eacc0703533152f5c427
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 9 07:53:46 2012 +0800
Corrected admin_views tests following removal of the email fallback on admin logins.
commit 20d1892491839d6ef21f37db4ca136935c2076bf
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 9 01:00:37 2012 +0800
Added conditional skips for all tests dependent on the default User model
commit 40ea8b888284775481fc1eaadeff267dbd7e3dfa
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 8 23:47:02 2012 +0800
Added documentation for REQUIRED_FIELDS in custom auth.
commit e6aaf659708cf6491f5485d3edfa616cb9214cc0
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 8 23:20:02 2012 +0800
Added first draft of custom User docs.
Thanks to Greg Turner for the initial text.
commit 75118bd242eec87649da2859e8c50a199a8a1dca
Author: Thomas Sutton <me@thomas-sutton.id.au>
Date: Mon Aug 20 11:17:26 2012 +0800
Admin app should not allow username discovery
The admin app login form should not allow users to discover the username
associated with an email address.
commit d088b3af58dad7449fc58493193a327725c57c22
Author: Thomas Sutton <me@thomas-sutton.id.au>
Date: Mon Aug 20 10:32:13 2012 +0800
Admin app login form should use swapped user model
commit 7e82e83d67ee0871a72e1a3a723afdd214fcefc3
Merge: e29c010 39aa890
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Fri Sep 7 23:45:03 2012 +0800
Merged master changes.
commit e29c010beb96ca07697c4e3e0c0d5d3ffdc4c0a3
Merge: 8e3fd70 30bdf22
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Aug 20 13:12:57 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit 8e3fd703d02c31a4c3ac9f51f5011d03c0bd47f6
Merge: 507bb50 26e0ba0
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Aug 20 13:09:09 2012 +0800
Merged recent changes from trunk.
commit 507bb50a9291bfcdcfa1198f9fea21d4e3b1e762
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Jun 4 20:41:37 2012 +0800
Modified auth app so that login with alternate auth app is possible.
commit dabe3628362ab7a4a6c9686dd874803baa997eaa
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Jun 4 20:10:51 2012 +0800
Modified auth management commands to handle custom user definitions.
commit 7cc0baf89d490c92ef3f1dc909b8090191a1294b
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Jun 4 14:17:28 2012 +0800
Added model Meta option for swappable models, and made auth.User a swappable model
2012-09-26 10:48:09 +00:00
|
|
|
self.assertEqual(response.status_code, 302)
|
|
|
|
self.assertEqual(len(mail.outbox), 1)
|
|
|
|
return self._read_signup_email(mail.outbox[0])
|
|
|
|
|
|
|
|
def _read_signup_email(self, email):
|
|
|
|
urlmatch = re.search(r"https?://[^/]*(/.*reset/\S*)", email.body)
|
2014-10-28 10:02:56 +00:00
|
|
|
self.assertIsNotNone(urlmatch, "No URL found in sent email")
|
Fixed #3011 -- Added swappable auth.User models.
Thanks to the many people that contributed to the development and review of
this patch, including (but not limited to) Jacob Kaplan-Moss, Anssi
Kääriäinen, Ramiro Morales, Preston Holmes, Josh Ourisman, Thomas Sutton,
and Roger Barnes, as well as the many, many people who have contributed to
the design discussion around this ticket over many years.
Squashed commit of the following:
commit d84749a0f034a0a6906d20df047086b1219040d0
Merge: 531e771 7c11b1a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Wed Sep 26 18:37:04 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit 531e7715da545f930c49919a19e954d41c59b446
Merge: 29d1abb 1f84b04
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Wed Sep 26 07:09:23 2012 +0800
Merged recent trunk changes.
commit 29d1abbe351fd5da855fe5ce09e24227d90ddc91
Merge: 8a527dd 54c81a1
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Sep 24 07:49:46 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit 8a527dda13c9bec955b1f7e8db5822d1d9b32a01
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Sep 24 07:48:05 2012 +0800
Ensure sequences are reset correctly in the presence of swapped models.
commit e2b6e22f298eb986d74d28b8d9906f37f5ff8eb8
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 23 17:53:05 2012 +0800
Modifications to the handling and docs for auth forms.
commit 98aba856b534620aea9091f824b442b47d2fdb3c
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 23 15:28:57 2012 +0800
Improved error handling and docs for get_user_model()
commit 0229209c844f06dfeb33b0b8eeec000c127695b6
Merge: 6494bf9 8599f64
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 23 14:50:11 2012 +0800
Merged recent Django trunk changes.
commit 6494bf91f2ddaaabec3ec017f2e3131937c35517
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Sep 17 21:38:44 2012 +0800
Improved validation of swappable model settings.
commit 5a04cde342cc860384eb844cfda5af55204564ad
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Sep 17 07:15:14 2012 +0800
Removed some unused imports.
commit ffd535e4136dc54f084b6ac467e81444696e1c8a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 20:31:28 2012 +0800
Corrected attribute access on for get_by_natural_key
commit 913e1ac84c3d9c7c58a9b3bdbbb15ebccd8a8c0a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 20:12:34 2012 +0800
Added test for proxy model safeguards on swappable models.
commit 280bf19e94d0d534d0e51bae485c1842558f4ff4
Merge: dbb3900 935a863
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 18:16:49 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit dbb3900775a99df8b6cb1d7063cf364eab55621a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 18:09:27 2012 +0800
Fixes for Python 3 compatibility.
commit dfd72131d8664615e245aa0f95b82604ba6b3821
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 15:54:30 2012 +0800
Added protection against proxying swapped models.
commit abcb027190e53613e7f1734e77ee185b2587de31
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 15:11:10 2012 +0800
Cleanup and documentation of AbstractUser base class.
commit a9491a87763e307f0eb0dc246f54ac865a6ffb34
Merge: fd8bb4e 08bcb4a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 14:46:49 2012 +0800
Merge commit '08bcb4aec1ed154cefc631b8510ee13e9af0c19d' into t3011
commit fd8bb4e3e498a92d7a8b340f0684d5f088aa4c92
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 14:20:14 2012 +0800
Documentation improvements coming from community review.
commit b550a6d06d016ab6a0198c4cb2dffe9cceabe8a5
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 13:52:47 2012 +0800
Refactored skipIfCustomUser into the contrib.auth tests.
commit 52a02f11107c3f0d711742b8ca65b75175b79d6a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 13:46:10 2012 +0800
Refactored common 'get' pattern into manager method.
commit b441a6bbc7d6065175715cb09316b9f13268171b
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 13:41:33 2012 +0800
Added note about backwards incompatible change to admin login messages.
commit 08bcb4aec1ed154cefc631b8510ee13e9af0c19d
Author: Anssi Kääriäinen <akaariai@gmail.com>
Date: Sat Sep 15 18:30:33 2012 +0300
Splitted User to AbstractUser and User
commit d9f5e5addbad5e1a01f67e7358e4f5091c3cad81
Author: Anssi Kääriäinen <akaariai@gmail.com>
Date: Sat Sep 15 18:30:02 2012 +0300
Reworked REQUIRED_FIELDS + create_user() interaction
commit 579f152e4a6e06671e1ac1e59e2b43cf4d764bf4
Merge: 9184972 93e6733
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 15 20:18:37 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit 918497218c58227f5032873ff97261627b2ceab2
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 15 20:18:19 2012 +0800
Deprecate AUTH_PROFILE_MODULE and get_profile().
commit 334cdfc1bb6a6794791497cdefda843bca2ea57a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 15 20:00:12 2012 +0800
Added release notes for new swappable User feature.
commit 5d7bb22e8d913b51aba1c3360e7af8b01b6c0ab6
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 15 19:59:49 2012 +0800
Ensure swapped models can't be queried.
commit 57ac6e3d32605a67581e875b37ec5b2284711a32
Merge: f2ec915 abfba3b
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 15 14:31:54 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit f2ec915b20f81c8afeaa3df25f80689712f720f8
Merge: 1952656 5e99a3d
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 9 08:29:51 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit 19526563b54fa300785c49cfb625c0c6158ced67
Merge: 2c5e833 c4aa26a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 9 08:22:26 2012 +0800
Merge recent changes from master.
commit 2c5e833a30bef4305d55eacc0703533152f5c427
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 9 07:53:46 2012 +0800
Corrected admin_views tests following removal of the email fallback on admin logins.
commit 20d1892491839d6ef21f37db4ca136935c2076bf
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 9 01:00:37 2012 +0800
Added conditional skips for all tests dependent on the default User model
commit 40ea8b888284775481fc1eaadeff267dbd7e3dfa
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 8 23:47:02 2012 +0800
Added documentation for REQUIRED_FIELDS in custom auth.
commit e6aaf659708cf6491f5485d3edfa616cb9214cc0
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 8 23:20:02 2012 +0800
Added first draft of custom User docs.
Thanks to Greg Turner for the initial text.
commit 75118bd242eec87649da2859e8c50a199a8a1dca
Author: Thomas Sutton <me@thomas-sutton.id.au>
Date: Mon Aug 20 11:17:26 2012 +0800
Admin app should not allow username discovery
The admin app login form should not allow users to discover the username
associated with an email address.
commit d088b3af58dad7449fc58493193a327725c57c22
Author: Thomas Sutton <me@thomas-sutton.id.au>
Date: Mon Aug 20 10:32:13 2012 +0800
Admin app login form should use swapped user model
commit 7e82e83d67ee0871a72e1a3a723afdd214fcefc3
Merge: e29c010 39aa890
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Fri Sep 7 23:45:03 2012 +0800
Merged master changes.
commit e29c010beb96ca07697c4e3e0c0d5d3ffdc4c0a3
Merge: 8e3fd70 30bdf22
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Aug 20 13:12:57 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit 8e3fd703d02c31a4c3ac9f51f5011d03c0bd47f6
Merge: 507bb50 26e0ba0
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Aug 20 13:09:09 2012 +0800
Merged recent changes from trunk.
commit 507bb50a9291bfcdcfa1198f9fea21d4e3b1e762
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Jun 4 20:41:37 2012 +0800
Modified auth app so that login with alternate auth app is possible.
commit dabe3628362ab7a4a6c9686dd874803baa997eaa
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Jun 4 20:10:51 2012 +0800
Modified auth management commands to handle custom user definitions.
commit 7cc0baf89d490c92ef3f1dc909b8090191a1294b
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Jun 4 14:17:28 2012 +0800
Added model Meta option for swappable models, and made auth.User a swappable model
2012-09-26 10:48:09 +00:00
|
|
|
return urlmatch.group(), urlmatch.groups()[0]
|
|
|
|
|
|
|
|
def test_confirm_valid_custom_user(self):
|
|
|
|
url, path = self._test_confirm_start()
|
|
|
|
response = self.client.get(path)
|
|
|
|
# redirect to a 'complete' page:
|
|
|
|
self.assertContains(response, "Please enter your new password")
|
2015-02-13 14:12:30 +00:00
|
|
|
# then submit a new password
|
|
|
|
response = self.client.post(path, {
|
|
|
|
'new_password1': 'anewpassword',
|
|
|
|
'new_password2': 'anewpassword',
|
|
|
|
})
|
|
|
|
self.assertRedirects(response, '/reset/done/')
|
|
|
|
|
|
|
|
|
2015-10-26 22:38:30 +00:00
|
|
|
@override_settings(AUTH_USER_MODEL='auth_tests.UUIDUser')
|
2015-02-13 14:12:30 +00:00
|
|
|
class UUIDUserPasswordResetTest(CustomUserPasswordResetTest):
|
|
|
|
|
|
|
|
def _test_confirm_start(self):
|
|
|
|
# instead of fixture
|
|
|
|
UUIDUser.objects.create_user(
|
|
|
|
email=self.user_email,
|
|
|
|
username='foo',
|
|
|
|
password='foo',
|
|
|
|
)
|
2017-01-21 13:13:44 +00:00
|
|
|
return super()._test_confirm_start()
|
Fixed #3011 -- Added swappable auth.User models.
