Commit Graph

315 Commits

Author SHA1 Message Date
Anssi Kääriäinen 8fad77da95 Ensured tests pass using custom PASSWORD_HASHERS. 2012-04-30 22:10:27 +03:00
Claude Paroz be12c9e908 Fixed #18038 -- Removed the 'supports_inactive_user' backwards-compatibility flag. Thanks Aymeric Augustin for the initial patch and Ramiro Morales for the review.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17938 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-04-26 17:15:40 +00:00
Claude Paroz eb351ac9cb Fixed #18037 -- Changed behaviour of url and ssi template tags to the new syntax, as per official deprecation timeline. Thanks Ramiro Morales and Jannis Leidel for the review.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17934 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-04-24 19:55:52 +00:00
Claude Paroz 0e01023897 Converted more test assertions to assert[Not]Contains.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17910 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-04-14 13:35:25 +00:00
Claude Paroz 883c38c499 Fixed #17848 -- Added setting_changed signal for cases when TEMPLATE_CONTEXT_PROCESSORS is overriden in tests.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17885 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-04-09 13:24:57 +00:00
Aymeric Augustin 98e9d1c6ab Used the override_settings decorator in the tests of auth, flatpages, and formtools.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17851 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-03-31 16:03:09 +00:00
Aymeric Augustin eb163f37cb Use the class decorator syntax available in Python >= 2.6. Refs #17965.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17829 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-03-30 09:08:29 +00:00
Claude Paroz 9383a2761c Removed with_statement imports, useless in Python >= 2.6. Refs #17965. Thanks jonash for the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17828 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-03-30 08:02:08 +00:00
Claude Paroz 0fe9f3ce27 Make auth test pass even when LANGUAGE_CODE is not 'en'. Refs #17980. Thanks wassup for the report.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17811 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-03-26 20:22:02 +00:00
Aymeric Augustin a8d0fc1001 Fixed #17944 -- Prevented an error in the user change page of the admin when the content of the password field doesn't match the expected format. Thanks saxix for the report and initial patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17775 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-03-22 08:10:19 +00:00
Aymeric Augustin 86f9ab20b0 Fixed a typo in my previous commit. Apologies.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17771 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-03-20 21:04:57 +00:00
Aymeric Augustin ed27ae071f Fixed #17940 -- Enforced USE_TZ = False in contrib apps tests that use fixtures containing datetimes.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17770 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-03-20 20:51:16 +00:00
Claude Paroz 1235cd376e Reset template context processors cache after tests. Refs #17848.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17736 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-03-14 20:46:52 +00:00
Ramiro Morales 4cd9b4bb50 Fixed #17327 (again) -- Moved createsuperuser tests added in r17665.
In their new location they won't cause multi-db-related errors when
users run contrib.auh tests together with their application tests.

Thanks brianriley for the patch.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@17676 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-03-10 17:36:41 +00:00
Chris Beaven 8c9b032ea0 Fixes #17327 -- Add --database option to createsuperuser and change password management commands
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17665 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-03-05 04:17:55 +00:00
Jannis Leidel fcaf8eae14 Fixed #17046 -- Added a check if the username passed to User.objects.create_user is empty or not. Thanks, kwadrat.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17628 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-03-02 16:56:20 +00:00
Paul McMillan 413e37481d Fixes #17777 and makes tests run again.
Adds a salted MD5 hasher for backwards compatibility.
Thanks gunnar@g10f.de for the report.

