Commit Graph

15 Commits

Author SHA1 Message Date
Jannis Leidel ff63a5bdec Fixed #14632 -- Skip a messages test if auth app is not in INSTALLED_APPS. Thanks, gregmuellegger.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14557 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-11-13 18:43:13 +00:00
Luke Plant 02fc6276d7 Fixed #14508 - test suite silences warnings.
Utility functions get_warnings_state and save_warnings_state have been added
to django.test.utils, and methods to django.test.TestCase for convenience.

The implementation is based on the catch_warnings context manager from
Python 2.6.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@14526 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-11-11 15:06:20 +00:00
Luke Plant 45c7f427ce Fixed #14445 - Use HMAC and constant-time comparison functions where needed.
All adhoc MAC applications have been updated to use HMAC, using SHA1 to
generate unique keys for each application based on the SECRET_KEY, which is
common practice for this situation. In all cases, backwards compatibility
with existing hashes has been maintained, aiming to phase this out as per
the normal deprecation process. In this way, under most normal
circumstances the old hashes will have expired (e.g. by session expiration
etc.) before they become invalid.

In the case of the messages framework and the cookie backend, which was
already using HMAC, there is the possibility of a backwards incompatibility
if the SECRET_KEY is shorter than the default 50 bytes, but the low
likelihood and low impact meant compatibility code was not worth it.

All known instances where tokens/hashes were compared using simple string
equality, which could potentially open timing based attacks, have also been
fixed using a constant-time comparison function.

There are no known practical attacks against the existing implementations,
so these security improvements will not be backported.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@14218 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-10-14 20:54:30 +00:00
Russell Keith-Magee 121d2e3678 Fixed #12991 -- Added unittest2 support. Thanks to PaulM for the draft patch, and to Luke, Karen, Justin, Alex, Łukasz Rekucki, and Chuck Harmston for their help testing and reviewing the final patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14139 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-10-11 12:55:17 +00:00
Russell Keith-Magee 1070c57b83 Fixed #14436 -- Escalated 1.2 PendingDeprecationWarnings to DeprecationWarnings, and removed 1.1 deprecated code.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14138 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-10-11 12:20:07 +00:00
Russell Keith-Magee 5211f48ae3 Fixed #12164 -- Removed the Python 2.3 compatibility imports and workarounds. Thanks to timo and claudep for the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13094 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-05-04 14:00:30 +00:00
Karen Tracey 8661cb9bd3 Fixed #13170: Make get_level and set_level importable from django.contrib.messages,
as documented. Thanks dm, SmileyChris, tobias.


git-svn-id: http://code.djangoproject.com/svn/django/trunk@12826 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-03-21 13:47:50 +00:00
Luke Plant 65c1dfe67b Small optimization on r12285
git-svn-id: http://code.djangoproject.com/svn/django/trunk@12292 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-01-25 18:14:30 +00:00
Luke Plant e6c5599494 Reduced CookieStorage.max_cookie_size to 75% of 4K to be nice to Internet Explorer
Internet Explorer, up to at least version 7, allows only 4K cookie data *per
domain*, rather than per cookie, so we ensure that stored messages leave
some room for other cookies.




git-svn-id: http://code.djangoproject.com/svn/django/trunk@12287 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-01-24 00:04:02 +00:00
Luke Plant 63d072581c Made CookieStorage account for the overhead added by the underlying cookie encoding
git-svn-id: http://code.djangoproject.com/svn/django/trunk@12285 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-01-23 23:56:04 +00:00
Luke Plant 09b585e4bb Fixed #12588 - test failure since r12207
git-svn-id: http://code.djangoproject.com/svn/django/trunk@12215 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-01-12 22:03:00 +00:00
Luke Plant c56beed240 Fixed #12575 - created a better interface for getting/setting the effective level of contrib.messages
Thanks Chris Beaven.



git-svn-id: http://code.djangoproject.com/svn/django/trunk@12207 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-01-12 02:41:57 +00:00
Karen Tracey cafb12464b Fixed #12368: Fixed order-dependent messages test that was failing on MySQL/MyISAM. Thanks Tobias.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11847 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-12-13 17:20:36 +00:00
Russell Keith-Magee 7cb8892fdb Fixed #12362 -- Corrected Python 2.4 incompatibility with hmac constructor in contrib.messages. Thanks to Jeremy Dunck for the report and patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11814 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-12-12 05:25:50 +00:00
Luke Plant 25020ddb05 Fixed #4604 - Configurable message passing system, supporting anonymous users
This deprecates User.message_set in favour of a configurable messaging
system, with backends provided for cookie storage, session storage and
backward compatibility.

Many thanks to Tobias McNulty for the bulk of the work here, with
contributions from Chris Beaven (SmileyChris) and lots of code review from
Russell Keith-Magee, and input from many others.  Also credit to the authors
of various messaging systems for Django whose ideas may have been pinched
:-)



git-svn-id: http://code.djangoproject.com/svn/django/trunk@11804 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-12-09 16:57:23 +00:00