Thanks to the many people that contributed to the development and review of
this patch, including (but not limited to) Jacob Kaplan-Moss, Anssi
Kääriäinen, Ramiro Morales, Preston Holmes, Josh Ourisman, Thomas Sutton,
and Roger Barnes, as well as the many, many people who have contributed to
the design discussion around this ticket over many years.
Squashed commit of the following:
commit d84749a0f034a0a6906d20df047086b1219040d0
Merge: 531e771 7c11b1a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Wed Sep 26 18:37:04 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit 531e7715da545f930c49919a19e954d41c59b446
Merge: 29d1abb 1f84b04
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Wed Sep 26 07:09:23 2012 +0800
Merged recent trunk changes.
commit 29d1abbe351fd5da855fe5ce09e24227d90ddc91
Merge: 8a527dd 54c81a1
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Sep 24 07:49:46 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit 8a527dda13c9bec955b1f7e8db5822d1d9b32a01
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Sep 24 07:48:05 2012 +0800
Ensure sequences are reset correctly in the presence of swapped models.
commit e2b6e22f298eb986d74d28b8d9906f37f5ff8eb8
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 23 17:53:05 2012 +0800
Modifications to the handling and docs for auth forms.
commit 98aba856b534620aea9091f824b442b47d2fdb3c
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 23 15:28:57 2012 +0800
Improved error handling and docs for get_user_model()
commit 0229209c844f06dfeb33b0b8eeec000c127695b6
Merge: 6494bf9 8599f64
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 23 14:50:11 2012 +0800
Merged recent Django trunk changes.
commit 6494bf91f2ddaaabec3ec017f2e3131937c35517
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Sep 17 21:38:44 2012 +0800
Improved validation of swappable model settings.
commit 5a04cde342cc860384eb844cfda5af55204564ad
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Sep 17 07:15:14 2012 +0800
Removed some unused imports.
commit ffd535e4136dc54f084b6ac467e81444696e1c8a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 20:31:28 2012 +0800
Corrected attribute access on for get_by_natural_key
commit 913e1ac84c3d9c7c58a9b3bdbbb15ebccd8a8c0a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 20:12:34 2012 +0800
Added test for proxy model safeguards on swappable models.
commit 280bf19e94d0d534d0e51bae485c1842558f4ff4
Merge: dbb3900 935a863
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 18:16:49 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit dbb3900775a99df8b6cb1d7063cf364eab55621a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 18:09:27 2012 +0800
Fixes for Python 3 compatibility.
commit dfd72131d8664615e245aa0f95b82604ba6b3821
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 15:54:30 2012 +0800
Added protection against proxying swapped models.
commit abcb027190e53613e7f1734e77ee185b2587de31
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 15:11:10 2012 +0800
Cleanup and documentation of AbstractUser base class.
commit a9491a87763e307f0eb0dc246f54ac865a6ffb34
Merge: fd8bb4e 08bcb4a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 14:46:49 2012 +0800
Merge commit '08bcb4aec1ed154cefc631b8510ee13e9af0c19d' into t3011
commit fd8bb4e3e498a92d7a8b340f0684d5f088aa4c92
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 14:20:14 2012 +0800
Documentation improvements coming from community review.
commit b550a6d06d016ab6a0198c4cb2dffe9cceabe8a5
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 13:52:47 2012 +0800
Refactored skipIfCustomUser into the contrib.auth tests.
commit 52a02f11107c3f0d711742b8ca65b75175b79d6a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 13:46:10 2012 +0800
Refactored common 'get' pattern into manager method.
commit b441a6bbc7d6065175715cb09316b9f13268171b
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 13:41:33 2012 +0800
Added note about backwards incompatible change to admin login messages.
commit 08bcb4aec1ed154cefc631b8510ee13e9af0c19d
Author: Anssi Kääriäinen <akaariai@gmail.com>
Date: Sat Sep 15 18:30:33 2012 +0300
Splitted User to AbstractUser and User
commit d9f5e5addbad5e1a01f67e7358e4f5091c3cad81
Author: Anssi Kääriäinen <akaariai@gmail.com>
Date: Sat Sep 15 18:30:02 2012 +0300
Reworked REQUIRED_FIELDS + create_user() interaction
commit 579f152e4a6e06671e1ac1e59e2b43cf4d764bf4
Merge: 9184972 93e6733
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 15 20:18:37 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit 918497218c58227f5032873ff97261627b2ceab2
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 15 20:18:19 2012 +0800
Deprecate AUTH_PROFILE_MODULE and get_profile().
commit 334cdfc1bb6a6794791497cdefda843bca2ea57a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 15 20:00:12 2012 +0800
Added release notes for new swappable User feature.
commit 5d7bb22e8d913b51aba1c3360e7af8b01b6c0ab6
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 15 19:59:49 2012 +0800
Ensure swapped models can't be queried.
commit 57ac6e3d32605a67581e875b37ec5b2284711a32
Merge: f2ec915 abfba3b
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 15 14:31:54 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit f2ec915b20f81c8afeaa3df25f80689712f720f8
Merge: 1952656 5e99a3d
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 9 08:29:51 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit 19526563b54fa300785c49cfb625c0c6158ced67
Merge: 2c5e833 c4aa26a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 9 08:22:26 2012 +0800
Merge recent changes from master.
commit 2c5e833a30bef4305d55eacc0703533152f5c427
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 9 07:53:46 2012 +0800
Corrected admin_views tests following removal of the email fallback on admin logins.
commit 20d1892491839d6ef21f37db4ca136935c2076bf
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 9 01:00:37 2012 +0800
Added conditional skips for all tests dependent on the default User model
commit 40ea8b888284775481fc1eaadeff267dbd7e3dfa
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 8 23:47:02 2012 +0800
Added documentation for REQUIRED_FIELDS in custom auth.
commit e6aaf659708cf6491f5485d3edfa616cb9214cc0
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 8 23:20:02 2012 +0800
Added first draft of custom User docs.
Thanks to Greg Turner for the initial text.
commit 75118bd242eec87649da2859e8c50a199a8a1dca
Author: Thomas Sutton <me@thomas-sutton.id.au>
Date: Mon Aug 20 11:17:26 2012 +0800
Admin app should not allow username discovery
The admin app login form should not allow users to discover the username
associated with an email address.
commit d088b3af58dad7449fc58493193a327725c57c22
Author: Thomas Sutton <me@thomas-sutton.id.au>
Date: Mon Aug 20 10:32:13 2012 +0800
Admin app login form should use swapped user model
commit 7e82e83d67ee0871a72e1a3a723afdd214fcefc3
Merge: e29c010 39aa890
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Fri Sep 7 23:45:03 2012 +0800
Merged master changes.
commit e29c010beb96ca07697c4e3e0c0d5d3ffdc4c0a3
Merge: 8e3fd70 30bdf22
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Aug 20 13:12:57 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit 8e3fd703d02c31a4c3ac9f51f5011d03c0bd47f6
Merge: 507bb50 26e0ba0
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Aug 20 13:09:09 2012 +0800
Merged recent changes from trunk.
commit 507bb50a9291bfcdcfa1198f9fea21d4e3b1e762
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Jun 4 20:41:37 2012 +0800
Modified auth app so that login with alternate auth app is possible.
commit dabe3628362ab7a4a6c9686dd874803baa997eaa
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Jun 4 20:10:51 2012 +0800
Modified auth management commands to handle custom user definitions.
commit 7cc0baf89d490c92ef3f1dc909b8090191a1294b
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Jun 4 14:17:28 2012 +0800
Added model Meta option for swappable models, and made auth.User a swappable model
2012-09-26 10:48:09 +00:00
|
|
|
|
2018-03-16 01:33:15 +00:00
|
|
|
def test_confirm_invalid_uuid(self):
|
|
|
|
"""A uidb64 that decodes to a non-UUID doesn't crash."""
|
|
|
|
_, path = self._test_confirm_start()
|
2019-11-18 14:31:42 +00:00
|
|
|
invalid_uidb64 = urlsafe_base64_encode(b'INVALID_UUID')
|
2018-03-16 01:33:15 +00:00
|
|
|
first, _uuidb64_, second = path.strip('/').split('/')
|
|
|
|
response = self.client.get('/' + '/'.join((first, invalid_uidb64, second)) + '/')
|
|
|
|
self.assertContains(response, 'The password reset link was invalid')
|
|
|
|
|
Fixed #3011 -- Added swappable auth.User models.
Thanks to the many people that contributed to the development and review of
this patch, including (but not limited to) Jacob Kaplan-Moss, Anssi
Kääriäinen, Ramiro Morales, Preston Holmes, Josh Ourisman, Thomas Sutton,
and Roger Barnes, as well as the many, many people who have contributed to
the design discussion around this ticket over many years.