Also fixes a bug preventing the hasher tests from being run during
contrib tests.


git-svn-id: http://code.djangoproject.com/svn/django/trunk@17604 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-02-29 20:12:16 +00:00
Aymeric Augustin abf2d4295f Fixed #16366 -- Prevented some failures of the django.contrib.auth tests when run within a project. Thanks to everyone who contributed to the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17598 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-02-27 22:54:35 +00:00
Paul McMillan 06da2be00f Fix broken test introduced by r17526.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17527 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-02-16 01:37:12 +00:00
Jannis Leidel 875a5ea8d4 Fixed #17504 -- Fixed normalization of email addresses that have '@' in the name when calling `User.objects.create_user`. Thanks, marw85.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17482 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-02-09 18:58:53 +00:00
Jannis Leidel 954e3b4ad3 Fixed #13914 -- Added natural keys to User and Group models in auth contrib app. Thanks, jbochi and closedbracket.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17429 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2012-02-04 12:48:01 +00:00
Paul McMillan 90e05aaeac Renovated password hashing, including the forgotten files in r17253.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17254 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-12-23 03:53:56 +00:00
Paul McMillan dce820ff70 Renovated password hashing. Many thanks to Justine Tunney for help with the initial patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17253 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-12-23 03:46:06 +00:00
Jannis Leidel 5df31c0164 Fixed #17194 -- Made sure the auth form tests work if a language other than English is activated by moving the error message translation strings into class level dictionaries. Many thanks to Claude Paroz, rabio and Bas Peschier for their initial work on this.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17204 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-12-15 16:12:46 +00:00
Aymeric Augustin 658abb0859 Removed redundant definition of urls in the auth tests.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17142 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-11-22 07:44:26 +00:00
Aymeric Augustin 03cfad4198 Upgraded django.contrib.auth to be compatible with time zone support.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17122 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-11-20 10:50:18 +00:00
Karen Tracey f4f61baa8c Fix #16813: Restore checking whether a backend supports inctive users before sending inactive users in for permission checking. Thanks apollo13 for the report and poirier for the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@17084 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-11-12 17:23:07 +00:00
Ramiro Morales 4c457bca85 Fixed #16789 -- Added names to URLs in convenience contrib.auth urls.py.
Thanks wim AT go2people DOT nl for the report, cmheisel for the patch and
fcurella for reviewing it.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@16901 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-09-24 19:48:27 +00:00
Ramiro Morales 26b8122087 Fixed #14675 -- Completed removal of `from django.conf.urls.default import *` usage.
This applies to both our own [test] code and documentation examples. Also:
 * Moved the functions and handlers from `django.conf.urls.defaults` up to
   `django.conf.urls` deprecating the former module.
 * Added documentation for `handler403`.
 * Tweaked the URLs topic document a bit.

Thanks to pupeno and cdestigter for their great work contributing patches.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@16818 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-09-11 22:36:16 +00:00
Alex Gaynor e130dc3275 Removed the deprecated-since-1.2 "supports_object_permissions" and "supports_anonymous_user" flags on authentication backends. If you have an authenication backend it now *must* suport these.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@16789 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-09-10 21:00:32 +00:00
Julien Phalip 09fc775f42 Fixed #16412 -- Prevented a `contrib.auth` test from failing in the potential case where `contrib.sites` was not installed. Thanks to haras for the report and to Aymeric Augustin for the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@16717 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-09-03 12:53:08 +00:00
Jannis Leidel 56775c23ee Added yet another import from the future.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@16577 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-07-31 17:01:57 +00:00
Jannis Leidel 6b80640fd7 Fixed #16413 -- Stopped an auth test from failing if LOGIN_URL is set to a non-default value. Thanks, Aymeric Augustin.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@16552 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-07-26 08:27:23 +00:00
Jannis Leidel 24f4764a48 Fixed #16225 -- Removed unused imports. Many thanks to Aymeric Augustin for the work on the patch and Alex for reviewing.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@16539 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-07-13 09:35:51 +00:00
Jannis Leidel 230dab85c5 Removed stale import from auth tests. Thanks, Ramiro.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@16483 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-06-28 14:04:36 +00:00
Jannis Leidel f4aa39837a Reverted parts of r14891 and r16400 due to inherent brokenness of tests.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@16482 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-06-28 13:42:46 +00:00
Jannis Leidel 0278947128 Fixed #16363 -- Fixed tests introduced in r16472. Thanks, EnTeQuAk.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@16478 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-06-28 10:17:36 +00:00
Chris Beaven f54135fa4d Make the email parameter of User.objects.create_user optional.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@16472 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-06-28 04:29:48 +00:00
Jannis Leidel 4a10338986 Fixed #14390 and #16262 -- Moved password related functions from auth models to utils module and stopped check_password from throwing an exception. Thanks, subsume and lrekucki.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@16456 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-06-26 16:51:46 +00:00
Jannis Leidel 2619dc8285 Fixed #14674 -- Prevent user accounts with an unusable password from resetting passwords. Thanks, summerisgone, thejaswi_puthraya and lrekucki.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@16455 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-06-26 16:51:34 +00:00
Jannis Leidel 821d8aaaaa Fixed #15266 -- Applied login_required decorator to password_change_done view. Thanks, lasko.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@16454 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-06-26 16:51:25 +00:00
Jannis Leidel 656360c240 Fixed #12202 -- Removed hardcoded password reset subject and added a subject_template_name parameter to the password_reset view. Thanks, Ramiro Morales, Claude Paroz and agabel.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@16438 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-06-19 11:24:39 +00:00
Jannis Leidel 3f37d1673b Fixed #16183 -- Fixed an ignored auth test. Thanks, desh.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@16400 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-06-14 10:45:49 +00:00
Luke Plant 4531767700 Fixed auth context processor tests, which were not running at all previously.
It seems they were accidentally disabled following being moved from
regressiontests in [15990]

