1
0
mirror of https://github.com/django/django.git synced 2025-01-15 21:02:52 +00:00
django/tests/admin_views/test_forms.py
Tim Graham af33fb250e Fixed CVE-2018-6188 -- Fixed information leakage in AuthenticationForm.
Reverted 359370a8b8ca0efe99b1d4630b291ec060b69225 (refs #28645).

This is a security fix.
2018-02-01 09:05:14 -05:00

21 lines
819 B
Python

from django.contrib.admin.forms import AdminAuthenticationForm
from django.contrib.auth.models import User
from django.test import TestCase, override_settings
# To verify that the login form rejects inactive users, use an authentication
# backend that allows them.
@override_settings(AUTHENTICATION_BACKENDS=['django.contrib.auth.backends.AllowAllUsersModelBackend'])
class AdminAuthenticationFormTests(TestCase):
@classmethod
def setUpTestData(cls):
User.objects.create_user(username='inactive', password='password', is_active=False)
def test_inactive_user(self):
data = {
'username': 'inactive',
'password': 'password',
}
form = AdminAuthenticationForm(None, data)
self.assertEqual(form.non_field_errors(), ['This account is inactive.'])