Squashed commit of the following:
commit d84749a0f034a0a6906d20df047086b1219040d0
Merge: 531e771 7c11b1a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Wed Sep 26 18:37:04 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit 531e7715da545f930c49919a19e954d41c59b446
Merge: 29d1abb 1f84b04
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Wed Sep 26 07:09:23 2012 +0800
Merged recent trunk changes.
commit 29d1abbe351fd5da855fe5ce09e24227d90ddc91
Merge: 8a527dd 54c81a1
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Sep 24 07:49:46 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit 8a527dda13c9bec955b1f7e8db5822d1d9b32a01
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Sep 24 07:48:05 2012 +0800
Ensure sequences are reset correctly in the presence of swapped models.
commit e2b6e22f298eb986d74d28b8d9906f37f5ff8eb8
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 23 17:53:05 2012 +0800
Modifications to the handling and docs for auth forms.
commit 98aba856b534620aea9091f824b442b47d2fdb3c
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 23 15:28:57 2012 +0800
Improved error handling and docs for get_user_model()
commit 0229209c844f06dfeb33b0b8eeec000c127695b6
Merge: 6494bf9 8599f64
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 23 14:50:11 2012 +0800
Merged recent Django trunk changes.
commit 6494bf91f2ddaaabec3ec017f2e3131937c35517
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Sep 17 21:38:44 2012 +0800
Improved validation of swappable model settings.
commit 5a04cde342cc860384eb844cfda5af55204564ad
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Sep 17 07:15:14 2012 +0800
Removed some unused imports.
commit ffd535e4136dc54f084b6ac467e81444696e1c8a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 20:31:28 2012 +0800
Corrected attribute access on for get_by_natural_key
commit 913e1ac84c3d9c7c58a9b3bdbbb15ebccd8a8c0a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 20:12:34 2012 +0800
Added test for proxy model safeguards on swappable models.
commit 280bf19e94d0d534d0e51bae485c1842558f4ff4
Merge: dbb3900 935a863
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 18:16:49 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit dbb3900775a99df8b6cb1d7063cf364eab55621a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 18:09:27 2012 +0800
Fixes for Python 3 compatibility.
commit dfd72131d8664615e245aa0f95b82604ba6b3821
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 15:54:30 2012 +0800
Added protection against proxying swapped models.
commit abcb027190e53613e7f1734e77ee185b2587de31
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 15:11:10 2012 +0800
Cleanup and documentation of AbstractUser base class.
commit a9491a87763e307f0eb0dc246f54ac865a6ffb34
Merge: fd8bb4e 08bcb4a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 14:46:49 2012 +0800
Merge commit '08bcb4aec1ed154cefc631b8510ee13e9af0c19d' into t3011
commit fd8bb4e3e498a92d7a8b340f0684d5f088aa4c92
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 14:20:14 2012 +0800
Documentation improvements coming from community review.
commit b550a6d06d016ab6a0198c4cb2dffe9cceabe8a5
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 13:52:47 2012 +0800
Refactored skipIfCustomUser into the contrib.auth tests.
commit 52a02f11107c3f0d711742b8ca65b75175b79d6a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 13:46:10 2012 +0800
Refactored common 'get' pattern into manager method.
commit b441a6bbc7d6065175715cb09316b9f13268171b
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 16 13:41:33 2012 +0800
Added note about backwards incompatible change to admin login messages.
commit 08bcb4aec1ed154cefc631b8510ee13e9af0c19d
Author: Anssi Kääriäinen <akaariai@gmail.com>
Date: Sat Sep 15 18:30:33 2012 +0300
Splitted User to AbstractUser and User
commit d9f5e5addbad5e1a01f67e7358e4f5091c3cad81
Author: Anssi Kääriäinen <akaariai@gmail.com>
Date: Sat Sep 15 18:30:02 2012 +0300
Reworked REQUIRED_FIELDS + create_user() interaction
commit 579f152e4a6e06671e1ac1e59e2b43cf4d764bf4
Merge: 9184972 93e6733
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 15 20:18:37 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit 918497218c58227f5032873ff97261627b2ceab2
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 15 20:18:19 2012 +0800
Deprecate AUTH_PROFILE_MODULE and get_profile().
commit 334cdfc1bb6a6794791497cdefda843bca2ea57a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 15 20:00:12 2012 +0800
Added release notes for new swappable User feature.
commit 5d7bb22e8d913b51aba1c3360e7af8b01b6c0ab6
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 15 19:59:49 2012 +0800
Ensure swapped models can't be queried.
commit 57ac6e3d32605a67581e875b37ec5b2284711a32
Merge: f2ec915 abfba3b
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 15 14:31:54 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit f2ec915b20f81c8afeaa3df25f80689712f720f8
Merge: 1952656 5e99a3d
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 9 08:29:51 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit 19526563b54fa300785c49cfb625c0c6158ced67
Merge: 2c5e833 c4aa26a
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 9 08:22:26 2012 +0800
Merge recent changes from master.
commit 2c5e833a30bef4305d55eacc0703533152f5c427
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 9 07:53:46 2012 +0800
Corrected admin_views tests following removal of the email fallback on admin logins.
commit 20d1892491839d6ef21f37db4ca136935c2076bf
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sun Sep 9 01:00:37 2012 +0800
Added conditional skips for all tests dependent on the default User model
commit 40ea8b888284775481fc1eaadeff267dbd7e3dfa
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 8 23:47:02 2012 +0800
Added documentation for REQUIRED_FIELDS in custom auth.
commit e6aaf659708cf6491f5485d3edfa616cb9214cc0
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Sat Sep 8 23:20:02 2012 +0800
Added first draft of custom User docs.
Thanks to Greg Turner for the initial text.
commit 75118bd242eec87649da2859e8c50a199a8a1dca
Author: Thomas Sutton <me@thomas-sutton.id.au>
Date: Mon Aug 20 11:17:26 2012 +0800
Admin app should not allow username discovery
The admin app login form should not allow users to discover the username
associated with an email address.
commit d088b3af58dad7449fc58493193a327725c57c22
Author: Thomas Sutton <me@thomas-sutton.id.au>
Date: Mon Aug 20 10:32:13 2012 +0800
Admin app login form should use swapped user model
commit 7e82e83d67ee0871a72e1a3a723afdd214fcefc3
Merge: e29c010 39aa890
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Fri Sep 7 23:45:03 2012 +0800
Merged master changes.
commit e29c010beb96ca07697c4e3e0c0d5d3ffdc4c0a3
Merge: 8e3fd70 30bdf22
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Aug 20 13:12:57 2012 +0800
Merge remote-tracking branch 'django/master' into t3011
commit 8e3fd703d02c31a4c3ac9f51f5011d03c0bd47f6
Merge: 507bb50 26e0ba0
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Aug 20 13:09:09 2012 +0800
Merged recent changes from trunk.
commit 507bb50a9291bfcdcfa1198f9fea21d4e3b1e762
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Jun 4 20:41:37 2012 +0800
Modified auth app so that login with alternate auth app is possible.
commit dabe3628362ab7a4a6c9686dd874803baa997eaa
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Jun 4 20:10:51 2012 +0800
Modified auth management commands to handle custom user definitions.
commit 7cc0baf89d490c92ef3f1dc909b8090191a1294b
Author: Russell Keith-Magee <russell@keith-magee.com>
Date: Mon Jun 4 14:17:28 2012 +0800
Added model Meta option for swappable models, and made auth.User a swappable model
2012-09-26 10:48:09 +00:00
|
|
|
|
2009-04-10 15:50:51 +00:00
|
|
|
class ChangePasswordTest(AuthViewsTestCase):
|
2008-08-23 18:20:49 +00:00
|
|
|
|
2016-08-18 22:51:53 +00:00
|
|
|
def fail_login(self):
|
2008-08-23 18:20:49 +00:00
|
|
|
response = self.client.post('/login/', {
|
|
|
|
'username': 'testclient',
|
2016-08-18 22:51:53 +00:00
|
|
|
'password': 'password',
|
2011-12-15 16:12:46 +00:00
|
|
|
})
|
2013-02-13 22:10:43 +00:00
|
|
|
self.assertFormError(response, AuthenticationForm.error_messages['invalid_login'] % {
|
2013-10-19 23:33:10 +00:00
|
|
|
'username': User._meta.get_field('username').verbose_name
|
2013-10-18 09:02:43 +00:00
|
|
|
})
|
2008-08-23 18:20:49 +00:00
|
|
|
|
|
|
|
def logout(self):
|
2013-08-04 16:17:10 +00:00
|
|
|
self.client.get('/logout/')
|
2008-08-23 18:20:49 +00:00
|
|
|
|
|
|
|
def test_password_change_fails_with_invalid_old_password(self):
|
|
|
|
self.login()
|
|
|
|
response = self.client.post('/password_change/', {
|
|
|
|
'old_password': 'donuts',
|
|
|
|
'new_password1': 'password1',
|
|
|
|
'new_password2': 'password1',
|
2011-12-15 16:12:46 +00:00
|
|
|
})
|
2013-02-13 22:10:43 +00:00
|
|
|
self.assertFormError(response, PasswordChangeForm.error_messages['password_incorrect'])
|
2008-08-23 18:20:49 +00:00
|
|
|
|
|
|
|
def test_password_change_fails_with_mismatched_passwords(self):
|
|
|
|
self.login()
|
|
|
|
response = self.client.post('/password_change/', {
|
|
|
|
'old_password': 'password',
|
|
|
|
'new_password1': 'password1',
|
|
|
|
'new_password2': 'donuts',
|
2011-12-15 16:12:46 +00:00
|
|
|
})
|
2013-02-13 22:10:43 +00:00
|
|
|
self.assertFormError(response, SetPasswordForm.error_messages['password_mismatch'])
|
2008-08-23 18:20:49 +00:00
|
|
|
|
|
|
|
def test_password_change_succeeds(self):
|
|
|
|
self.login()
|
2013-08-04 16:17:10 +00:00
|
|
|
self.client.post('/password_change/', {
|
2008-08-23 18:20:49 +00:00
|
|
|
'old_password': 'password',
|
|
|
|
'new_password1': 'password1',
|
|
|
|
'new_password2': 'password1',
|
2011-12-15 16:12:46 +00:00
|
|
|
})
|
2008-08-23 18:20:49 +00:00
|
|
|
self.fail_login()
|
|
|
|
self.login(password='password1')
|
|
|
|
|
2011-06-26 16:51:25 +00:00
|
|
|
def test_password_change_done_succeeds(self):
|
|
|
|
self.login()
|
|
|
|
response = self.client.post('/password_change/', {
|
|
|
|
'old_password': 'password',
|
|
|
|
'new_password1': 'password1',
|
|
|
|
'new_password2': 'password1',
|
2011-12-15 16:12:46 +00:00
|
|
|
})
|
2016-10-28 15:52:52 +00:00
|
|
|
self.assertRedirects(response, '/password_change/done/', fetch_redirect_response=False)
|
2011-06-26 16:51:25 +00:00
|
|
|
|
2013-05-19 10:57:06 +00:00
|
|
|
@override_settings(LOGIN_URL='/login/')
|
2011-06-26 16:51:25 +00:00
|
|
|
def test_password_change_done_fails(self):
|
2013-05-19 10:57:06 +00:00
|
|
|
response = self.client.get('/password_change/done/')
|
2016-10-28 15:52:52 +00:00
|
|
|
self.assertRedirects(response, '/login/?next=/password_change/done/', fetch_redirect_response=False)
|
2013-05-19 10:57:06 +00:00
|
|
|
|
|
|
|
def test_password_change_redirect_default(self):
|
|
|
|
self.login()
|
|
|
|
response = self.client.post('/password_change/', {
|
|
|
|
'old_password': 'password',
|
|
|
|
'new_password1': 'password1',
|
|
|
|
'new_password2': 'password1',
|
|
|
|
})
|
2016-10-28 15:52:52 +00:00
|
|
|
self.assertRedirects(response, '/password_change/done/', fetch_redirect_response=False)
|
2013-05-19 10:57:06 +00:00
|
|
|
|
|
|
|
def test_password_change_redirect_custom(self):
|
|
|
|
self.login()
|
|
|
|
response = self.client.post('/password_change/custom/', {
|
|
|
|
'old_password': 'password',
|
|
|
|
'new_password1': 'password1',
|
|
|
|
'new_password2': 'password1',
|
|
|
|
})
|
2016-10-28 15:52:52 +00:00
|
|
|
self.assertRedirects(response, '/custom/', fetch_redirect_response=False)
|
2013-05-19 10:57:06 +00:00
|
|
|
|
|
|
|
def test_password_change_redirect_custom_named(self):
|
|
|
|
self.login()
|
|
|
|
response = self.client.post('/password_change/custom/named/', {
|
|
|
|
'old_password': 'password',
|
|
|
|
'new_password1': 'password1',
|
|
|
|
'new_password2': 'password1',
|
|
|
|
})
|
2016-10-28 15:52:52 +00:00
|
|
|
self.assertRedirects(response, '/password_reset/', fetch_redirect_response=False)
|
2011-06-26 16:51:25 +00:00
|
|
|
|
|
|
|
|
2014-04-01 00:16:09 +00:00
|
|
|
class SessionAuthenticationTests(AuthViewsTestCase):
|
|
|
|
def test_user_password_change_updates_session(self):
|
|
|
|
"""
|
|
|
|
#21649 - Ensure contrib.auth.views.password_change updates the user's
|
|
|
|
session auth hash after a password change so the session isn't logged out.
