innov
/
django1
1
0
Fork 0
Code Issues Pull Requests 1 Projects Releases Wiki Activity
9,969 Commits 25 Branches 361 Tags 501 MiB
Commit Graph

63 Commits

Author SHA1 Message Date
Russell Keith-Magee afd040d4d3 Updated test assertions that have been deprecated by the move to unittest2. In summary, this means: 
assert_ -> assertTrue
 assertEquals -> assertEqual
 failUnless -> assertTrue

For full details, see http://www.voidspace.org.uk/python/articles/unittest2.shtml#deprecations

git-svn-id: http://code.djangoproject.com/svn/django/trunk@15728 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2011-03-03 15:04:39 +00:00
Jannis Leidel 751888ece3 Fixed #11223 -- Fixed logout view to use the 'next' GET parameter correctly as described in the docs, while only allowing redirection to the same host. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@15706 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2011-03-02 12:47:44 +00:00
Jannis Leidel ec193224d3 Fixed #12534 -- Loosened the the security check for "next" redirects after logins slightly to allow paths that contain spaces. Thanks for the patch, jnns and aaugustin. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@15702 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2011-03-01 22:49:18 +00:00
Russell Keith-Magee b9a20d1e3b Fixed #15371 -- Ensure that a superuser created with the createsuperuser management command with --noinput has an invalid password, not a blank password. Thanks to yishaibeeri for the report and patch. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@15631 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2011-02-22 11:33:04 +00:00
Russell Keith-Magee 7a60b41130 Fixed #15111 -- Ensured that the auth, contenttypes and sitemaps tests will run when the sites app isn't installed. Thanks to Waldemar Kornewald for the report and draft patch. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@15418 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2011-02-05 03:49:03 +00:00
Russell Keith-Magee d053624aa8 Fixed #15067 -- Modified the range checks on base36_to_int so you are guaranteed to always get an int, avoiding possible OverflowErrors. Thanks to Garthex for the report, jboutros for the patch, and kfrazier for the feedback. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@15288 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2011-01-24 08:02:40 +00:00
Russell Keith-Magee 8781ea6cd7 Fixed #14975, #14925 -- Added some cache flushing to avoid some cross-test effects. Thanks to jsdalton and rpbarlow for the reports. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@15192 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2011-01-13 16:22:03 +00:00
Alex Gaynor 6819be1ea1 Fix a security issue in the auth system. Disclosure and new release forthcoming. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@15032 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2010-12-23 03:45:08 +00:00
Jannis Leidel 745c255a19 Fixed #14249 -- Added support for inactive users to the auth backend system. Thanks, Harro van der Klauw. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@15010 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2010-12-21 19:18:12 +00:00
Russell Keith-Magee 059d9205d4 Fixed #14920 -- Fixed some test failures caused by caching contenttypes that were loaded during a contenttype fixture test. Thanks to Karen for the report. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14985 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2010-12-19 13:01:51 +00:00
Jannis Leidel 674c671cae Fixed #14731 -- Respect ordering when creating the default permissions. Thanks, chipx86. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14891 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2010-12-12 22:59:28 +00:00
Russell Keith-Magee 5b8ef18dcc Fixed #14795 -- Ensure that get_all_permissions() returns the right result (i.e., all permissions) for superusers. Thanks to jay.halleaux@gmail.com for the report, and Brett Haydon for the patch. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14797 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2010-12-04 05:59:56 +00:00
Russell Keith-Magee 34a386378f Fixed #13190 -- Improved error handling for the case where no authentication backends are defined. Thanks to Joel3000 for the report, and Łukasz Rekucki for the final patch. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14793 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2010-12-04 04:47:59 +00:00
Chris Beaven dceaa82dec Fixed #14809 -- broken login related tests after r14733. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14764 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2010-12-01 22:25:17 +00:00
Chris Beaven e74edb4d53 Fixes #11025 -- ability to specify LOGIN_URL as full qualified absolute URL. 
auth.views.login now allows for login redirections for different schemes
with the same host (or no host even, e.g. 'https:///login/')

auth.decorators.login_required can now use lazy urls (refs #5925)

git-svn-id: http://code.djangoproject.com/svn/django/trunk@14733 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2010-11-27 22:43:33 +00:00
Jannis Leidel 132afbf8ee Fixed #5612 -- Added login and logout signals to contrib auth app. Thanks SmileyChris and pterk. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14710 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2010-11-26 13:33:27 +00:00
Luke Plant 02fc6276d7 Fixed #14508 - test suite silences warnings. 
Utility functions get_warnings_state and save_warnings_state have been added
to django.test.utils, and methods to django.test.TestCase for convenience.

