pagure/tests/test_pagure_flask_ui_login.py

593 lines
23 KiB
Python

# -*- coding: utf-8 -*-
"""
(c) 2016 - Copyright Red Hat Inc
Authors:
Pierre-Yves Chibon <pingou@pingoured.fr>
Farhaan Bukhsh <farhaan.bukhsh@gmail.com>
"""
__requires__ = ['SQLAlchemy >= 0.8']
import pkg_resources
import datetime
import hashlib
import json
import unittest
import shutil
import sys
import tempfile
import os
import pygit2
from mock import patch
sys.path.insert(0, os.path.join(os.path.dirname(
os.path.abspath(__file__)), '..'))
import pagure.lib
import tests
from pagure.lib.repo import PagureRepo
import pagure.ui.login
class PagureFlaskLogintests(tests.Modeltests):
""" Tests for flask app controller of pagure """
def setUp(self):
""" Set up the environnment, ran before every tests. """
super(PagureFlaskLogintests, self).setUp()
pagure.APP.config['TESTING'] = True
pagure.APP.config['EMAIL_SEND'] = False
pagure.APP.config['PAGURE_AUTH'] = 'local'
pagure.SESSION = self.session
pagure.ui.SESSION = self.session
pagure.ui.app.SESSION = self.session
pagure.ui.login.SESSION = self.session
pagure.ui.filters.SESSION = self.session
self.app = pagure.APP.test_client()
def test_new_user(self):
""" Test the new_user endpoint. """
# Check before:
items = pagure.lib.search_user(self.session)
self.assertEqual(2, len(items))
# First access the new user page
output = self.app.get('/user/new')
self.assertEqual(output.status_code, 200)
self.assertIn('<title>New user - Pagure</title>', output.data)
self.assertIn(
'<form action="/user/new" method="post">', output.data)
# Create the form to send there
# This has all the data needed
data = {
'user': 'foo',
'fullname': 'user foo',
'email_address': 'foo@bar.com',
'password': 'barpass',
'confirm_password': 'barpass',
}
# Submit this form - Doesn't work since there is no csrf token
output = self.app.post('/user/new', data=data)
self.assertEqual(output.status_code, 200)
self.assertIn('<title>New user - Pagure</title>', output.data)
self.assertIn(
'<form action="/user/new" method="post">', output.data)
csrf_token = output.data.split(
'name="csrf_token" type="hidden" value="')[1].split('">')[0]
# Submit the form with the csrf token
data['csrf_token'] = csrf_token
output = self.app.post('/user/new', data=data, follow_redirects=True)
self.assertEqual(output.status_code, 200)
self.assertIn('<title>New user - Pagure</title>', output.data)
self.assertIn(
'<form action="/user/new" method="post">', output.data)
self.assertIn('Username already taken.', output.data)
# Submit the form with another username
data['user'] = 'foouser'
output = self.app.post('/user/new', data=data, follow_redirects=True)
self.assertEqual(output.status_code, 200)
self.assertIn('<title>New user - Pagure</title>', output.data)
self.assertIn('Email address already taken.', output.data)
# Submit the form with proper data
data['email_address'] = 'foo@example.com'
output = self.app.post('/user/new', data=data, follow_redirects=True)
self.assertEqual(output.status_code, 200)
self.assertIn('<title>Login - Pagure</title>', output.data)
self.assertIn(
'User created, please check your email to activate the account',
output.data)
# Check after:
items = pagure.lib.search_user(self.session)
self.assertEqual(3, len(items))
def test_do_login(self):
""" Test the do_login endpoint. """
output = self.app.get('/login/')
self.assertEqual(output.status_code, 200)
self.assertIn('<title>Login - Pagure</title>', output.data)
self.assertIn(
'<form action="/dologin" method="post">', output.data)
# This has all the data needed
data = {
'username': 'foouser',
'password': 'barpass',
}
# Submit this form - Doesn't work since there is no csrf token
output = self.app.post('/dologin', data=data, follow_redirects=True)
self.assertEqual(output.status_code, 200)
self.assertIn('<title>Login - Pagure</title>', output.data)
self.assertIn(
'<form action="/dologin" method="post">', output.data)