|
|
|
|
"""
|
|
|
|
self.login()
|
2016-08-15 23:29:12 +00:00
|
|
|
original_session_key = self.client.session.session_key
|
2014-04-01 00:16:09 +00:00
|
|
|
response = self.client.post('/password_change/', {
|
|
|
|
'old_password': 'password',
|
|
|
|
'new_password1': 'password1',
|
|
|
|
'new_password2': 'password1',
|
|
|
|
})
|
|
|
|
# if the hash isn't updated, retrieving the redirection page will fail.
|
|
|
|
self.assertRedirects(response, '/password_change/done/')
|
2016-08-15 23:29:12 +00:00
|
|
|
# The session key is rotated.
|
|
|
|
self.assertNotEqual(original_session_key, self.client.session.session_key)
|
2014-04-01 00:16:09 +00:00
|
|
|
|
|
|
|
|
2009-04-10 15:50:51 +00:00
|
|
|
class LoginTest(AuthViewsTestCase):
|
2009-04-01 16:37:48 +00:00
|
|
|
|
|
|
|
def test_current_site_in_context_after_login(self):
|
2013-05-30 17:39:54 +00:00
|
|
|
response = self.client.get(reverse('login'))
|
2011-03-03 15:04:39 +00:00
|
|
|
self.assertEqual(response.status_code, 200)
|
2014-02-01 16:37:08 +00:00
|
|
|
if apps.is_installed('django.contrib.sites'):
|
|
|
|
Site = apps.get_model('sites.Site')
|
2011-02-05 03:49:03 +00:00
|
|
|
site = Site.objects.get_current()
|
2011-03-03 15:04:39 +00:00
|
|
|
self.assertEqual(response.context['site'], site)
|
|
|
|
self.assertEqual(response.context['site_name'], site.name)
|
2011-02-05 03:49:03 +00:00
|
|
|
else:
|
|
|
|
self.assertIsInstance(response.context['site'], RequestSite)
|
2014-04-09 20:20:22 +00:00
|
|
|
self.assertIsInstance(response.context['form'], AuthenticationForm)
|
2010-03-01 19:58:53 +00:00
|
|
|
|
2016-08-18 22:51:53 +00:00
|
|
|
def test_security_check(self):
|
2013-05-30 17:39:54 +00:00
|
|
|
login_url = reverse('login')
|
2010-03-01 19:58:53 +00:00
|
|
|
|
2017-03-07 21:00:43 +00:00
|
|
|
# These URLs should not pass the security check.
|
|
|
|
bad_urls = (
|
|
|
|
'http://example.com',
|
|
|
|
'http:///example.com',
|
|
|
|
'https://example.com',
|
|
|
|
'ftp://example.com',
|
|
|
|
'///example.com',
|
|
|
|
'//example.com',
|
|
|
|
'javascript:alert("XSS")',
|
|
|
|
)
|
|
|
|
for bad_url in bad_urls:
|
|
|
|
with self.subTest(bad_url=bad_url):
|
|
|
|
nasty_url = '%(url)s?%(next)s=%(bad_url)s' % {
|
|
|
|
'url': login_url,
|
|
|
|
'next': REDIRECT_FIELD_NAME,
|
|
|
|
'bad_url': quote(bad_url),
|
|
|
|
}
|
|
|
|
response = self.client.post(nasty_url, {
|
|
|
|
'username': 'testclient',
|
|
|
|
'password': 'password',
|
|
|
|
})
|
|
|
|
self.assertEqual(response.status_code, 302)
|
|
|
|
self.assertNotIn(bad_url, response.url, '%s should be blocked' % bad_url)
|
|
|
|
|
|
|
|
# These URLs should pass the security check.
|
|
|
|
good_urls = (
|
|
|
|
'/view/?param=http://example.com',
|
|
|
|
'/view/?param=https://example.com',
|
|
|
|
'/view?param=ftp://example.com',
|
|
|
|
'view/?param=//example.com',
|
|
|
|
'https://testserver/',
|
|
|
|
'HTTPS://testserver/',
|
|
|
|
'//testserver/',
|
|
|
|
'/url%20with%20spaces/',
|
|
|
|
)
|
|
|
|
for good_url in good_urls:
|
|
|
|
with self.subTest(good_url=good_url):
|
|
|
|
safe_url = '%(url)s?%(next)s=%(good_url)s' % {
|
|
|
|
'url': login_url,
|
|
|
|
'next': REDIRECT_FIELD_NAME,
|
|
|
|
'good_url': quote(good_url),
|
|
|
|
}
|
|
|
|
response = self.client.post(safe_url, {
|
|
|
|
'username': 'testclient',
|
|
|
|
'password': 'password',
|
|
|
|
})
|
|
|
|
self.assertEqual(response.status_code, 302)
|
|
|
|
self.assertIn(good_url, response.url, '%s should be allowed' % good_url)
|
2010-03-01 19:58:53 +00:00
|
|
|
|
2016-08-19 11:40:21 +00:00
|
|
|
def test_security_check_https(self):
|
|
|
|
login_url = reverse('login')
|
|
|
|
non_https_next_url = 'http://testserver/path'
|
|
|
|
not_secured_url = '%(url)s?%(next)s=%(next_url)s' % {
|
|
|
|
'url': login_url,
|
|
|
|
'next': REDIRECT_FIELD_NAME,
|
2017-01-26 13:25:15 +00:00
|
|
|
'next_url': quote(non_https_next_url),
|
2016-08-19 11:40:21 +00:00
|
|
|
}
|
|
|
|
post_data = {
|
|
|
|
'username': 'testclient',
|
|
|
|
'password': 'password',
|
|
|
|
}
|
|
|
|
response = self.client.post(not_secured_url, post_data, secure=True)
|
|
|
|
self.assertEqual(response.status_code, 302)
|
|
|
|
self.assertNotEqual(response.url, non_https_next_url)
|
|
|
|
self.assertEqual(response.url, settings.LOGIN_REDIRECT_URL)
|
|
|
|
|
2013-02-23 23:25:05 +00:00
|
|
|
def test_login_form_contains_request(self):
|
2017-02-07 09:17:36 +00:00
|
|
|
# The custom authentication form for this login requires a request to
|
|
|
|
# initialize it.
|
|
|
|
response = self.client.post('/custom_request_auth_login/', {
|
2013-02-23 23:25:05 +00:00
|
|
|
'username': 'testclient',
|
|
|
|
'password': 'password',
|
2017-02-07 09:17:36 +00:00
|
|
|
})
|
|
|
|
# The login was successful.
|
|
|
|
self.assertRedirects(response, settings.LOGIN_REDIRECT_URL, fetch_redirect_response=False)
|
2011-03-01 22:49:18 +00:00
|
|
|
|
2016-08-18 22:51:53 +00:00
|
|
|
def test_login_csrf_rotate(self):
|
2013-05-23 15:14:27 +00:00
|
|
|
"""
|
|
|
|
Makes sure that a login rotates the currently-used CSRF token.
|
|
|
|
"""
|
|
|
|
# Do a GET to establish a CSRF token
|
2017-09-09 13:41:45 +00:00
|
|
|
# The test client isn't used here as it's a test for middleware.
|
2013-05-23 15:14:27 +00:00
|
|
|
req = HttpRequest()
|
2016-05-15 15:28:00 +00:00
|
|
|
CsrfViewMiddleware().process_view(req, LoginView.as_view(), (), {})
|
2015-04-24 06:24:38 +00:00
|
|
|
# get_token() triggers CSRF token inclusion in the response
|
|
|
|
get_token(req)
|
2016-05-15 15:28:00 +00:00
|
|
|
resp = LoginView.as_view()(req)
|
2013-05-23 15:14:27 +00:00
|
|
|
resp2 = CsrfViewMiddleware().process_response(req, resp)
|
|
|
|
csrf_cookie = resp2.cookies.get(settings.CSRF_COOKIE_NAME, None)
|
|
|
|
token1 = csrf_cookie.coded_value
|
|
|
|
|
|
|
|
# Prepare the POST request
|
|
|
|
req = HttpRequest()
|
|
|
|
req.COOKIES[settings.CSRF_COOKIE_NAME] = token1
|
|
|
|
req.method = "POST"
|
2016-08-18 22:51:53 +00:00
|
|
|
req.POST = {'username': 'testclient', 'password': 'password', 'csrfmiddlewaretoken': token1}
|
2013-05-23 15:14:27 +00:00
|
|
|
|
|
|
|
# Use POST request to log in
|
|
|
|
SessionMiddleware().process_request(req)
|
2016-05-15 15:28:00 +00:00
|
|
|
CsrfViewMiddleware().process_view(req, LoginView.as_view(), (), {})
|
2013-05-23 15:14:27 +00:00
|
|
|
req.META["SERVER_NAME"] = "testserver" # Required to have redirect work in login view
|
|
|
|
req.META["SERVER_PORT"] = 80
|
2016-05-15 15:28:00 +00:00
|
|
|
resp = LoginView.as_view()(req)
|
2013-05-23 15:14:27 +00:00
|
|
|
resp2 = CsrfViewMiddleware().process_response(req, resp)
|
|
|
|
csrf_cookie = resp2.cookies.get(settings.CSRF_COOKIE_NAME, None)
|
|
|
|
token2 = csrf_cookie.coded_value
|
|
|
|
|
|
|
|
# Check the CSRF token switched
|
|
|
|
self.assertNotEqual(token1, token2)
|
|
|
|
|
2014-04-01 00:16:09 +00:00
|
|
|
def test_session_key_flushed_on_login(self):
|
|
|
|
"""
|
|
|
|
To avoid reusing another user's session, ensure a new, empty session is
|
|
|
|
created if the existing session corresponds to a different authenticated
|
|
|
|
user.