The implementation is based on the catch_warnings context manager from
Python 2.6.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@14526 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2010-11-11 15:06:20 +00:00
Luke Plant 6feef0c13e Fixed #14612 - Password reset page leaks valid user ids publicly. 
Thanks to PaulM for the report.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@14456 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2010-11-04 12:36:55 +00:00
Luke Plant 7d4a3991f3 Fixed a test setup and isolation bug that was causing PasswordResetTest to fail when run individually 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14455 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2010-11-04 12:31:57 +00:00
Alex Gaynor 15b3350d30 Fixed the auth tests so they work when the AUTHENTICATION_BACKENDS setting is a list. Thanks to Patrick Altman for the report. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14406 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2010-10-31 16:25:29 +00:00
Luke Plant 45c7f427ce Fixed #14445 - Use HMAC and constant-time comparison functions where needed. 
All adhoc MAC applications have been updated to use HMAC, using SHA1 to
generate unique keys for each application based on the SECRET_KEY, which is
common practice for this situation. In all cases, backwards compatibility
with existing hashes has been maintained, aiming to phase this out as per
the normal deprecation process. In this way, under most normal
circumstances the old hashes will have expired (e.g. by session expiration
etc.) before they become invalid.

In the case of the messages framework and the cookie backend, which was
already using HMAC, there is the possibility of a backwards incompatibility
if the SECRET_KEY is shorter than the default 50 bytes, but the low
likelihood and low impact meant compatibility code was not worth it.

All known instances where tokens/hashes were compared using simple string
equality, which could potentially open timing based attacks, have also been
fixed using a constant-time comparison function.

There are no known practical attacks against the existing implementations,
so these security improvements will not be backported.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@14218 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2010-10-14 20:54:30 +00:00
Russell Keith-Magee 03f00bcd42 Fixed #14447 -- Modified the auth and sitemaps tests to remove some assumptions about the environment in which the tests are run. Thanks to Gabriel Hurley for the report and patch. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14184 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2010-10-12 07:15:47 +00:00
Russell Keith-Magee 1070c57b83 Fixed #14436 -- Escalated 1.2 PendingDeprecationWarnings to DeprecationWarnings, and removed 1.1 deprecated code. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14138 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2010-10-11 12:20:07 +00:00
Luke Plant f3429da6a0 Converted contrib/auth/tokens doctests to unittests. We've always said "no more" to doctests. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14100 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2010-10-10 01:06:42 +00:00
Russell Keith-Magee 8755fb1549 Fixed #14354 -- Normalized the handling of empty/null passwords in contrib.auth. This also updates the createsuperuser command to be more testable, and migrates some auth doctests. Thanks to berryp for the report, and Laurent Luce for the patch. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14053 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2010-10-09 03:34:08 +00:00
Russell Keith-Magee f53491db6e #14374 -- Added some missing template files to ensure that contrib.auth tests will pass when admin isn't installed. Thanks to henriquebastos for the report and patch. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14003 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2010-10-08 13:50:54 +00:00
Luke Plant 667d832e90 Fixed #14386, #8960, #10235, #10909, #10608, #13845, #14377 - standardize Site/RequestSite usage in various places. 
Many thanks to gabrielhurley for putting most of this together.  Also to
bmihelac, arthurk, qingfeng, hvendelbo, petr.pulc@s-cape.cz, Hraban for
reports and some initial patches.

The patch also contains some whitespace/PEP8 fixes.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@13980 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2010-10-04 14:20:47 +00:00
Malcolm Tredinnick 4084bc7354 Permit custom from-email address in auth forms email. 
Patch from cassidy and Rob Hudson. Fixed #11300.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@13817 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2010-09-12 22:38:01 +00:00
Jannis Leidel bb00b28399 Added login_url argument to login_required decorator. Thanks mhlakhani and ericflo for the report and patch. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13723 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2010-09-10 19:38:57 +00:00
Luke Plant 303bdc85a7 Fixed #14242 - UserChangeForm subclasses without 'user_permissions' field causes KeyError 
This was a regression introduced by [13683]

Thanks to adammckerlie@gmail.com for report.