self.assertIn('Insufficient information provided', output.data)
csrf_token = output.data.split(
'name="csrf_token" type="hidden" value="')[1].split('">')[0]
# Submit the form with the csrf token - but invalid user
data['csrf_token'] = csrf_token
output = self.app.post('/dologin', data=data, follow_redirects=True)
self.assertEqual(output.status_code, 200)
self.assertIn('<title>Login - Pagure</title>', output.data)
self.assertIn(
'<form action="/dologin" method="post">', output.data)
self.assertIn('Username or password invalid.', output.data)
# Create a local user
self.test_new_user()
items = pagure.lib.search_user(self.session)
self.assertEqual(3, len(items))
# Submit the form with the csrf token - but user not confirmed
data['csrf_token'] = csrf_token
output = self.app.post('/dologin', data=data, follow_redirects=True)
self.assertEqual(output.status_code, 200)
self.assertIn('<title>Login - Pagure</title>', output.data)
self.assertIn(
'<form action="/dologin" method="post">', output.data)
self.assertIn(
'Invalid user, did you confirm the creation with the url '
'provided by email?', output.data)
# User in the DB, csrf provided - but wrong password submitted
data['password'] = 'password'
output = self.app.post('/dologin', data=data, follow_redirects=True)
self.assertEqual(output.status_code, 200)
self.assertIn('<title>Login - Pagure</title>', output.data)
self.assertIn(
'<form action="/dologin" method="post">', output.data)
self.assertIn('Username or password invalid.', output.data)
# When account is not confirmed i.e user_obj != None
data['password'] = 'barpass'
output = self.app.post('/dologin', data=data, follow_redirects=True)
self.assertEqual(output.status_code, 200)
self.assertIn('<title>Login - Pagure</title>', output.data)
self.assertIn(
'<form action="/dologin" method="post">', output.data)
self.assertIn(
'Invalid user, did you confirm the creation with the url '
'provided by email?', output.data)
# Wrong password submitted
data['password'] = 'password'
output = self.app.post('/dologin', data=data, follow_redirects=True)
self.assertEqual(output.status_code, 200)
self.assertIn('<title>Login - Pagure</title>', output.data)
self.assertIn(
'<form action="/dologin" method="post">', output.data)
self.assertIn('Username or password invalid.', output.data)
# When account is not confirmed i.e user_obj != None
data['password'] = 'barpass'
output = self.app.post('/dologin', data=data, follow_redirects=True)
self.assertEqual(output.status_code, 200)
self.assertIn('<title>Login - Pagure</title>', output.data)
self.assertIn(
'<form action="/dologin" method="post">', output.data)
self.assertIn(
'Invalid user, did you confirm the creation with the url '
'provided by email?', output.data)
# Confirm the user so that we can log in
item = pagure.lib.search_user(self.session, username='foouser')
self.assertEqual(item.user, 'foouser')
self.assertNotEqual(item.token, None)
# Remove the token
item.token = None
self.session.add(item)
self.session.commit
# Check the user
item = pagure.lib.search_user(self.session, username='foouser')
self.assertEqual(item.user, 'foouser')
self.assertEqual(item.token, None)
# Login but cannot save the session to the DB due to the missing IP
# address in the flask request
data['password'] = 'barpass'
output = self.app.post('/dologin', data=data, follow_redirects=True)
self.assertEqual(output.status_code, 200)
self.assertIn('<title>Home - Pagure</title>', output.data)
self.assertIn(
'<a class="nav-link" href="/login/?next=http://localhost/">',
output.data)
self.assertIn(
'Could not set the session in the db, please report this error '
'to an admin', output.data)
# Make the password invalid
item = pagure.lib.search_user(self.session, username='foouser')
self.assertEqual(item.user, 'foouser')
self.assertTrue(item.password.startswith('$2$'))
# Remove the $2$
item.password = item.password[3:]
