Code

Plug a number of security holes:
[roundup.git] / test / test_cgi.py
1 #
2 # Copyright (c) 2003 Richard Jones, rjones@ekit-inc.com
3 # This module is free software, and you may redistribute it and/or modify
4 # under the same terms as Python, so long as this copyright message and
5 # disclaimer are retained in their original form.
6 #
7 # This module is distributed in the hope that it will be useful,
8 # but WITHOUT ANY WARRANTY; without even the implied warranty of
9 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
10 #
11 # $Id: test_cgi.py,v 1.36 2008-08-07 06:12:57 richard Exp $
13 import unittest, os, shutil, errno, sys, difflib, cgi, re
15 from roundup.cgi import client, actions, exceptions
16 from roundup.cgi.exceptions import FormError
17 from roundup.cgi.templating import HTMLItem
18 from roundup.cgi.form_parser import FormParser
19 from roundup import init, instance, password, hyperdb, date
21 import db_test_base
23 NEEDS_INSTANCE = 1
25 class FileUpload:
26     def __init__(self, content, filename):
27         self.content = content
28         self.filename = filename
30 def makeForm(args):
31     form = cgi.FieldStorage()
32     for k,v in args.items():
33         if type(v) is type([]):
34             [form.list.append(cgi.MiniFieldStorage(k, x)) for x in v]
35         elif isinstance(v, FileUpload):
36             x = cgi.MiniFieldStorage(k, v.content)
37             x.filename = v.filename
38             form.list.append(x)
39         else:
40             form.list.append(cgi.MiniFieldStorage(k, v))
41     return form
43 cm = client.clean_message
44 class MessageTestCase(unittest.TestCase):
45     def testCleanMessageOK(self):
46         self.assertEqual(cm('<br>x<br />'), '<br>x<br />')
47         self.assertEqual(cm('<i>x</i>'), '<i>x</i>')
48         self.assertEqual(cm('<b>x</b>'), '<b>x</b>')
49         self.assertEqual(cm('<a href="y">x</a>'),
50             '<a href="y">x</a>')
51         self.assertEqual(cm('<BR>x<BR />'), '<BR>x<BR />')
52         self.assertEqual(cm('<I>x</I>'), '<I>x</I>')
53         self.assertEqual(cm('<B>x</B>'), '<B>x</B>')
54         self.assertEqual(cm('<A HREF="y">x</A>'),
55             '<A HREF="y">x</A>')
57     def testCleanMessageBAD(self):
58         self.assertEqual(cm('<script>x</script>'),
59             '&lt;script&gt;x&lt;/script&gt;')
60         self.assertEqual(cm('<iframe>x</iframe>'),
61             '&lt;iframe&gt;x&lt;/iframe&gt;')
63 class FormTestCase(unittest.TestCase):
64     def setUp(self):
65         self.dirname = '_test_cgi_form'
66         # set up and open a tracker
67         self.instance = db_test_base.setupTracker(self.dirname)
69         # open the database
70         self.db = self.instance.open('admin')
71         self.db.user.create(username='Chef', address='chef@bork.bork.bork',
72             realname='Bork, Chef', roles='User')
73         self.db.user.create(username='mary', address='mary@test.test',
74             roles='User', realname='Contrary, Mary')
76         test = self.instance.backend.Class(self.db, "test",
77             string=hyperdb.String(), number=hyperdb.Number(),
78             boolean=hyperdb.Boolean(), link=hyperdb.Link('test'),
79             multilink=hyperdb.Multilink('test'), date=hyperdb.Date(),
80             messages=hyperdb.Multilink('msg'), interval=hyperdb.Interval())
82         # compile the labels re
83         classes = '|'.join(self.db.classes.keys())
84         self.FV_SPECIAL = re.compile(FormParser.FV_LABELS%classes,
85             re.VERBOSE)
87     def parseForm(self, form, classname='test', nodeid=None):
88         cl = client.Client(self.instance, None, {'PATH_INFO':'/',
89             'REQUEST_METHOD':'POST'}, makeForm(form))
90         cl.classname = classname
91         cl.nodeid = nodeid
92         cl.language = ('en',)
93         cl.db = self.db
94         return cl.parsePropsFromForm(create=1)
96     def tearDown(self):
97         self.db.close()
98         try:
99             shutil.rmtree(self.dirname)
100         except OSError, error:
101             if error.errno not in (errno.ENOENT, errno.ESRCH): raise