git-svn-id: http://code.djangoproject.com/svn/django/trunk@16304 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-05-31 15:19:19 +00:00
Chris Beaven 161b94ef7b Fixes #15778 -- createsuperuser fails on international characters in system user names. Thanks for the patch, Hynek Cernoch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@16182 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-05-09 01:10:40 +00:00
Russell Keith-Magee 4c468800ee Updates to the test suite to allow for newly deprecated and removed features
git-svn-id: http://code.djangoproject.com/svn/django/trunk@15990 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-04-02 08:44:47 +00:00
Russell Keith-Magee 48edaf17a3 Advanced deprecations in contrib.auth.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@15970 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-04-02 08:33:01 +00:00
Adrian Holovaty 94af19c43f Changed e-mail to email throughout documentation and codebase. The one exception is translation strings, which I didn't want to disrupt
git-svn-id: http://code.djangoproject.com/svn/django/trunk@15967 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-04-01 16:10:22 +00:00
Luke Plant 25aaa359a2 Removed Django 1.2 compatibility fallback for password reset hash
git-svn-id: http://code.djangoproject.com/svn/django/trunk@15950 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-03-30 17:34:38 +00:00
Adrian Holovaty a87be3554f Removed a bunch of Python 2.4 workarounds now that we don't support it. Refs #15702 -- thanks to jonash for the patch. Splitting this over muliple commits to make it more manageable.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@15926 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-03-28 01:40:43 +00:00
Russell Keith-Magee b49ee91eb3 Fixed #15142 -- Force test views to be non-cached so that projects with caching middleware enabled don't cause test failures. Thanks to jsdalton for the report and patch
git-svn-id: http://code.djangoproject.com/svn/django/trunk@15865 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-03-17 08:07:40 +00:00
Carl Meyer 7d71a9e45f Fixed #9213 - Added check to prevent inactive users from resetting their password. Thanks to John Scott for report and draft patch, and Evgeny Fadeev for final patch with test.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@15805 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-03-14 21:14:10 +00:00
Russell Keith-Magee afd040d4d3 Updated test assertions that have been deprecated by the move to unittest2. In summary, this means:
assert_ -> assertTrue
 assertEquals -> assertEqual
 failUnless -> assertTrue