self.session.add(item)
self.session.commit
# Check the password
item = pagure.lib.search_user(self.session, username='foouser')
self.assertEqual(item.user, 'foouser')
self.assertFalse(item.password.startswith('$2$'))
# Try login again
output = self.app.post('/dologin', data=data, follow_redirects=True)
self.assertEqual(output.status_code, 200)
self.assertIn('<title>Login - Pagure</title>', output.data)
self.assertIn(
'<form action="/dologin" method="post">', output.data)
self.assertIn('Username or password of invalid format.', output.data)
# Make the password be version 1
item = pagure.lib.search_user(self.session, username='foouser')
self.assertEqual(item.user, 'foouser')
self.assertTrue(item.password.startswith('$2$'))
# V1 password
password = '%s%s' % ('barpass', None)
password = hashlib.sha512(password).hexdigest()
item.token = None
item.password = '$1$%s' % password
self.session.add(item)
self.session.commit
# Check the password
item = pagure.lib.search_user(self.session, username='foouser')
self.assertEqual(item.user, 'foouser')
self.assertTrue(item.password.startswith('$1$'))
# Log in with a v1 password
output = self.app.post('/dologin', data=data, follow_redirects=True)
self.assertEqual(output.status_code, 200)
self.assertIn('<title>Home - Pagure</title>', output.data)
self.assertIn(
'<a class="nav-link" href="/login/?next=http://localhost/">',
output.data)
self.assertIn(
'Could not set the session in the db, please report this error '
'to an admin', output.data)
def test_confirm_user(self):
""" Test the confirm_user endpoint. """
output = self.app.get('/confirm/foo', follow_redirects=True)
self.assertEqual(output.status_code, 200)
self.assertIn('<title>Home - Pagure</title>', output.data)
self.assertIn(
'No user associated with this token.', output.data)
# Create a local user
self.test_new_user()
items = pagure.lib.search_user(self.session)
self.assertEqual(3, len(items))
item = pagure.lib.search_user(self.session, username='foouser')
self.assertEqual(item.user, 'foouser')
self.assertTrue(item.password.startswith('$2$'))
self.assertNotEqual(item.token, None)
output = self.app.get(
'/confirm/%s' % item.token, follow_redirects=True)
self.assertEqual(output.status_code, 200)
self.assertIn('<title>Login - Pagure</title>', output.data)
self.assertIn(
'Email confirmed, account activated', output.data)
def test_lost_password(self):
""" Test the lost_password endpoint. """
output = self.app.get('/password/lost')
self.assertEqual(output.status_code, 200)
self.assertIn('<title>Lost password - Pagure</title>', output.data)
self.assertIn(
'<form action="/password/lost" method="post">', output.data)
# Prepare the data to send
data = {
'username': 'foouser',
}
# Missing CSRF
output = self.app.post('/password/lost', data=data)
self.assertEqual(output.status_code, 200)
self.assertIn('<title>Lost password - Pagure</title>', output.data)
self.assertIn(
'<form action="/password/lost" method="post">', output.data)
csrf_token = output.data.split(
'name="csrf_token" type="hidden" value="')[1].split('">')[0]
# With the CSRF - But invalid user
data['csrf_token'] = csrf_token
output = self.app.post(
'/password/lost', data=data, follow_redirects=True)
self.assertEqual(output.status_code, 200)
self.assertIn('<title>Login - Pagure</title>', output.data)
self.assertIn('Username invalid.', output.data)
# With the CSRF and a valid user
data['username'] = 'foo'
output = self.app.post(
'/password/lost', data=data, follow_redirects=True)
self.assertEqual(output.status_code, 200)
self.assertIn('<title>Login - Pagure</title>', output.data)
self.assertIn(
'Check your email to finish changing your password', output.data)
# With the CSRF and a valid user - but too quick after the last one
data['username'] = 'foo'
output = self.app.post(
'/password/lost', data=data, follow_redirects=True)
self.assertEqual(output.status_code, 200)