|
|
|
|
"""
|
|
|
|
self.login()
|
|
|
|
original_session_key = self.client.session.session_key
|
|
|
|
|
|
|
|
self.login(username='staff')
|
|
|
|
self.assertNotEqual(original_session_key, self.client.session.session_key)
|
|
|
|
|
|
|
|
def test_session_key_flushed_on_login_after_password_change(self):
|
|
|
|
"""
|
|
|
|
As above, but same user logging in after a password change.
|
|
|
|
"""
|
|
|
|
self.login()
|
|
|
|
original_session_key = self.client.session.session_key
|
|
|
|
|
|
|
|
# If no password change, session key should not be flushed.
|
|
|
|
self.login()
|
|
|
|
self.assertEqual(original_session_key, self.client.session.session_key)
|
|
|
|
|
|
|
|
user = User.objects.get(username='testclient')
|
|
|
|
user.set_password('foobar')
|
|
|
|
user.save()
|
|
|
|
|
|
|
|
self.login(password='foobar')
|
|
|
|
self.assertNotEqual(original_session_key, self.client.session.session_key)
|
|
|
|
|
2014-04-10 12:03:50 +00:00
|
|
|
def test_login_session_without_hash_session_key(self):
|
|
|
|
"""
|
|
|
|
Session without django.contrib.auth.HASH_SESSION_KEY should login
|
|
|
|
without an exception.
|
|
|
|
"""
|
|
|
|
user = User.objects.get(username='testclient')
|
|
|
|
engine = import_module(settings.SESSION_ENGINE)
|
|
|
|
session = engine.SessionStore()
|
|
|
|
session[SESSION_KEY] = user.id
|
|
|
|
session.save()
|
|
|
|
original_session_key = session.session_key
|
|
|
|
self.client.cookies[settings.SESSION_COOKIE_NAME] = original_session_key
|
|
|
|
|
|
|
|
self.login()
|
|
|
|
self.assertNotEqual(original_session_key, self.client.session.session_key)
|
|
|
|
|
2013-05-19 10:57:06 +00:00
|
|
|
|
2010-11-27 22:43:33 +00:00
|
|
|
class LoginURLSettings(AuthViewsTestCase):
|
2013-05-19 10:57:06 +00:00
|
|
|
"""Tests for settings.LOGIN_URL."""
|
2017-12-19 19:05:10 +00:00
|
|
|
def assertLoginURLEquals(self, url):
|
2010-11-27 22:43:33 +00:00
|
|
|
response = self.client.get('/login_required/')
|
2018-06-20 18:08:56 +00:00
|
|
|
self.assertRedirects(response, url, fetch_redirect_response=False)
|
2010-11-27 22:43:33 +00:00
|
|
|
|
2013-05-19 10:57:06 +00:00
|
|
|
@override_settings(LOGIN_URL='/login/')
|
2010-11-27 22:43:33 +00:00
|
|
|
def test_standard_login_url(self):
|
2013-05-19 10:57:06 +00:00
|
|
|
self.assertLoginURLEquals('/login/?next=/login_required/')
|
|
|
|
|
|
|
|
@override_settings(LOGIN_URL='login')
|
|
|
|
def test_named_login_url(self):
|
|
|
|
self.assertLoginURLEquals('/login/?next=/login_required/')
|
2010-11-27 22:43:33 +00:00
|
|
|
|
2013-05-19 10:57:06 +00:00
|
|
|
@override_settings(LOGIN_URL='http://remote.example.com/login')
|
2010-11-27 22:43:33 +00:00
|
|
|
def test_remote_login_url(self):
|
2017-01-26 13:25:15 +00:00
|
|
|
quoted_next = quote('http://testserver/login_required/')
|
2013-05-19 10:57:06 +00:00
|
|
|
expected = 'http://remote.example.com/login?next=%s' % quoted_next
|
|
|
|
self.assertLoginURLEquals(expected)
|
2010-11-27 22:43:33 +00:00
|
|
|
|
2013-05-19 10:57:06 +00:00
|
|
|
@override_settings(LOGIN_URL='https:///login/')
|
2010-11-27 22:43:33 +00:00
|
|
|
def test_https_login_url(self):
|
2017-01-26 13:25:15 +00:00
|
|
|
quoted_next = quote('http://testserver/login_required/')
|
2013-05-19 10:57:06 +00:00
|
|
|
expected = 'https:///login/?next=%s' % quoted_next
|
|
|
|
self.assertLoginURLEquals(expected)
|
2010-11-27 22:43:33 +00:00
|
|
|
|
2013-05-19 10:57:06 +00:00
|
|
|
@override_settings(LOGIN_URL='/login/?pretty=1')
|
2010-11-27 22:43:33 +00:00
|
|
|
def test_login_url_with_querystring(self):
|
2017-12-19 19:05:10 +00:00
|
|
|
self.assertLoginURLEquals('/login/?pretty=1&next=/login_required/')
|
2010-11-27 22:43:33 +00:00
|
|
|
|
2013-05-19 10:57:06 +00:00
|
|
|
@override_settings(LOGIN_URL='http://remote.example.com/login/?next=/default/')
|
2010-11-27 22:43:33 +00:00
|
|
|
def test_remote_login_url_with_next_querystring(self):
|
2017-01-26 13:25:15 +00:00
|
|
|
quoted_next = quote('http://testserver/login_required/')
|
2013-05-19 10:57:06 +00:00
|
|
|
expected = 'http://remote.example.com/login/?next=%s' % quoted_next
|
|
|
|
self.assertLoginURLEquals(expected)
|
|
|
|
|
2015-01-09 21:18:34 +00:00
|
|
|
@override_settings(LOGIN_URL=reverse_lazy('login'))
|
|
|
|
def test_lazy_login_url(self):
|
|
|
|
self.assertLoginURLEquals('/login/?next=/login_required/')
|
|
|
|
|
2013-05-19 10:57:06 +00:00
|
|
|
|
|
|
|
class LoginRedirectUrlTest(AuthViewsTestCase):
|
|
|
|
"""Tests for settings.LOGIN_REDIRECT_URL."""
|
|
|
|
def assertLoginRedirectURLEqual(self, url):
|
|
|
|
response = self.login()
|
2016-10-28 15:52:52 +00:00
|
|
|
self.assertRedirects(response, url, fetch_redirect_response=False)
|
2013-05-19 10:57:06 +00:00
|
|
|
|
|
|
|
def test_default(self):
|
|
|
|
self.assertLoginRedirectURLEqual('/accounts/profile/')
|
|
|
|
|
|
|
|
@override_settings(LOGIN_REDIRECT_URL='/custom/')
|
|
|
|
def test_custom(self):
|
|
|
|
self.assertLoginRedirectURLEqual('/custom/')
|
|
|
|
|
|
|
|
@override_settings(LOGIN_REDIRECT_URL='password_reset')
|
|
|
|
def test_named(self):
|
|
|
|
self.assertLoginRedirectURLEqual('/password_reset/')
|
|
|
|
|
|
|
|
@override_settings(LOGIN_REDIRECT_URL='http://remote.example.com/welcome/')
|
|
|
|
def test_remote(self):
|
|
|
|
self.assertLoginRedirectURLEqual('http://remote.example.com/welcome/')
|
2010-12-01 22:25:17 +00:00
|
|
|
|
|
|
|
|
2015-01-09 21:18:34 +00:00
|
|
|
class RedirectToLoginTests(AuthViewsTestCase):
|
|
|
|
"""Tests for the redirect_to_login view"""
|
|
|
|
@override_settings(LOGIN_URL=reverse_lazy('login'))
|
|
|
|
def test_redirect_to_login_with_lazy(self):
|
|
|
|
login_redirect_response = redirect_to_login(next='/else/where/')
|
|
|
|
expected = '/login/?next=/else/where/'
|
|
|
|
self.assertEqual(expected, login_redirect_response.url)
|
|
|
|
|
|
|
|
@override_settings(LOGIN_URL=reverse_lazy('login'))
|
|
|
|
def test_redirect_to_login_with_lazy_and_unicode(self):
|
|
|
|
login_redirect_response = redirect_to_login(next='/else/where/झ/')
|
|
|
|
expected = '/login/?next=/else/where/%E0%A4%9D/'
|
|
|
|
self.assertEqual(expected, login_redirect_response.url)
|
|
|
|
|
|
|
|
|
2016-07-20 16:32:19 +00:00
|
|
|
class LogoutThenLoginTests(AuthViewsTestCase):
|
|
|
|
"""Tests for the logout_then_login view"""
|
|
|
|
|
|
|
|
def confirm_logged_out(self):
|
|
|
|
self.assertNotIn(SESSION_KEY, self.client.session)
|
|
|
|
|
|
|
|
@override_settings(LOGIN_URL='/login/')
|
|
|
|
def test_default_logout_then_login(self):
|
|
|
|
self.login()
|
|
|
|
req = HttpRequest()
|
|
|
|
req.method = 'GET'
|
|
|
|
req.session = self.client.session
|
|
|
|
response = logout_then_login(req)
|
|
|
|
self.confirm_logged_out()
|
|
|
|
self.assertRedirects(response, '/login/', fetch_redirect_response=False)
|
|
|
|
|
|
|
|
def test_logout_then_login_with_custom_login(self):
|
|
|
|
self.login()
|
|
|
|
req = HttpRequest()
|
|
|
|
req.method = 'GET'
|
|
|
|
req.session = self.client.session
|
|
|
|
response = logout_then_login(req, login_url='/custom/')
|
|
|
|
self.confirm_logged_out()
|
|
|
|
self.assertRedirects(response, '/custom/', fetch_redirect_response=False)
|
|
|
|
|
|
|
|
|
2015-11-11 23:48:16 +00:00
|
|
|
class LoginRedirectAuthenticatedUser(AuthViewsTestCase):
|
|
|
|
dont_redirect_url = '/login/redirect_authenticated_user_default/'
|
|
|
|
do_redirect_url = '/login/redirect_authenticated_user/'
|
|
|
|
|
|
|
|
def test_default(self):
|
|
|
|
"""Stay on the login page by default."""