For full details, see http://www.voidspace.org.uk/python/articles/unittest2.shtml#deprecations

git-svn-id: http://code.djangoproject.com/svn/django/trunk@15728 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-03-03 15:04:39 +00:00
Jannis Leidel 751888ece3 Fixed #11223 -- Fixed logout view to use the 'next' GET parameter correctly as described in the docs, while only allowing redirection to the same host.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@15706 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-03-02 12:47:44 +00:00
Jannis Leidel ec193224d3 Fixed #12534 -- Loosened the the security check for "next" redirects after logins slightly to allow paths that contain spaces. Thanks for the patch, jnns and aaugustin.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@15702 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-03-01 22:49:18 +00:00
Russell Keith-Magee b9a20d1e3b Fixed #15371 -- Ensure that a superuser created with the createsuperuser management command with --noinput has an invalid password, not a blank password. Thanks to yishaibeeri for the report and patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@15631 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-02-22 11:33:04 +00:00
Russell Keith-Magee 7a60b41130 Fixed #15111 -- Ensured that the auth, contenttypes and sitemaps tests will run when the sites app isn't installed. Thanks to Waldemar Kornewald for the report and draft patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@15418 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-02-05 03:49:03 +00:00
Russell Keith-Magee d053624aa8 Fixed #15067 -- Modified the range checks on base36_to_int so you are guaranteed to always get an int, avoiding possible OverflowErrors. Thanks to Garthex for the report, jboutros for the patch, and kfrazier for the feedback.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@15288 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-01-24 08:02:40 +00:00
Russell Keith-Magee 8781ea6cd7 Fixed #14975, #14925 -- Added some cache flushing to avoid some cross-test effects. Thanks to jsdalton and rpbarlow for the reports.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@15192 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2011-01-13 16:22:03 +00:00
Alex Gaynor 6819be1ea1 Fix a security issue in the auth system. Disclosure and new release forthcoming.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@15032 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-12-23 03:45:08 +00:00
Jannis Leidel 745c255a19 Fixed #14249 -- Added support for inactive users to the auth backend system. Thanks, Harro van der Klauw.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@15010 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-12-21 19:18:12 +00:00
Russell Keith-Magee 059d9205d4 Fixed #14920 -- Fixed some test failures caused by caching contenttypes that were loaded during a contenttype fixture test. Thanks to Karen for the report.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14985 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-12-19 13:01:51 +00:00
Jannis Leidel 674c671cae Fixed #14731 -- Respect ordering when creating the default permissions. Thanks, chipx86.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14891 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-12-12 22:59:28 +00:00
Russell Keith-Magee 5b8ef18dcc Fixed #14795 -- Ensure that get_all_permissions() returns the right result (i.e., all permissions) for superusers. Thanks to jay.halleaux@gmail.com for the report, and Brett Haydon for the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14797 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-12-04 05:59:56 +00:00
Russell Keith-Magee 34a386378f Fixed #13190 -- Improved error handling for the case where no authentication backends are defined. Thanks to Joel3000 for the report, and Łukasz Rekucki for the final patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14793 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-12-04 04:47:59 +00:00
Chris Beaven dceaa82dec Fixed #14809 -- broken login related tests after r14733.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14764 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-12-01 22:25:17 +00:00
Chris Beaven e74edb4d53 Fixes #11025 -- ability to specify LOGIN_URL as full qualified absolute URL.
auth.views.login now allows for login redirections for different schemes
with the same host (or no host even, e.g. 'https:///login/')

auth.decorators.login_required can now use lazy urls (refs #5925)

git-svn-id: http://code.djangoproject.com/svn/django/trunk@14733 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-11-27 22:43:33 +00:00
Jannis Leidel 132afbf8ee Fixed #5612 -- Added login and logout signals to contrib auth app. Thanks SmileyChris and pterk.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14710 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-11-26 13:33:27 +00:00
Luke Plant 02fc6276d7 Fixed #14508 - test suite silences warnings.
Utility functions get_warnings_state and save_warnings_state have been added
to django.test.utils, and methods to django.test.TestCase for convenience.