103     #
104     # form label extraction
105     #
106     def tl(self, s, c, i, a, p):
107         m = self.FV_SPECIAL.match(s)
108         self.assertNotEqual(m, None)
109         d = m.groupdict()
110         self.assertEqual(d['classname'], c)
111         self.assertEqual(d['id'], i)
112         for action in 'required add remove link note file'.split():
113             if a == action:
114                 self.assertNotEqual(d[action], None)
115             else:
116                 self.assertEqual(d[action], None)
117         self.assertEqual(d['propname'], p)
119     def testLabelMatching(self):
120         self.tl('<propname>', None, None, None, '<propname>')
121         self.tl(':required', None, None, 'required', None)
122         self.tl(':confirm:<propname>', None, None, 'confirm', '<propname>')
123         self.tl(':add:<propname>', None, None, 'add', '<propname>')
124         self.tl(':remove:<propname>', None, None, 'remove', '<propname>')
125         self.tl(':link:<propname>', None, None, 'link', '<propname>')
126         self.tl('test1:<prop>', 'test', '1', None, '<prop>')
127         self.tl('test1:required', 'test', '1', 'required', None)
128         self.tl('test1:add:<prop>', 'test', '1', 'add', '<prop>')
129         self.tl('test1:remove:<prop>', 'test', '1', 'remove', '<prop>')
130         self.tl('test1:link:<prop>', 'test', '1', 'link', '<prop>')
131         self.tl('test1:confirm:<prop>', 'test', '1', 'confirm', '<prop>')
132         self.tl('test-1:<prop>', 'test', '-1', None, '<prop>')
133         self.tl('test-1:required', 'test', '-1', 'required', None)
134         self.tl('test-1:add:<prop>', 'test', '-1', 'add', '<prop>')
135         self.tl('test-1:remove:<prop>', 'test', '-1', 'remove', '<prop>')
136         self.tl('test-1:link:<prop>', 'test', '-1', 'link', '<prop>')
137         self.tl('test-1:confirm:<prop>', 'test', '-1', 'confirm', '<prop>')
138         self.tl(':note', None, None, 'note', None)
139         self.tl(':file', None, None, 'file', None)
141     #
142     # Empty form
143     #
144     def testNothing(self):
145         self.assertEqual(self.parseForm({}), ({('test', None): {}}, []))
147     def testNothingWithRequired(self):
148         self.assertRaises(FormError, self.parseForm, {':required': 'string'})
149         self.assertRaises(FormError, self.parseForm,
150             {':required': 'title,status', 'status':'1'}, 'issue')
151         self.assertRaises(FormError, self.parseForm,
152             {':required': ['title','status'], 'status':'1'}, 'issue')
153         self.assertRaises(FormError, self.parseForm,
154             {':required': 'status', 'status':''}, 'issue')
155         self.assertRaises(FormError, self.parseForm,
156             {':required': 'nosy', 'nosy':''}, 'issue')
157         self.assertRaises(FormError, self.parseForm,
158             {':required': 'msg-1@content', 'msg-1@content':''}, 'issue')
159         self.assertRaises(FormError, self.parseForm,
160             {':required': 'msg-1@content'}, 'issue')
162     #
163     # Nonexistant edit
164     #
165     def testEditNonexistant(self):
166         self.assertRaises(FormError, self.parseForm, {'boolean': ''},
167             'test', '1')
169     #
170     # String
171     #
172     def testEmptyString(self):
173         self.assertEqual(self.parseForm({'string': ''}),
174             ({('test', None): {}}, []))
175         self.assertEqual(self.parseForm({'string': ' '}),
176             ({('test', None): {}}, []))
177         self.assertRaises(FormError, self.parseForm, {'string': ['', '']})
179     def testSetString(self):
180         self.assertEqual(self.parseForm({'string': 'foo'}),
181             ({('test', None): {'string': 'foo'}}, []))
182         self.assertEqual(self.parseForm({'string': 'a\r\nb\r\n'}),
183             ({('test', None): {'string': 'a\nb'}}, []))
184         nodeid = self.db.issue.create(title='foo')
185         self.assertEqual(self.parseForm({'title': 'foo'}, 'issue', nodeid),
186             ({('issue', nodeid): {}}, []))