|
|
|
|
self.login()
|
|
|
|
response = self.client.get(self.dont_redirect_url)
|
|
|
|
self.assertEqual(response.status_code, 200)
|
2017-05-22 21:52:56 +00:00
|
|
|
self.assertEqual(response.context['next'], '')
|
2015-11-11 23:48:16 +00:00
|
|
|
|
|
|
|
def test_guest(self):
|
|
|
|
"""If not logged in, stay on the same page."""
|
|
|
|
response = self.client.get(self.do_redirect_url)
|
|
|
|
self.assertEqual(response.status_code, 200)
|
|
|
|
|
|
|
|
def test_redirect(self):
|
|
|
|
"""If logged in, go to default redirected URL."""
|
|
|
|
self.login()
|
|
|
|
response = self.client.get(self.do_redirect_url)
|
|
|
|
self.assertRedirects(response, '/accounts/profile/', fetch_redirect_response=False)
|
|
|
|
|
|
|
|
@override_settings(LOGIN_REDIRECT_URL='/custom/')
|
|
|
|
def test_redirect_url(self):
|
|
|
|
"""If logged in, go to custom redirected URL."""
|
|
|
|
self.login()
|
|
|
|
response = self.client.get(self.do_redirect_url)
|
|
|
|
self.assertRedirects(response, '/custom/', fetch_redirect_response=False)
|
|
|
|
|
|
|
|
def test_redirect_param(self):
|
|
|
|
"""If next is specified as a GET parameter, go there."""
|
|
|
|
self.login()
|
|
|
|
url = self.do_redirect_url + '?next=/custom_next/'
|
|
|
|
response = self.client.get(url)
|
|
|
|
self.assertRedirects(response, '/custom_next/', fetch_redirect_response=False)
|
|
|
|
|
|
|
|
def test_redirect_loop(self):
|
|
|
|
"""
|
|
|
|
Detect a redirect loop if LOGIN_REDIRECT_URL is not correctly set,
|
|
|
|
with and without custom parameters.
|
|
|
|
"""
|
|
|
|
self.login()
|
|
|
|
msg = (
|
|
|
|
"Redirection loop for authenticated user detected. Check that "
|
2019-03-15 23:27:57 +00:00
|
|
|
"your LOGIN_REDIRECT_URL doesn't point to a login page."
|
2015-11-11 23:48:16 +00:00
|
|
|
)
|
|
|
|
with self.settings(LOGIN_REDIRECT_URL=self.do_redirect_url):
|
|
|
|
with self.assertRaisesMessage(ValueError, msg):
|
|
|
|
self.client.get(self.do_redirect_url)
|
|
|
|
|
|
|
|
url = self.do_redirect_url + '?bla=2'
|
|
|
|
with self.assertRaisesMessage(ValueError, msg):
|
|
|
|
self.client.get(url)
|
|
|
|
|
2018-03-12 15:48:46 +00:00
|
|
|
def test_permission_required_not_logged_in(self):
|
|
|
|
# Not logged in ...
|
|
|
|
with self.settings(LOGIN_URL=self.do_redirect_url):
|
|
|
|
# redirected to login.
|
|
|
|
response = self.client.get('/permission_required_redirect/', follow=True)
|
|
|
|
self.assertEqual(response.status_code, 200)
|
|
|
|
# exception raised.
|
|
|
|
response = self.client.get('/permission_required_exception/', follow=True)
|
|
|
|
self.assertEqual(response.status_code, 403)
|
|
|
|
# redirected to login.
|
|
|
|
response = self.client.get('/login_and_permission_required_exception/', follow=True)
|
|
|
|
self.assertEqual(response.status_code, 200)
|
|
|
|
|
|
|
|
def test_permission_required_logged_in(self):
|
|
|
|
self.login()
|
|
|
|
# Already logged in...
|
|
|
|
with self.settings(LOGIN_URL=self.do_redirect_url):
|
|
|
|
# redirect loop encountered.
|
|
|
|
with self.assertRaisesMessage(RedirectCycleError, 'Redirect loop detected.'):
|
|
|
|
self.client.get('/permission_required_redirect/', follow=True)
|
|
|
|
# exception raised.
|
|
|
|
response = self.client.get('/permission_required_exception/', follow=True)
|
|
|
|
self.assertEqual(response.status_code, 403)
|
|
|
|
# exception raised.
|
|
|
|
response = self.client.get('/login_and_permission_required_exception/', follow=True)
|
|
|
|
self.assertEqual(response.status_code, 403)
|
|
|
|
|
2015-11-11 23:48:16 +00:00
|
|
|
|
2016-07-26 23:10:08 +00:00
|
|
|
class LoginSuccessURLAllowedHostsTest(AuthViewsTestCase):
|
|
|
|
def test_success_url_allowed_hosts_same_host(self):
|
|
|
|
response = self.client.post('/login/allowed_hosts/', {
|
|
|
|
'username': 'testclient',
|
|
|
|
'password': 'password',
|
|
|
|
'next': 'https://testserver/home',
|
|
|
|
})
|
|
|
|
self.assertIn(SESSION_KEY, self.client.session)
|
2016-10-28 15:52:52 +00:00
|
|
|
self.assertRedirects(response, 'https://testserver/home', fetch_redirect_response=False)
|
2016-07-26 23:10:08 +00:00
|
|
|
|
|
|
|
def test_success_url_allowed_hosts_safe_host(self):
|
|
|
|
response = self.client.post('/login/allowed_hosts/', {
|
|
|
|
'username': 'testclient',
|
|
|
|
'password': 'password',
|
|
|
|
'next': 'https://otherserver/home',
|
|
|
|
})
|
|
|
|
self.assertIn(SESSION_KEY, self.client.session)
|
2016-10-28 15:52:52 +00:00
|
|
|
self.assertRedirects(response, 'https://otherserver/home', fetch_redirect_response=False)
|
2016-07-26 23:10:08 +00:00
|
|
|
|
|
|
|
def test_success_url_allowed_hosts_unsafe_host(self):
|
|
|
|
response = self.client.post('/login/allowed_hosts/', {
|
|
|
|
'username': 'testclient',
|
|
|
|
'password': 'password',
|
|
|
|
'next': 'https://evil/home',
|
|
|
|
})
|
|
|
|
self.assertIn(SESSION_KEY, self.client.session)
|
2016-10-28 15:52:52 +00:00
|
|
|
self.assertRedirects(response, '/accounts/profile/', fetch_redirect_response=False)
|
2016-07-26 23:10:08 +00:00
|
|
|
|
|
|
|
|
2009-04-10 15:50:51 +00:00
|
|
|
class LogoutTest(AuthViewsTestCase):
|
2009-04-01 17:02:32 +00:00
|
|
|
|
|
|
|
def confirm_logged_out(self):
|
2014-10-28 10:02:56 +00:00
|
|
|
self.assertNotIn(SESSION_KEY, self.client.session)
|
2009-04-01 17:02:32 +00:00
|
|
|
|
|
|
|
def test_logout_default(self):
|
|
|
|
"Logout without next_page option renders the default template"
|
|
|
|
self.login()
|
|
|
|
response = self.client.get('/logout/')
|
2012-04-14 13:35:25 +00:00
|
|
|
self.assertContains(response, 'Logged out')
|
2009-04-01 17:02:32 +00:00
|
|
|
self.confirm_logged_out()
|
|
|
|
|
2017-08-24 13:11:16 +00:00
|
|
|
def test_logout_with_post(self):
|
|
|
|
self.login()
|
|
|
|
response = self.client.post('/logout/')
|
|
|
|
self.assertContains(response, 'Logged out')
|
|
|
|
self.confirm_logged_out()
|
|
|
|
|
Fixed #14386, #8960, #10235, #10909, #10608, #13845, #14377 - standardize Site/RequestSite usage in various places.
Many thanks to gabrielhurley for putting most of this together. Also to
bmihelac, arthurk, qingfeng, hvendelbo, petr.pulc@s-cape.cz, Hraban for
reports and some initial patches.
The patch also contains some whitespace/PEP8 fixes.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13980 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-10-04 14:20:47 +00:00
|
|
|
def test_14377(self):
|
|
|
|
# Bug 14377
|
|
|
|
self.login()
|
|
|
|
response = self.client.get('/logout/')
|
2014-10-28 10:02:56 +00:00
|
|
|
self.assertIn('site', response.context)
|
Fixed #14386, #8960, #10235, #10909, #10608, #13845, #14377 - standardize Site/RequestSite usage in various places.
Many thanks to gabrielhurley for putting most of this together. Also to
bmihelac, arthurk, qingfeng, hvendelbo, petr.pulc@s-cape.cz, Hraban for
reports and some initial patches.
The patch also contains some whitespace/PEP8 fixes.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13980 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-10-04 14:20:47 +00:00
|
|
|
|
2015-10-01 19:52:18 +00:00
|
|
|
def test_logout_doesnt_cache(self):
|
|
|
|
"""
|
|
|
|
The logout() view should send "no-cache" headers for reasons described
|
|
|
|
in #25490.
|
|
|
|
"""
|
|
|
|
response = self.client.get('/logout/')
|
|
|
|
self.assertIn('no-store', response['Cache-Control'])
|
|
|
|
|
2011-03-02 12:47:44 +00:00
|
|
|
def test_logout_with_overridden_redirect_url(self):
|
|
|
|
# Bug 11223
|
|
|
|
self.login()
|
|
|
|
response = self.client.get('/logout/next_page/')
|
2016-10-28 15:52:52 +00:00
|
|
|
self.assertRedirects(response, '/somewhere/', fetch_redirect_response=False)
|
2011-03-02 12:47:44 +00:00
|
|
|
|
|
|
|
response = self.client.get('/logout/next_page/?next=/login/')
|
2016-10-28 15:52:52 +00:00
|
|
|
self.assertRedirects(response, '/login/', fetch_redirect_response=False)
|
2011-03-02 12:47:44 +00:00
|
|
|
|
|
|
|
self.confirm_logged_out()
|
|
|
|
|
2011-03-03 15:04:39 +00:00
|
|
|
def test_logout_with_next_page_specified(self):
|
2009-04-01 17:02:32 +00:00
|
|
|
"Logout with next_page option given redirects to specified resource"
|
|
|
|
self.login()
|
|
|
|
response = self.client.get('/logout/next_page/')
|
2016-10-28 15:52:52 +00:00
|
|
|
self.assertRedirects(response, '/somewhere/', fetch_redirect_response=False)
|
2009-04-01 17:02:32 +00:00
|
|
|
self.confirm_logged_out()
|
|
|
|
|
|
|
|
def test_logout_with_redirect_argument(self):
|
|
|
|
"Logout with query string redirects to specified resource"
|
|
|
|
self.login()
|
|
|
|
response = self.client.get('/logout/?next=/login/')
|
2016-10-28 15:52:52 +00:00
|
|
|
self.assertRedirects(response, '/login/', fetch_redirect_response=False)
|
2009-04-01 17:02:32 +00:00
|
|
|
self.confirm_logged_out()
|
|
|
|
|
|
|
|
def test_logout_with_custom_redirect_argument(self):
|
|
|
|
"Logout with custom query string redirects to specified resource"
|
|
|
|
self.login()
|
|
|
|
response = self.client.get('/logout/custom_query/?follow=/somewhere/')
|
2016-10-28 15:52:52 +00:00
|
|
|
self.assertRedirects(response, '/somewhere/', fetch_redirect_response=False)
|
2013-05-19 10:57:06 +00:00
|
|
|
self.confirm_logged_out()
|
|
|
|
|
|
|
|
def test_logout_with_named_redirect(self):
|
|
|
|
"Logout resolves names or URLs passed as next_page."