The implementation is based on the catch_warnings context manager from
Python 2.6.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@14526 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-11-11 15:06:20 +00:00
Luke Plant 6feef0c13e Fixed #14612 - Password reset page leaks valid user ids publicly.
Thanks to PaulM for the report.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@14456 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-11-04 12:36:55 +00:00
Luke Plant 7d4a3991f3 Fixed a test setup and isolation bug that was causing PasswordResetTest to fail when run individually
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14455 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-11-04 12:31:57 +00:00
Alex Gaynor 15b3350d30 Fixed the auth tests so they work when the AUTHENTICATION_BACKENDS setting is a list. Thanks to Patrick Altman for the report.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14406 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-10-31 16:25:29 +00:00
Luke Plant 45c7f427ce Fixed #14445 - Use HMAC and constant-time comparison functions where needed.
All adhoc MAC applications have been updated to use HMAC, using SHA1 to
generate unique keys for each application based on the SECRET_KEY, which is
common practice for this situation. In all cases, backwards compatibility
with existing hashes has been maintained, aiming to phase this out as per
the normal deprecation process. In this way, under most normal
circumstances the old hashes will have expired (e.g. by session expiration
etc.) before they become invalid.

In the case of the messages framework and the cookie backend, which was
already using HMAC, there is the possibility of a backwards incompatibility
if the SECRET_KEY is shorter than the default 50 bytes, but the low
likelihood and low impact meant compatibility code was not worth it.

All known instances where tokens/hashes were compared using simple string
equality, which could potentially open timing based attacks, have also been
fixed using a constant-time comparison function.

There are no known practical attacks against the existing implementations,
so these security improvements will not be backported.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@14218 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-10-14 20:54:30 +00:00
Russell Keith-Magee 03f00bcd42 Fixed #14447 -- Modified the auth and sitemaps tests to remove some assumptions about the environment in which the tests are run. Thanks to Gabriel Hurley for the report and patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14184 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-10-12 07:15:47 +00:00
Russell Keith-Magee 1070c57b83 Fixed #14436 -- Escalated 1.2 PendingDeprecationWarnings to DeprecationWarnings, and removed 1.1 deprecated code.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14138 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-10-11 12:20:07 +00:00
Luke Plant f3429da6a0 Converted contrib/auth/tokens doctests to unittests. We've always said "no more" to doctests.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14100 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-10-10 01:06:42 +00:00
Russell Keith-Magee 8755fb1549 Fixed #14354 -- Normalized the handling of empty/null passwords in contrib.auth. This also updates the createsuperuser command to be more testable, and migrates some auth doctests. Thanks to berryp for the report, and Laurent Luce for the patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14053 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-10-09 03:34:08 +00:00
Russell Keith-Magee f53491db6e #14374 -- Added some missing template files to ensure that contrib.auth tests will pass when admin isn't installed. Thanks to henriquebastos for the report and patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@14003 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-10-08 13:50:54 +00:00
Luke Plant 667d832e90 Fixed #14386, #8960, #10235, #10909, #10608, #13845, #14377 - standardize Site/RequestSite usage in various places.
Many thanks to gabrielhurley for putting most of this together.  Also to
bmihelac, arthurk, qingfeng, hvendelbo, petr.pulc@s-cape.cz, Hraban for
reports and some initial patches.

The patch also contains some whitespace/PEP8 fixes.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@13980 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-10-04 14:20:47 +00:00
Malcolm Tredinnick 4084bc7354 Permit custom from-email address in auth forms email.
Patch from cassidy and Rob Hudson. Fixed #11300.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@13817 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-09-12 22:38:01 +00:00
Jannis Leidel bb00b28399 Added login_url argument to login_required decorator. Thanks mhlakhani and ericflo for the report and patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13723 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-09-10 19:38:57 +00:00
Luke Plant 303bdc85a7 Fixed #14242 - UserChangeForm subclasses without 'user_permissions' field causes KeyError
This was a regression introduced by [13683]

Thanks to adammckerlie@gmail.com for report.



