Projet

Général

Profil

0001-manage-do-not-crash-while-trying-to-impersonate-stal.patch

Paul Marillonnet, 23 septembre 2022 11:24

Télécharger (3,25 ko)

Voir les différences: 

Subject: [PATCH] manage: do not crash while trying to impersonate stale ldap
 user (#62868)


 src/authentic2/views.py    |  4 ++--
 tests/test_user_manager.py | 28 +++++++++++++++++++++++++++-
 2 files changed, 29 insertions(+), 3 deletions(-)
src/authentic2/views.py
1602 1602 
        if not user:
1603 1603 
            raise Http404
1604 1604 
        # LDAP ad-hoc behaviour
1605 
        if user.userexternalid_set.exists():
1606 
            user = utils_misc.authenticate(request, user=user)
1605 
        if user.userexternalid_set.exists() and not utils_misc.authenticate(request, user=user):
1606 
            raise Http404(_('Logging in to Publik as stale LDAP user is not allowed.'))
1607 1607 
        return utils_misc.simulate_authentication(request, user, 'su')
1608 1608 

  		




  1609
  1609
  
    

  		












  

    
      tests/test_user_manager.py
    
  





  26
  26
  
    
from django.contrib.contenttypes.models import ContentType

  		




  27
  27
  
    
from django.urls import reverse

  		




  28
  28
  
    
from webtest import Upload

  		




  
  29
  
    
from webtest.app import AppError

  		




  29
  30
  
    

  		




  30
  31
  
    
from authentic2.a2_rbac.models import OrganizationalUnit as OU

  		




  31
  32
  
    
from authentic2.a2_rbac.models import Permission, Role

  		




  ......




  33
  34
  
    
from authentic2.apps.journal.models import Event

  		




  34
  35
  
    
from authentic2.custom_user.models import User

  		




  35
  36
  
    
from authentic2.manager import user_import

  		




  36
  
  
    
from authentic2.models import Attribute, AttributeValue

  		




  
  37
  
    
from authentic2.models import Attribute, AttributeValue, UserExternalId

  		




  
  38
  
    
from authentic2.utils import misc as utils_misc

  		




  37
  39
  
    
from authentic2_idp_oidc.models import OIDCAuthorization, OIDCClient

  		




  38
  40
  
    
from django_rbac.models import VIEW_OP

  		




  39
  41
  
    
from django_rbac.utils import get_operation

  		




  ......




  645
  647
  
    
    assert new_app.session['_auth_user_id'] == str(simple_user.pk)

  		




  646
  648
  
    

  		




  647
  649
  
    

  		




  
  650
  
    
def test_su_permission_ldap_user_authn_failed(app, app_factory, superuser, simple_user, monkeypatch):

  		




  
  651
  
    
    external_id = UserExternalId(

  		




  
  652
  
    
        user=simple_user,

  		




  
  653
  
    
        source='ldap',

  		




  
  654
  
    
        external_id='abc',

  		




  
  655
  
    
    )

  		




  
  656
  
    
    external_id.save()

  		




  
  657
  
    
    simple_user.userexternalid_set.set([external_id])

  		




  
  658
  
    
    resp = login(app, superuser, '/manage/users/%s/' % simple_user.pk)

  		




  
  659
  
    
    su_view_url = resp.pyquery('button[name="su"]')[0].get('data-url')

  		




  
  660
  
    
    resp = app.get(su_view_url)

  		




  
  661
  
    
    anchors = resp.pyquery('a#su-link')

  		




  
  662
  
    
    su_url = anchors[0].get('href')

  		




  
  663
  
    
    new_app = app_factory()

  		




  
  664
  
    

  		




  
  665
  
    
    def patched_authenticate(request, user=None):

  		




  
  666
  
    
        return None

  		




  
  667
  
    

  		




  
  668
  
    
    monkeypatch.setattr(utils_misc, 'authenticate', patched_authenticate)

  		




  
  669
  
    
    with pytest.raises(AppError) as exc_info:

  		




  
  670
  
    
        new_app.get(su_url).follow()

  		




  
  671
  
    
    assert exc_info.match('Bad response: 404 Not Found')

  		




  
  672
  
    

  		




  
  673
  
    

  		




  648
  674
  
    
def import_csv(csv_content, app):

  		




  649
  675
  
    
    response = app.get('/manage/users/')

  		




  650
  676
  
    
    response = response.click('Import users')

  		




  651
  
  
    
-