|
|
|
|
self.login()
|
|
|
|
response = self.client.get('/logout/next_page/named/')
|
2016-10-28 15:52:52 +00:00
|
|
|
self.assertRedirects(response, '/password_reset/', fetch_redirect_response=False)
|
2009-04-19 03:41:33 +00:00
|
|
|
self.confirm_logged_out()
|
2011-03-02 12:47:44 +00:00
|
|
|
|
2016-07-26 23:10:08 +00:00
|
|
|
def test_success_url_allowed_hosts_same_host(self):
|
|
|
|
self.login()
|
|
|
|
response = self.client.get('/logout/allowed_hosts/?next=https://testserver/')
|
2016-10-28 15:52:52 +00:00
|
|
|
self.assertRedirects(response, 'https://testserver/', fetch_redirect_response=False)
|
2016-07-26 23:10:08 +00:00
|
|
|
self.confirm_logged_out()
|
|
|
|
|
|
|
|
def test_success_url_allowed_hosts_safe_host(self):
|
|
|
|
self.login()
|
|
|
|
response = self.client.get('/logout/allowed_hosts/?next=https://otherserver/')
|
2016-10-28 15:52:52 +00:00
|
|
|
self.assertRedirects(response, 'https://otherserver/', fetch_redirect_response=False)
|
2016-07-26 23:10:08 +00:00
|
|
|
self.confirm_logged_out()
|
|
|
|
|
|
|
|
def test_success_url_allowed_hosts_unsafe_host(self):
|
|
|
|
self.login()
|
|
|
|
response = self.client.get('/logout/allowed_hosts/?next=https://evil/')
|
2016-10-28 15:52:52 +00:00
|
|
|
self.assertRedirects(response, '/logout/allowed_hosts/', fetch_redirect_response=False)
|
2016-07-26 23:10:08 +00:00
|
|
|
self.confirm_logged_out()
|
|
|
|
|
2016-08-18 22:51:53 +00:00
|
|
|
def test_security_check(self):
|
2013-05-30 17:39:54 +00:00
|
|
|
logout_url = reverse('logout')
|
2011-03-02 12:47:44 +00:00
|
|
|
|
2017-03-07 21:00:43 +00:00
|
|
|
# These URLs should not pass the security check.
|
|
|
|
bad_urls = (
|
|
|
|
'http://example.com',
|
|
|
|
'http:///example.com',
|
|
|
|
'https://example.com',
|
|
|
|
'ftp://example.com',
|
|
|
|
'///example.com',
|
|
|
|
'//example.com',
|
|
|
|
'javascript:alert("XSS")',
|
|
|
|
)
|
|
|
|
for bad_url in bad_urls:
|
|
|
|
with self.subTest(bad_url=bad_url):
|
|
|
|
nasty_url = '%(url)s?%(next)s=%(bad_url)s' % {
|
|
|
|
'url': logout_url,
|
|
|
|
'next': REDIRECT_FIELD_NAME,
|
|
|
|
'bad_url': quote(bad_url),
|
|
|
|
}
|
|
|
|
self.login()
|
|
|
|
response = self.client.get(nasty_url)
|
|
|
|
self.assertEqual(response.status_code, 302)
|
|
|
|
self.assertNotIn(bad_url, response.url, '%s should be blocked' % bad_url)
|
|
|
|
self.confirm_logged_out()
|
|
|
|
|
|
|
|
# These URLs should pass the security check.
|
|
|
|
good_urls = (
|
|
|
|
'/view/?param=http://example.com',
|
|
|
|
'/view/?param=https://example.com',
|
|
|
|
'/view?param=ftp://example.com',
|
|
|
|
'view/?param=//example.com',
|
|
|
|
'https://testserver/',
|
|
|
|
'HTTPS://testserver/',
|
|
|
|
'//testserver/',
|
|
|
|
'/url%20with%20spaces/',
|
|
|
|
)
|
|
|
|
for good_url in good_urls:
|
|
|
|
with self.subTest(good_url=good_url):
|
|
|
|
safe_url = '%(url)s?%(next)s=%(good_url)s' % {
|
|
|
|
'url': logout_url,
|
|
|
|
'next': REDIRECT_FIELD_NAME,
|
|
|
|
'good_url': quote(good_url),
|
|
|
|
}
|
|
|
|
self.login()
|
|
|
|
response = self.client.get(safe_url)
|
|
|
|
self.assertEqual(response.status_code, 302)
|
|
|
|
self.assertIn(good_url, response.url, '%s should be allowed' % good_url)
|
|
|
|
self.confirm_logged_out()
|
2013-03-27 16:23:59 +00:00
|
|
|
|
2016-08-19 11:40:21 +00:00
|
|
|
def test_security_check_https(self):
|
|
|
|
logout_url = reverse('logout')
|
|
|
|
non_https_next_url = 'http://testserver/'
|
|
|
|
url = '%(url)s?%(next)s=%(next_url)s' % {
|
|
|
|
'url': logout_url,
|
|
|
|
'next': REDIRECT_FIELD_NAME,
|
2017-01-26 13:25:15 +00:00
|
|
|
'next_url': quote(non_https_next_url),
|
2016-08-19 11:40:21 +00:00
|
|
|
}
|
|
|
|
self.login()
|
|
|
|
response = self.client.get(url, secure=True)
|
2016-10-28 15:52:52 +00:00
|
|
|
self.assertRedirects(response, logout_url, fetch_redirect_response=False)
|
2016-08-19 11:40:21 +00:00
|
|
|
self.confirm_logged_out()
|
|
|
|
|
2013-11-23 17:27:23 +00:00
|
|
|
def test_logout_preserve_language(self):
|
2016-08-14 20:42:49 +00:00
|
|
|
"""Language is preserved after logout."""
|
|
|
|
self.login()
|
|
|
|
self.client.post('/setlang/', {'language': 'pl'})
|
|
|
|
self.assertEqual(self.client.cookies[settings.LANGUAGE_COOKIE_NAME].value, 'pl')
|
2013-11-23 17:27:23 +00:00
|
|
|
self.client.get('/logout/')
|
2016-08-14 20:42:49 +00:00
|
|
|
self.assertEqual(self.client.cookies[settings.LANGUAGE_COOKIE_NAME].value, 'pl')
|
2013-11-23 17:27:23 +00:00
|
|
|
|
2015-08-26 06:07:06 +00:00
|
|
|
@override_settings(LOGOUT_REDIRECT_URL='/custom/')
|
|
|
|
def test_logout_redirect_url_setting(self):
|
|
|
|
self.login()
|
|
|
|
response = self.client.get('/logout/')
|
|
|
|
self.assertRedirects(response, '/custom/', fetch_redirect_response=False)
|
|
|
|
|
|
|
|
@override_settings(LOGOUT_REDIRECT_URL='logout')
|
|
|
|
def test_logout_redirect_url_named_setting(self):
|
|
|
|
self.login()
|
|
|
|
response = self.client.get('/logout/')
|
|
|
|
self.assertRedirects(response, '/logout/', fetch_redirect_response=False)
|
|
|
|
|
2013-10-31 15:42:28 +00:00
|
|
|
|
2018-09-13 13:08:41 +00:00
|
|
|
def get_perm(Model, perm):
|
|
|
|
ct = ContentType.objects.get_for_model(Model)
|
|
|
|
return Permission.objects.get(content_type=ct, codename=perm)
|
|
|
|
|
|
|
|
|
2015-01-21 16:55:57 +00:00
|
|
|
# Redirect in test_user_change_password will fail if session auth hash
|
|
|
|
# isn't updated after password change (#21649)
|
2016-02-05 20:56:52 +00:00
|
|
|
@override_settings(ROOT_URLCONF='auth_tests.urls_admin')
|
2013-03-27 16:23:59 +00:00
|
|
|
class ChangelistTests(AuthViewsTestCase):
|
|
|
|
|
2018-11-24 01:59:38 +00:00
|
|
|
@classmethod
|
|
|
|
def setUpTestData(cls):
|
|
|
|
super().setUpTestData()
|
2012-10-24 15:11:41 +00:00
|
|
|
# Make me a superuser before logging in.
|
2013-03-27 16:23:59 +00:00
|
|
|
User.objects.filter(username='testclient').update(is_staff=True, is_superuser=True)
|
2018-11-24 01:59:38 +00:00
|
|
|
|
|
|
|
def setUp(self):
|
2013-03-27 16:23:59 +00:00
|
|
|
self.login()
|
2018-11-24 01:59:38 +00:00
|
|
|
# Get the latest last_login value.
|
2015-02-23 00:53:57 +00:00
|
|
|
self.admin = User.objects.get(pk=self.u1.pk)
|
2012-10-24 15:11:41 +00:00
|
|
|
|
|
|
|
def get_user_data(self, user):
|
|
|
|
return {
|
|
|
|
'username': user.username,
|
|
|
|
'password': user.password,
|
|
|
|
'email': user.email,
|
|
|
|
'is_active': user.is_active,
|
|
|
|
'is_staff': user.is_staff,
|
|
|
|
'is_superuser': user.is_superuser,
|
|
|
|
'last_login_0': user.last_login.strftime('%Y-%m-%d'),
|
|
|
|
'last_login_1': user.last_login.strftime('%H:%M:%S'),
|
|
|
|
'initial-last_login_0': user.last_login.strftime('%Y-%m-%d'),
|
|
|
|
'initial-last_login_1': user.last_login.strftime('%H:%M:%S'),
|
|
|
|
'date_joined_0': user.date_joined.strftime('%Y-%m-%d'),
|
|
|
|
'date_joined_1': user.date_joined.strftime('%H:%M:%S'),
|
|
|
|
'initial-date_joined_0': user.date_joined.strftime('%Y-%m-%d'),
|
|
|
|
'initial-date_joined_1': user.date_joined.strftime('%H:%M:%S'),
|
|
|
|
'first_name': user.first_name,
|
|
|
|
'last_name': user.last_name,
|
|
|
|
}
|
2013-03-27 16:23:59 +00:00
|
|
|
|
2012-10-24 15:11:41 +00:00
|
|
|
# #20078 - users shouldn't be allowed to guess password hashes via
|
|
|
|
# repeated password__startswith queries.
|
|
|
|
def test_changelist_disallows_password_lookups(self):
|
2013-03-27 16:23:59 +00:00
|
|
|
# A lookup that tries to filter on password isn't OK
|
2018-04-28 13:20:27 +00:00
|
|
|
with self.assertLogs('django.security.DisallowedModelAdminLookup', 'ERROR'):
|
2015-02-09 16:28:03 +00:00
|
|
|
response = self.client.get(reverse('auth_test_admin:auth_user_changelist') + '?password__startswith=sha1$')
|
2018-04-28 13:20:27 +00:00
|
|
|
self.assertEqual(response.status_code, 400)
|
2012-10-24 15:11:41 +00:00
|
|
|
|
|
|
|
def test_user_change_email(self):
|
|
|
|
data = self.get_user_data(self.admin)
|
|
|
|
data['email'] = 'new_' + data['email']
|
2015-02-09 16:28:03 +00:00
|
|
|
response = self.client.post(
|
|
|
|
reverse('auth_test_admin:auth_user_change', args=(self.admin.pk,)),
|
|
|
|
data
|
|
|
|
)
|
|
|
|
self.assertRedirects(response, reverse('auth_test_admin:auth_user_changelist'))
|
2012-10-24 15:11:41 +00:00
|
|
|
row = LogEntry.objects.latest('id')
|
2019-06-14 16:20:29 +00:00
|
|
|
self.assertEqual(row.get_change_message(), 'Changed Email address.')