self.assertIn('<title>Login - Pagure</title>', output.data)
self.assertIn(
'An email was sent to you less than 3 minutes ago, did you '
'check your spam folder? Otherwise, try again after some time.',
output.data)
def test_reset_password(self):
""" Test the reset_password endpoint. """
output = self.app.get('/password/reset/foo', follow_redirects=True)
self.assertEqual(output.status_code, 200)
self.assertIn('<title>Login - Pagure</title>', output.data)
self.assertIn('No user associated with this token.', output.data)
self.assertIn('<form action="/dologin" method="post">', output.data)
self.test_lost_password()
self.test_new_user()
# Check the password
item = pagure.lib.search_user(self.session, username='foouser')
self.assertEqual(item.user, 'foouser')
self.assertNotEqual(item.token, None)
self.assertTrue(item.password.startswith('$2$'))
old_password = item.password
token = item.token
output = self.app.get(
'/password/reset/%s' % token, follow_redirects=True)
self.assertEqual(output.status_code, 200)
self.assertIn('<title>Change password - Pagure</title>', output.data)
self.assertIn(
'<form action="/password/reset/', output.data)
data = {
'password': 'passwd',
'confirm_password': 'passwd',
}
# Missing CSRF
output = self.app.post(
'/password/reset/%s' % token, data=data, follow_redirects=True)
self.assertEqual(output.status_code, 200)
self.assertIn('<title>Change password - Pagure</title>', output.data)
self.assertIn(
'<form action="/password/reset/', output.data)
csrf_token = output.data.split(
'name="csrf_token" type="hidden" value="')[1].split('">')[0]
# With CSRF
data['csrf_token'] = csrf_token
output = self.app.post(
'/password/reset/%s' % token, data=data, follow_redirects=True)
self.assertEqual(output.status_code, 200)
self.assertIn('<title>Login - Pagure</title>', output.data)
self.assertIn('Password changed', output.data)
def test_change_password(self):
""" Test the change_password endpoint. """
# Not logged in, redirects
output = self.app.get('/password/change', follow_redirects=True)
self.assertEqual(output.status_code, 200)
self.assertIn('<title>Login - Pagure</title>', output.data)
self.assertIn('<form action="/dologin" method="post">', output.data)
user = tests.FakeUser()
with tests.user_set(pagure.APP, user):
output = self.app.get('/password/change')
self.assertEqual(output.status_code, 404)
self.assertIn('User not found', output.data)
user = tests.FakeUser(username='foo')
with tests.user_set(pagure.APP, user):
output = self.app.get('/password/change')
self.assertEqual(output.status_code, 200)
self.assertIn(
'<title>Change password - Pagure</title>', output.data)
self.assertIn(
'<form action="/password/change" method="post">', output.data)
data = {
'old_password': 'foo',
'password': 'foo',
'confirm_password': 'foo',
}
# No CSRF token
output = self.app.post('/password/change', data=data)
self.assertEqual(output.status_code, 200)
self.assertIn(
'<title>Change password - Pagure</title>', output.data)
self.assertIn(
'<form action="/password/change" method="post">', output.data)
csrf_token = output.data.split(
'name="csrf_token" type="hidden" value="')[1].split('">')[0]
# With CSRF - Invalid password format
data['csrf_token'] = csrf_token
output = self.app.post(
'/password/change', data=data, follow_redirects=True)
self.assertEqual(output.status_code, 200)
self.assertIn('<title>Home - Pagure</title>', output.data)
self.assertIn(
'Could not update your password, either user or password '
'could not be checked', output.data)
self.test_new_user()
# Remove token of foouser
item = pagure.lib.search_user(self.session, username='foouser')
self.assertEqual(item.user, 'foouser')
self.assertNotEqual(item.token, None)
self.assertTrue(item.password.startswith('$2$'))
item.token = None
self.session.add(item)
self.session.commit()
user = tests.FakeUser(username='foouser')
with tests.user_set(pagure.APP, user):