git-svn-id: http://code.djangoproject.com/svn/django/trunk@13702 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-09-09 23:31:54 +00:00
Luke Plant 801bb146e8 Converted tests for contrib.auth.forms to unit tests.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13701 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-09-09 23:21:16 +00:00
Jannis Leidel 286ce85e45 Fixed #13569 -- Fixed createsuperuser management command to work with the new relaxed requirements for usernames.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@13297 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-05-21 14:08:49 +00:00
Russell Keith-Magee 056c940f0d Fixed #13304 -- Updated auth decorators so they can be used with callable classes. Thanks to Horst Gutmann for the report and patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@12938 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-04-09 11:07:17 +00:00
Russell Keith-Magee 4dfe6190fa Fixed #13108 -- Corrected an ambiguity in test data with the potential to cause test failures out of the box. Thanks to benreynwar for the report.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@12778 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-03-15 06:55:56 +00:00
Jacob Kaplan-Moss 973bf6f485 Fixed #5605: only lowercase the domain portion of an email address in `UserManager.create_user`.
Thanks, Leo.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@12641 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-03-01 20:30:44 +00:00
Jacob Kaplan-Moss 6e748b5db4 Fixed #11457: tightened the security check for "next" redirects after logins.
The new behavior still disallows redirects to off-site URLs, but now allows
redirects of the form `/some/other/view?foo=http://...`.

Thanks to brutasse.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@12635 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-03-01 19:58:53 +00:00
Jacob Kaplan-Moss c8015052d9 Fixed #5786: relaxed the validation for usernames to allow more common characters '@', etc.
This is really just a stop-gap until we come up with a improved way of handling
disparate auth data, but it should help us stretch a bit more milage out of the
current system.

Thanks to alextreme, lbruno, and clayg.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@12634 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-03-01 19:49:05 +00:00
Justin Bronn 1d5165e3be Fixed #12776 -- `User.get_profile` now raises `SiteProfileNotAvailable` instead of `AttributeError` in certain circumstances. Thanks, Bruno Renié.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@12506 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-02-23 05:52:37 +00:00
Russell Keith-Magee b794441951 Fixed #10976 -- Isolated contrib.auth tests so they will always pass, regardless of any local templates. Thanks to aarond10 for the report, and SmileyChris for turning that into a patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@12420 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-02-13 12:02:11 +00:00
Luke Plant 8daec78cfd Fixed #12557 - AnonymousUser should check auth backends for permissions
Thanks to hvdklauw for the idea and work on the patch.



git-svn-id: http://code.djangoproject.com/svn/django/trunk@12316 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-01-28 01:47:23 +00:00
Adrian Holovaty 19b72077f7 Fixed #8049 -- Fixed inconsistency in admin site is_active checks. Thanks for patch and tests, isagalaev
git-svn-id: http://code.djangoproject.com/svn/django/trunk@12159 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2010-01-10 16:51:13 +00:00
Jannis Leidel 57d7181caa Fixed #12462 - Fixed edge case with auth backends that don't support object permissions. Thanks to Florian Apolloner for catching it.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@12032 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-12-30 22:12:57 +00:00
Jannis Leidel 9bf652dfd6 Fixed #11010 - Add a foundation for object permissions to authentication backends. Thanks to Florian Apolloner for writing the initial patch.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11807 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-12-10 01:05:35 +00:00
Luke Plant c161bf21f0 Fixed #6552, #12031 - Make django.core.context_processors.auth lazy to avoid "Vary: Cookie"
Thanks to olau@iola.dk, Suor for the report



git-svn-id: http://code.djangoproject.com/svn/django/trunk@11623 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-14 18:09:13 +00:00
Luke Plant 4a5630fe75 Removed unnecessary keys in django.contrib.auth.test.__test__
Only doctest tests, and not TestCases, need to be in __test__ AFAICS.