|
2012-10-24 15:11:41 +00:00
|
|
|
|
|
|
|
def test_user_not_change(self):
|
2015-02-09 16:28:03 +00:00
|
|
|
response = self.client.post(
|
|
|
|
reverse('auth_test_admin:auth_user_change', args=(self.admin.pk,)),
|
2012-10-24 15:11:41 +00:00
|
|
|
self.get_user_data(self.admin)
|
|
|
|
)
|
2015-02-09 16:28:03 +00:00
|
|
|
self.assertRedirects(response, reverse('auth_test_admin:auth_user_changelist'))
|
2012-10-24 15:11:41 +00:00
|
|
|
row = LogEntry.objects.latest('id')
|
2015-12-26 18:51:22 +00:00
|
|
|
self.assertEqual(row.get_change_message(), 'No fields changed.')
|
2012-10-24 15:11:41 +00:00
|
|
|
|
|
|
|
def test_user_change_password(self):
|
2015-03-27 19:07:35 +00:00
|
|
|
user_change_url = reverse('auth_test_admin:auth_user_change', args=(self.admin.pk,))
|
|
|
|
password_change_url = reverse('auth_test_admin:auth_user_password_change', args=(self.admin.pk,))
|
|
|
|
|
|
|
|
response = self.client.get(user_change_url)
|
|
|
|
# Test the link inside password field help_text.
|
|
|
|
rel_link = re.search(
|
|
|
|
r'you can change the password using <a href="([^"]*)">this form</a>',
|
2018-02-07 19:20:04 +00:00
|
|
|
response.content.decode()
|
2015-03-27 19:07:35 +00:00
|
|
|
).groups()[0]
|
|
|
|
self.assertEqual(
|
|
|
|
os.path.normpath(user_change_url + rel_link),
|
|
|
|
os.path.normpath(password_change_url)
|
|
|
|
)
|
|
|
|
|
2015-02-09 16:28:03 +00:00
|
|
|
response = self.client.post(
|
2015-03-27 19:07:35 +00:00
|
|
|
password_change_url,
|
2015-02-09 16:28:03 +00:00
|
|
|
{
|
|
|
|
'password1': 'password1',
|
|
|
|
'password2': 'password1',
|
|
|
|
}
|
|
|
|
)
|
2015-03-27 19:07:35 +00:00
|
|
|
self.assertRedirects(response, user_change_url)
|
2012-10-24 15:11:41 +00:00
|
|
|
row = LogEntry.objects.latest('id')
|
2015-12-26 18:51:22 +00:00
|
|
|
self.assertEqual(row.get_change_message(), 'Changed password.')
|
2012-10-24 15:11:41 +00:00
|
|
|
self.logout()
|
|
|
|
self.login(password='password1')
|
2014-04-25 12:20:25 +00:00
|
|
|
|
|
|
|
def test_user_change_different_user_password(self):
|
|
|
|
u = User.objects.get(email='staffmember@example.com')
|
2015-02-09 16:28:03 +00:00
|
|
|
response = self.client.post(
|
|
|
|
reverse('auth_test_admin:auth_user_password_change', args=(u.pk,)),
|
|
|
|
{
|
|
|
|
'password1': 'password1',
|
|
|
|
'password2': 'password1',
|
|
|
|
}
|
|
|
|
)
|
|
|
|
self.assertRedirects(response, reverse('auth_test_admin:auth_user_change', args=(u.pk,)))
|
2014-04-25 12:20:25 +00:00
|
|
|
row = LogEntry.objects.latest('id')
|
|
|
|
self.assertEqual(row.user_id, self.admin.pk)
|
|
|
|
self.assertEqual(row.object_id, str(u.pk))
|
2015-12-26 18:51:22 +00:00
|
|
|
self.assertEqual(row.get_change_message(), 'Changed password.')
|
2015-02-12 17:14:19 +00:00
|
|
|
|
|
|
|
def test_password_change_bad_url(self):
|
|
|
|
response = self.client.get(reverse('auth_test_admin:auth_user_password_change', args=('foobar',)))
|
|
|
|
self.assertEqual(response.status_code, 404)
|
|
|
|
|
2018-08-17 21:43:00 +00:00
|
|
|
@mock.patch('django.contrib.auth.admin.UserAdmin.has_change_permission')
|
|
|
|
def test_user_change_password_passes_user_to_has_change_permission(self, has_change_permission):
|
|
|
|
url = reverse('auth_test_admin:auth_user_password_change', args=(self.admin.pk,))
|
|
|
|
self.client.post(url, {'password1': 'password1', 'password2': 'password1'})
|
|
|
|
(_request, user), _kwargs = has_change_permission.call_args
|
|
|
|
self.assertEqual(user.pk, self.admin.pk)
|
|
|
|
|
2018-09-13 13:08:41 +00:00
|
|
|
def test_view_user_password_is_readonly(self):
|
|
|
|
u = User.objects.get(username='testclient')
|
|
|
|
u.is_superuser = False
|
|
|
|
u.save()
|
2018-09-27 23:52:01 +00:00
|
|
|
original_password = u.password
|
2018-09-13 13:08:41 +00:00
|
|
|
u.user_permissions.add(get_perm(User, 'view_user'))
|
|
|
|
response = self.client.get(reverse('auth_test_admin:auth_user_change', args=(u.pk,)),)
|
|
|
|
algo, salt, hash_string = (u.password.split('$'))
|
|
|
|
self.assertContains(response, '<div class="readonly">testclient</div>')
|
|
|
|
# ReadOnlyPasswordHashWidget is used to render the field.
|
|
|
|
self.assertContains(
|
|
|
|
response,
|
|
|
|
'<strong>algorithm</strong>: %s\n\n'
|
|
|
|
'<strong>salt</strong>: %s**********\n\n'
|
|
|
|
'<strong>hash</strong>: %s**************************\n\n' % (
|
|
|
|
algo, salt[:2], hash_string[:6],
|
|
|
|
),
|
|
|
|
html=True,
|
|
|
|
)
|
2018-09-27 23:52:01 +00:00
|
|
|
# Value in POST data is ignored.
|
|
|
|
data = self.get_user_data(u)
|
|
|
|
data['password'] = 'shouldnotchange'
|
|
|
|
change_url = reverse('auth_test_admin:auth_user_change', args=(u.pk,))
|
|
|
|
response = self.client.post(change_url, data)
|
2019-11-14 14:03:26 +00:00
|
|
|
self.assertEqual(response.status_code, 403)
|
2018-09-27 23:52:01 +00:00
|
|
|
u.refresh_from_db()
|
|
|
|
self.assertEqual(u.password, original_password)
|
2018-09-13 13:08:41 +00:00
|
|
|
|
2015-02-12 17:14:19 +00:00
|
|
|
|
|
|
|
@override_settings(
|
2015-10-26 22:38:30 +00:00
|
|
|
AUTH_USER_MODEL='auth_tests.UUIDUser',
|
2015-02-12 17:14:19 +00:00
|
|
|
ROOT_URLCONF='auth_tests.urls_custom_user_admin',
|
|
|
|
)
|
|
|
|
class UUIDUserTests(TestCase):
|
|
|
|
|
|
|
|
def test_admin_password_change(self):
|
|
|
|
u = UUIDUser.objects.create_superuser(username='uuid', email='foo@bar.com', password='test')
|
|
|
|
self.assertTrue(self.client.login(username='uuid', password='test'))
|
|
|
|
|
2015-10-26 22:38:30 +00:00
|
|
|
user_change_url = reverse('custom_user_admin:auth_tests_uuiduser_change', args=(u.pk,))
|
2015-02-12 17:14:19 +00:00
|
|
|
response = self.client.get(user_change_url)
|
|
|
|
self.assertEqual(response.status_code, 200)
|
|
|
|
|
|
|
|
password_change_url = reverse('custom_user_admin:auth_user_password_change', args=(u.pk,))
|
|
|
|
response = self.client.get(password_change_url)
|
|
|
|
self.assertEqual(response.status_code, 200)
|
|
|
|
|
|
|
|
# A LogEntry is created with pk=1 which breaks a FK constraint on MySQL
|
|
|
|
with connection.constraint_checks_disabled():
|
|
|
|
response = self.client.post(password_change_url, {
|
|
|
|
'password1': 'password1',
|
|
|
|
'password2': 'password1',
|
|
|
|
})
|
|
|
|
self.assertRedirects(response, user_change_url)
|
|
|
|
row = LogEntry.objects.latest('id')
|
2015-12-02 23:55:50 +00:00
|
|
|
self.assertEqual(row.user_id, 1) # hardcoded in CustomUserAdmin.log_change()
|
2015-02-12 17:14:19 +00:00
|
|
|
self.assertEqual(row.object_id, str(u.pk))
|
2015-12-26 18:51:22 +00:00
|
|
|
self.assertEqual(row.get_change_message(), 'Changed password.')
|
2016-02-13 00:41:31 +00:00
|
|
|
|
|
|
|
# The LogEntry.user column isn't altered to a UUID type so it's set to
|
|
|
|
# an integer manually in CustomUserAdmin to avoid an error. To avoid a
|
|
|
|
# constraint error, delete the entry before constraints are checked
|
|
|
|
# after the test.
|
|
|
|
row.delete()
|