0001-misc-don-t-crash-storing-unicode-passwords-for-logge.patch

Frédéric Péters, 31 décembre 2018 10:16

Voir les différences: en ligne côte à côte

Subject: [PATCH] misc: don't crash storing unicode passwords for logged users
 (#19217)

 tests/test_form_pages.py | 11 ++++++-----
 wcs/qommon/form.py       |  1 +
 wcs/sql.py               |  6 +++++-
 3 files changed, 12 insertions(+), 6 deletions(-)

         formdata.store()
         resp = login(get_app(pub), 'foo', 'foo').get('/test/%s' % formdata.id, status=403)
     def form_password_field_submit(pub, password):
         password = unicode(password).encode(pub.site_charset)
     def form_password_field_submit(app, password):
         formdef = create_formdef()
         formdef.fields = [fields.PasswordField(id='0', label='password',
             formats=['sha1', 'md5', 'cleartext'])]
         formdef.store()
         page = get_app(pub).get('/test/')
         page = app.get('/test/')
         formdef.data_class().wipe()
         next_page = page.forms[0].submit('submit') # but the field is required
         assert '<div class="error">required field</div>' in next_page.body
-...
             }}
     def test_form_password_field_submit(pub):
         form_password_field_submit(pub, 'foobar')
         form_password_field_submit(pub, u'foobar\u00eb')
         user = create_user(pub)
         form_password_field_submit(get_app(pub), 'foobar')
         form_password_field_submit(get_app(pub), 'foobar\u00eb')
         form_password_field_submit(login(get_app(pub), username='foo', password='foo'), 'foobar\u00eb')
     def test_form_multi_page_formdef_count_condition(pub):
         formdef = create_formdef()

wcs/qommon/form.py
2167	2167	self.value = {}
2168	2168	for fmt in self.formats:
2169	2169	self.value[fmt] = PASSWORD_FORMATS[fmt](pwd1)
	2170	print 'parsed:', self.value
2170	2171	else:
2171	2172	self.value = None
2172	2173

             return value
         return value.encode(get_publisher().site_charset)
     def site_unicode(value):
         if isinstance(value, unicode):
             return value
         return unicode(value, get_publisher().site_charset)
     def get_connection(new=False):
         if new:
-...
                 if value is not None:
                     if field.key in ('ranked-items', 'password'):
                         # turn {'poire': 2, 'abricot': 1, 'pomme': 3} into an array
                         value = [[x, unicode(y).encode('utf-8')] for x, y in value.items()]
                         value = [[x, site_unicode(y).encode('utf-8')] for x, y in value.items()]
                     elif sql_type == 'varchar':
                         assert isinstance(value, basestring)
                     elif sql_type == 'date':
+    -

Projet

Général

Profil

Produits Entr'ouvert » w.c.s.

0001-misc-don-t-crash-storing-unicode-passwords-for-logge.patch