188     def testEmptyStringSet(self):
189         nodeid = self.db.issue.create(title='foo')
190         self.assertEqual(self.parseForm({'title': ''}, 'issue', nodeid),
191             ({('issue', nodeid): {'title': None}}, []))
192         nodeid = self.db.issue.create(title='foo')
193         self.assertEqual(self.parseForm({'title': ' '}, 'issue', nodeid),
194             ({('issue', nodeid): {'title': None}}, []))
196     def testStringLinkId(self):
197         self.db.status.set('1', name='2')
198         self.db.status.set('2', name='1')
199         issue = self.db.issue.create(title='i1-status1', status='1')
200         self.assertEqual(self.db.issue.get(issue,'status'),'1')
201         self.assertEqual(self.db.status.lookup('1'),'2')
202         self.assertEqual(self.db.status.lookup('2'),'1')
203         form = cgi.FieldStorage()
204         cl = client.Client(self.instance, None, {'PATH_INFO':'/'}, form)
205         cl.classname = 'issue'
206         cl.nodeid = issue
207         cl.db = self.db
208         cl.language = ('en',)
209         item = HTMLItem(cl, 'issue', issue)
210         self.assertEqual(item.status.id, '1')
211         self.assertEqual(item.status.name, '2')
213     def testStringMultilinkId(self):
214         id = self.db.keyword.create(name='2')
215         self.assertEqual(id,'1')
216         id = self.db.keyword.create(name='1')
217         self.assertEqual(id,'2')
218         issue = self.db.issue.create(title='i1-status1', keyword=['1'])
219         self.assertEqual(self.db.issue.get(issue,'keyword'),['1'])
220         self.assertEqual(self.db.keyword.lookup('1'),'2')
221         self.assertEqual(self.db.keyword.lookup('2'),'1')
222         form = cgi.FieldStorage()
223         cl = client.Client(self.instance, None, {'PATH_INFO':'/'}, form)
224         cl.classname = 'issue'
225         cl.nodeid = issue
226         cl.db = self.db
227         cl.language = ('en',)
228         cl.userid = '1'
229         item = HTMLItem(cl, 'issue', issue)
230         for keyword in item.keyword:
231             self.assertEqual(keyword.id, '1')
232             self.assertEqual(keyword.name, '2')
234     def testFileUpload(self):
235         file = FileUpload('foo', 'foo.txt')
236         self.assertEqual(self.parseForm({'content': file}, 'file'),
237             ({('file', None): {'content': 'foo', 'name': 'foo.txt',
238             'type': 'text/plain'}}, []))
240     def testEditFileClassAttributes(self):
241         self.assertEqual(self.parseForm({'name': 'foo.txt',
242                                          'type': 'application/octet-stream'},
243                                         'file'),
244                          ({('file', None): {'name': 'foo.txt',
245                                             'type': 'application/octet-stream'}},[]))
247     #
248     # Link
249     #
250     def testEmptyLink(self):
251         self.assertEqual(self.parseForm({'link': ''}),
252             ({('test', None): {}}, []))
253         self.assertEqual(self.parseForm({'link': ' '}),
254             ({('test', None): {}}, []))
255         self.assertRaises(FormError, self.parseForm, {'link': ['', '']})
256         self.assertEqual(self.parseForm({'link': '-1'}),
257             ({('test', None): {}}, []))
259     def testSetLink(self):
260         self.assertEqual(self.parseForm({'status': 'unread'}, 'issue'),
261             ({('issue', None): {'status': '1'}}, []))
262         self.assertEqual(self.parseForm({'status': '1'}, 'issue'),
263             ({('issue', None): {'status': '1'}}, []))
264         nodeid = self.db.issue.create(status='unread')
265         self.assertEqual(self.parseForm({'status': 'unread'}, 'issue', nodeid),
266             ({('issue', nodeid): {}}, []))
268     def testUnsetLink(self):
269         nodeid = self.db.issue.create(status='unread')
270         self.assertEqual(self.parseForm({'status': '-1'}, 'issue', nodeid),
271             ({('issue', nodeid): {'status': None}}, []))
273     def testInvalidLinkValue(self):
274 # XXX This is not the current behaviour - should we enforce this?