git-svn-id: http://code.djangoproject.com/svn/django/trunk@11481 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-09-10 09:51:27 +00:00
Russell Keith-Magee e91deca779 Fixed #10521 -- Modified the Remote User tests so that it isn't dependent on particular deployed URLs. Thanks to Kegan and Ramiro Morales for their contributions.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10674 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-05-04 07:05:44 +00:00
Malcolm Tredinnick 5a57a7f006 Fixed #8752 -- Fixed django.contrib.auth tests to be locale-independent.
Patch from Koen Biermans.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@10599 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-04-19 03:41:33 +00:00
Jacob Kaplan-Moss 9faa1cd9b5 Fixed #10747: fixed the auth tests to ignore broken user-supplied login/logout templates.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10482 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-04-10 15:50:51 +00:00
Jacob Kaplan-Moss 6d5492630d Fixed a sloppy test auth test. [10400] revealed that the auth test was relying on the weird difference between calling a management from the shell and from `call_command`. That this worked in the first case was pretty much an accident.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10404 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-04-05 19:00:27 +00:00
Jacob Kaplan-Moss 2a994716a1 Fixed #10265: fixed a bug when generating a password reset token for a user created on the same request. Thanks, crucialfelix.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10341 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-04-01 21:25:24 +00:00
Jacob Kaplan-Moss 3e6f4674e2 Fixed #10460: the logout view can now redirect like the rest of the auth views. Thanks, chronos and steingrd.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10332 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-04-01 17:02:32 +00:00
Jacob Kaplan-Moss 19b9211a3b Fixed #9881: Added the to the login view context, not just the site's name. Thanks, nessita.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10330 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-04-01 16:37:48 +00:00
Gary Wilson Jr b4f5655c86 Fixed #10553 -- Corrected several uses of `URLconf` in documentation and comments, according to the Django style guide. Based on patch from rduffield.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10256 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-03-31 16:07:07 +00:00
Gary Wilson Jr 3989a7ae11 Fixed #8140 -- Made `UserManager.create_superuser` return the new `User` object, based on patch from ericholscher.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10217 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-03-30 22:00:07 +00:00
Gary Wilson Jr b994387d8d Fixed #689 -- Added a middleware and authentication backend to contrib.auth for supporting external authentication solutions. Thanks to all who contributed to this patch, including Ian Holsman, garthk, Koen Biermans, Marc Fargas, ekarulf, and Ramiro Morales.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@10063 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-03-15 05:54:28 +00:00
Luke Plant 1306079a02 Fixed #10017 - PasswordResetForm.clean_email was not returning the value.
Thanks Zak Johnson, Leo


git-svn-id: http://code.djangoproject.com/svn/django/trunk@9906 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-02-26 17:11:28 +00:00
Karen Tracey bcd63cbfb0 Fixed #6160, #9111 -- Consistently apply conditional_escape to form errors and labels when outputing them as HTML.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@9365 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2008-11-06 19:49:24 +00:00
Malcolm Tredinnick 157dbe2fff Fixed #8552 -- Use the LOGIN_REDIRECT_URL setting in the auth tests, rather than hard-coding the value.
This enables things to work properly when installed in other configurations.
Patch from aeby.


git-svn-id: http://code.djangoproject.com/svn/django/trunk@8613 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2008-08-27 06:02:13 +00:00
Jacob Kaplan-Moss 78d13fb1c2 Fixed #8379: the admin user change form now properly validates the username. Thanks, kratorius.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@8544 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2008-08-25 17:10:20 +00:00
Jacob Kaplan-Moss 15ed0d65b0 Fixed #7833: the user creation form now works when password1 isn't set.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@8542 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2008-08-25 16:55:57 +00:00
Malcolm Tredinnick abb1c508cc Tests for password change process. Thanks, Mike Richardson. Fixed #8402.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@8497 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2008-08-23 18:20:49 +00:00
Luke Plant fcd837cd0f Fixed #7723 - implemented a secure password reset form that uses a token and prompts user for new password.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@8162 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2008-07-31 20:47:53 +00:00
Brian Rosner a19ed8aea3 Merged the newforms-admin branch into trunk.
This is a backward incompatible change. The admin contrib app has been
refactored. The newforms module has several improvements including FormSets
and Media definitions.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@7967 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2008-07-18 23:54:34 +00:00