git-svn-id: http://code.djangoproject.com/svn/django/trunk@13702 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2010-09-09 23:31:54 +00:00
Luke Plant 801bb146e8 Converted tests for contrib.auth.forms to unit tests. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13701 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2010-09-09 23:21:16 +00:00
Jannis Leidel 286ce85e45 Fixed #13569 -- Fixed createsuperuser management command to work with the new relaxed requirements for usernames. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13297 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2010-05-21 14:08:49 +00:00
Russell Keith-Magee 056c940f0d Fixed #13304 -- Updated auth decorators so they can be used with callable classes. Thanks to Horst Gutmann for the report and patch. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@12938 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2010-04-09 11:07:17 +00:00
Russell Keith-Magee 4dfe6190fa Fixed #13108 -- Corrected an ambiguity in test data with the potential to cause test failures out of the box. Thanks to benreynwar for the report. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@12778 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2010-03-15 06:55:56 +00:00
Jacob Kaplan-Moss 973bf6f485 Fixed #5605: only lowercase the domain portion of an email address in `UserManager.create_user`. 
Thanks, Leo.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@12641 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2010-03-01 20:30:44 +00:00
Jacob Kaplan-Moss 6e748b5db4 Fixed #11457: tightened the security check for "next" redirects after logins. 
The new behavior still disallows redirects to off-site URLs, but now allows
redirects of the form `/some/other/view?foo=http://...`.

Thanks to brutasse.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@12635 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2010-03-01 19:58:53 +00:00
Jacob Kaplan-Moss c8015052d9 Fixed #5786: relaxed the validation for usernames to allow more common characters '@', etc. 
This is really just a stop-gap until we come up with a improved way of handling
disparate auth data, but it should help us stretch a bit more milage out of the
current system.

Thanks to alextreme, lbruno, and clayg.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@12634 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2010-03-01 19:49:05 +00:00
Justin Bronn 1d5165e3be Fixed #12776 -- `User.get_profile` now raises `SiteProfileNotAvailable` instead of `AttributeError` in certain circumstances. Thanks, Bruno Renié. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@12506 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2010-02-23 05:52:37 +00:00
Russell Keith-Magee b794441951 Fixed #10976 -- Isolated contrib.auth tests so they will always pass, regardless of any local templates. Thanks to aarond10 for the report, and SmileyChris for turning that into a patch. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@12420 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2010-02-13 12:02:11 +00:00
Luke Plant 8daec78cfd Fixed #12557 - AnonymousUser should check auth backends for permissions 
Thanks to hvdklauw for the idea and work on the patch.



git-svn-id: http://code.djangoproject.com/svn/django/trunk@12316 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2010-01-28 01:47:23 +00:00
Adrian Holovaty 19b72077f7 Fixed #8049 -- Fixed inconsistency in admin site is_active checks. Thanks for patch and tests, isagalaev 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@12159 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2010-01-10 16:51:13 +00:00
Jannis Leidel 57d7181caa Fixed #12462 - Fixed edge case with auth backends that don't support object permissions. Thanks to Florian Apolloner for catching it. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@12032 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2009-12-30 22:12:57 +00:00
Jannis Leidel 9bf652dfd6 Fixed #11010 - Add a foundation for object permissions to authentication backends. Thanks to Florian Apolloner for writing the initial patch. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11807 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2009-12-10 01:05:35 +00:00
Luke Plant c161bf21f0 Fixed #6552, #12031 - Make django.core.context_processors.auth lazy to avoid "Vary: Cookie" 
Thanks to olau@iola.dk, Suor for the report



git-svn-id: http://code.djangoproject.com/svn/django/trunk@11623 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2009-10-14 18:09:13 +00:00
Luke Plant 4a5630fe75 Removed unnecessary keys in django.contrib.auth.test.__test__ 
Only doctest tests, and not TestCases, need to be in __test__ AFAICS.



git-svn-id: http://code.djangoproject.com/svn/django/trunk@11481 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2009-09-10 09:51:27 +00:00
Russell Keith-Magee e91deca779 Fixed #10521 -- Modified the Remote User tests so that it isn't dependent on particular deployed URLs. Thanks to Kegan and Ramiro Morales for their contributions. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10674 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2009-05-04 07:05:44 +00:00
Malcolm Tredinnick 5a57a7f006 Fixed #8752 -- Fixed django.contrib.auth tests to be locale-independent. 
Patch from Koen Biermans.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@10599 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2009-04-19 03:41:33 +00:00
Jacob Kaplan-Moss 9faa1cd9b5 Fixed #10747: fixed the auth tests to ignore broken user-supplied login/logout templates. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10482 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2009-04-10 15:50:51 +00:00
Jacob Kaplan-Moss 6d5492630d Fixed a sloppy test auth test. [10400] revealed that the auth test was relying on the weird difference between calling a management from the shell and from `call_command`. That this worked in the first case was pretty much an accident. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10404 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2009-04-05 19:00:27 +00:00
Jacob Kaplan-Moss 2a994716a1 Fixed #10265: fixed a bug when generating a password reset token for a user created on the same request. Thanks, crucialfelix. 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10341 bcc190cf-cafb-0310-a4f2-bffc1f526a37
 2009-04-01 21:25:24 +00:00