output = self.app.get('/password/change')
self.assertEqual(output.status_code, 200)
self.assertIn(
'<title>Change password - Pagure</title>', output.data)
self.assertIn(
'<form action="/password/change" method="post">', output.data)
data = {
'old_password': 'foo',
'password': 'foo',
'confirm_password': 'foo',
}
# No CSRF token
output = self.app.post('/password/change', data=data)
self.assertEqual(output.status_code, 200)
self.assertIn(
'<title>Change password - Pagure</title>', output.data)
self.assertIn(
'<form action="/password/change" method="post">', output.data)
csrf_token = output.data.split(
'name="csrf_token" type="hidden" value="')[1].split('">')[0]
# With CSRF - Incorrect password
data['csrf_token'] = csrf_token
output = self.app.post(
'/password/change', data=data, follow_redirects=True)
self.assertEqual(output.status_code, 200)
self.assertIn('<title>Home - Pagure</title>', output.data)
self.assertIn(
'Could not update your password, either user or password '
'could not be checked', output.data)
# With CSRF - Correct password
data['old_password'] = 'barpass'
output = self.app.post(
'/password/change', data=data, follow_redirects=True)
self.assertEqual(output.status_code, 200)
self.assertIn('<title>Home - Pagure</title>', output.data)
self.assertIn('Password changed', output.data)
def test_logout(self):
""" Test the auth_logout endpoint for local login. """
output = self.app.get('/logout/', follow_redirects=True)
self.assertEqual(output.status_code, 200)
self.assertIn('<title>Home - Pagure</title>', output.data)
self.assertNotIn('You have been logged out', output.data)
self.assertIn(
'<a class="nav-link" href="/login/?next=http://localhost/">',
output.data)
user = tests.FakeUser(username='foo')
with tests.user_set(pagure.APP, user):
output = self.app.get('/logout/', follow_redirects=True)
self.assertEqual(output.status_code, 200)
self.assertIn('<title>Home - Pagure</title>', output.data)
self.assertIn('You have been logged out', output.data)
# Due to the way the tests are running we do not actually
# log out
self.assertIn(
'<a href="/logout/?next=http://localhost/">log out</a>',
output.data)
def test_settings_admin_session_timedout(self):
""" Test the admin_session_timedout with settings endpoint. """
lifetime = pagure.APP.config.get('ADMIN_SESSION_LIFETIME',
datetime.timedelta(minutes=15))
td1 = datetime.timedelta(minutes=1)
# session already expired
user = tests.FakeUser(username='foo')
user.login_time = datetime.datetime.utcnow() - lifetime - td1
with tests.user_set(pagure.APP, user):
# not following the redirect because user_set contextmanager
# will run again for the login page and set back the user
# which results in a loop, since admin_session_timedout will
# redirect again for the login page
output = self.app.get('/settings/')
self.assertEqual(output.status_code, 302)
self.assertIn('http://localhost/login/', output.location)
# session did not expire
user.login_time = datetime.datetime.utcnow() - lifetime + td1
with tests.user_set(pagure.APP, user):
output = self.app.get('/settings/')
self.assertEqual(output.status_code, 200)
@patch('flask.flash')
@patch('flask.g')
def test_admin_session_timedout(self, g, flash):
""" Test the call to admin_session_timedout. """
lifetime = pagure.APP.config.get('ADMIN_SESSION_LIFETIME',
datetime.timedelta(minutes=15))
td1 = datetime.timedelta(minutes=1)
# session already expired
user = tests.FakeUser(username='foo')
user.login_time = datetime.datetime.utcnow() - lifetime - td1
g.fas_user = user
self.assertTrue(pagure.admin_session_timedout())
# session did not expire
user.login_time = datetime.datetime.utcnow() - lifetime + td1
g.fas_user = user
self.assertFalse(pagure.admin_session_timedout())
if __name__ == '__main__':
SUITE = unittest.TestLoader().loadTestsFromTestCase(PagureFlaskLogintests)
unittest.TextTestRunner(verbosity=2).run(SUITE)