wassname/flask-security
1
0
Fork 0
mirror of https://github.com/wassname/flask-security.git synced 2026-09-09 11:22:35 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix CSRF functionality for LoginForm

Browse Source 
The login form was not respecting csrf validation. I've adjusted the tests as well to always send a CSRF token along. This now requires all requests to pass a csrf token. If performing plain AJAX requests the token will have to be extracted from the form in some way. Fixes #86
This commit is contained in:
Matt Wright
2013-02-01 17:23:18 -05:00
parent b82a8d681d
commit 34b3bf9e80
4 changed files with 72 additions and 77 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/signals_tests.py
+17 -28
View File
@@ -32,7 +32,7 @@ class RegisterableSignalsTests(SecurityTest):
self.assertIn('confirm_token', args[0])
self.assertEqual(kwargs['app'], self.app)
def test_register(self):
def test_register_without_password(self):
e = 'dude@lp.com'
with capture_signals() as mocks:
self.register(e, password='')
@@ -111,9 +111,8 @@ class RecoverableSignalsTests(SecurityTest):
def test_reset_password_request(self):
with capture_signals() as mocks:
self.client.post('/reset',
data=dict(email='joe@lp.com'),
follow_redirects=True)
self._post('/reset', data=dict(email='joe@lp.com'),
follow_redirects=True)
self.assertEqual(mocks.signals_sent(), set([reset_password_instructions_sent]))
user = self.app.security.datastore.find_user(email='joe@lp.com')
calls = mocks[reset_password_instructions_sent]
@@ -125,15 +124,12 @@ class RecoverableSignalsTests(SecurityTest):
def test_reset_password(self):
with capture_reset_password_requests() as requests:
self.client.post('/reset',
data=dict(email='joe@lp.com'),
follow_redirects=True)
self._post('/reset', data=dict(email='joe@lp.com'),
follow_redirects=True)
token = requests[0]['token']
with capture_signals() as mocks:
self.client.post('/reset/' + token,
data=dict(password='newpassword',
password_confirm='newpassword'),
follow_redirects=True)
data = dict(password='newpassword', password_confirm='newpassword')
self._post('/reset/' + token, data, follow_redirects=True)
self.assertEqual(mocks.signals_sent(), set([password_reset]))
user = self.app.security.datastore.find_user(email='joe@lp.com')
calls = mocks[password_reset]
@@ -144,17 +140,14 @@ class RecoverableSignalsTests(SecurityTest):
def test_reset_password_invalid_emails(self):
with capture_signals() as mocks:
self.client.post('/reset',
data=dict(email='nobody@lp.com'),
follow_redirects=True)
self._post('/reset', data=dict(email='nobody@lp.com'),
follow_redirects=True)
self.assertEqual(mocks.signals_sent(), set())
def test_reset_password_invalid_token(self):
with capture_signals() as mocks:
self.client.post('/reset/bogus',
data=dict(password='newpassword',
password_confirm='newpassword'),
follow_redirects=True)
data = dict(password='newpassword', password_confirm='newpassword')
self._post('/reset/bogus', data, follow_redirects=True)
self.assertEqual(mocks.signals_sent(), set())
@@ -166,25 +159,22 @@ class PasswordlessTests(SecurityTest):
def test_login_request_for_inactive_user(self):
with capture_signals() as mocks:
self.client.post('/login',
data=dict(email='tiya@lp.com'),
follow_redirects=True)
self._post('/login', data=dict(email='tiya@lp.com'),
follow_redirects=True)
self.assertEqual(mocks.signals_sent(), set())
def test_login_request_for_invalid_email(self):
with capture_signals() as mocks:
self.client.post('/login',
data=dict(email='nobody@lp.com'),
follow_redirects=True)
self._post('/login', data=dict(email='nobody@lp.com'),
follow_redirects=True)
self.assertEqual(mocks.signals_sent(), set())
def test_request_login_token_sends_email_and_can_login(self):
e = 'matt@lp.com'
with capture_signals() as mocks:
self.client.post('/login',
data=dict(email=e),
follow_redirects=True)
self._post('/login', data=dict(email=e), follow_redirects=True)
self.assertEqual(mocks.signals_sent(), set([login_instructions_sent]))
user = self.app.security.datastore.find_user(email='matt@lp.com')
calls = mocks[login_instructions_sent]
@@ -193,4 +183,3 @@ class PasswordlessTests(SecurityTest):
self.assertTrue(compare_user(args[0]['user'], user))
self.assertIn('login_token', args[0])
self.assertEqual(kwargs['app'], self.app)