Projet

Général

Profil

0001-utils-make-sure-user_nameid-user_email-cannot-be-for.patch

Frédéric Péters, 26 juin 2017 10:18

Télécharger (2,24 ko)

Voir les différences: 

Subject: [PATCH] utils: make sure user_nameid/user_email cannot be forged
 (#17173)


 combo/utils.py      |  2 ++
 tests/test_utils.py | 12 +++++++++---
 2 files changed, 11 insertions(+), 3 deletions(-)
combo/utils.py
180 180 
    if context:
181 181 
        template_vars.update(context)
182 182 
        user = getattr(context.get('request'), 'user', None)
183 
        template_vars['user_email'] = ''
184 
        template_vars['user_nameid'] = ''
183 185 
        if user and user.is_authenticated():
184 186 
            template_vars['user_email'] = quote(user.email)
185 187 
            if hasattr(user, 'saml_identifiers') and user.saml_identifiers.exists():
tests/test_utils.py
55 55 
    request.user = None
56 56 
    for context in (None, Context({}), Context({'request': None}),
57 57 
                    Context({'request': request})):
58 
        if context is None:
59 
            with pytest.raises(UnknownTemplateVariableError) as e:
60 
                get_templated_url('NameID=[user_nameid]', context=context)
61 
            with pytest.raises(UnknownTemplateVariableError) as e:
62 
                get_templated_url('email=[user_email]', context=context)
63 
        else:
64 
            assert get_templated_url('NameID=[user_nameid]', context=context) == 'NameID='
65 
            assert get_templated_url('email=[user_email]', context=context) == 'email='
58 66 
        with pytest.raises(UnknownTemplateVariableError) as e:
59 
            get_templated_url('NameID=[user_nameid]', context=context)
60 
        with pytest.raises(UnknownTemplateVariableError):
61 
            get_templated_url('email=[user_email]', context=context)
67 
            get_templated_url('foo=[bar]', context=context)
62 68 
        if context:
63 69 
            context['foobar'] = 'barfoo'
64 70 
            assert get_templated_url('[foobar]', context=context) == 'barfoo'
65 
-