275 #        self.assertRaises(IndexError, self.parseForm,
276 #            {'status': '4'}))
277         self.assertRaises(FormError, self.parseForm, {'link': 'frozzle'})
278         self.assertRaises(FormError, self.parseForm, {'status': 'frozzle'},
279             'issue')
281     #
282     # Multilink
283     #
284     def testEmptyMultilink(self):
285         self.assertEqual(self.parseForm({'nosy': ''}),
286             ({('test', None): {}}, []))
287         self.assertEqual(self.parseForm({'nosy': ' '}),
288             ({('test', None): {}}, []))
290     def testSetMultilink(self):
291         self.assertEqual(self.parseForm({'nosy': '1'}, 'issue'),
292             ({('issue', None): {'nosy': ['1']}}, []))
293         self.assertEqual(self.parseForm({'nosy': 'admin'}, 'issue'),
294             ({('issue', None): {'nosy': ['1']}}, []))
295         self.assertEqual(self.parseForm({'nosy': ['1','2']}, 'issue'),
296             ({('issue', None): {'nosy': ['1','2']}}, []))
297         self.assertEqual(self.parseForm({'nosy': '1,2'}, 'issue'),
298             ({('issue', None): {'nosy': ['1','2']}}, []))
299         self.assertEqual(self.parseForm({'nosy': 'admin,2'}, 'issue'),
300             ({('issue', None): {'nosy': ['1','2']}}, []))
302     def testMixedMultilink(self):
303         form = cgi.FieldStorage()
304         form.list.append(cgi.MiniFieldStorage('nosy', '1,2'))
305         form.list.append(cgi.MiniFieldStorage('nosy', '3'))
306         cl = client.Client(self.instance, None, {'PATH_INFO':'/'}, form)
307         cl.classname = 'issue'
308         cl.nodeid = None
309         cl.db = self.db
310         cl.language = ('en',)
311         self.assertEqual(cl.parsePropsFromForm(create=1),
312             ({('issue', None): {'nosy': ['1','2', '3']}}, []))
314     def testEmptyMultilinkSet(self):
315         nodeid = self.db.issue.create(nosy=['1','2'])
316         self.assertEqual(self.parseForm({'nosy': ''}, 'issue', nodeid),
317             ({('issue', nodeid): {'nosy': []}}, []))
318         nodeid = self.db.issue.create(nosy=['1','2'])
319         self.assertEqual(self.parseForm({'nosy': ' '}, 'issue', nodeid),
320             ({('issue', nodeid): {'nosy': []}}, []))
321         self.assertEqual(self.parseForm({'nosy': '1,2'}, 'issue', nodeid),
322             ({('issue', nodeid): {}}, []))
324     def testInvalidMultilinkValue(self):
325 # XXX This is not the current behaviour - should we enforce this?
326 #        self.assertRaises(IndexError, self.parseForm,
327 #            {'nosy': '4'}))
328         self.assertRaises(FormError, self.parseForm, {'nosy': 'frozzle'},
329             'issue')
330         self.assertRaises(FormError, self.parseForm, {'nosy': '1,frozzle'},
331             'issue')
332         self.assertRaises(FormError, self.parseForm, {'multilink': 'frozzle'})
334     def testMultilinkAdd(self):
335         nodeid = self.db.issue.create(nosy=['1'])
336         # do nothing
337         self.assertEqual(self.parseForm({':add:nosy': ''}, 'issue', nodeid),
338             ({('issue', nodeid): {}}, []))
340         # do something ;)
341         self.assertEqual(self.parseForm({':add:nosy': '2'}, 'issue', nodeid),
342             ({('issue', nodeid): {'nosy': ['1','2']}}, []))
343         self.assertEqual(self.parseForm({':add:nosy': '2,mary'}, 'issue',
344             nodeid), ({('issue', nodeid): {'nosy': ['1','2','4']}}, []))
345         self.assertEqual(self.parseForm({':add:nosy': ['2','3']}, 'issue',
346             nodeid), ({('issue', nodeid): {'nosy': ['1','2','3']}}, []))
348     def testMultilinkAddNew(self):
349         self.assertEqual(self.parseForm({':add:nosy': ['2','3']}, 'issue'),
350             ({('issue', None): {'nosy': ['2','3']}}, []))
352     def testMultilinkRemove(self):
353         nodeid = self.db.issue.create(nosy=['1','2'])
354         # do nothing
355         self.assertEqual(self.parseForm({':remove:nosy': ''}, 'issue', nodeid),
356             ({('issue', nodeid): {}}, []))
358         # do something ;)
359         self.assertEqual(self.parseForm({':remove:nosy': '1'}, 'issue',
360             nodeid), ({('issue', nodeid): {'nosy': ['2']}}, []))
361         self.assertEqual(self.parseForm({':remove:nosy': 'admin,2'},
362             'issue', nodeid), ({('issue', nodeid): {'nosy': []}}, []))
363         self.assertEqual(self.parseForm({':remove:nosy': ['1','2']},
364             'issue', nodeid), ({('issue', nodeid): {'nosy': []}}, []))
366         # add and remove
367         self.assertEqual(self.parseForm({':add:nosy': ['3'],
368             ':remove:nosy': ['1','2']},
369             'issue', nodeid), ({('issue', nodeid): {'nosy': ['3']}}, []))
371         # remove one that doesn't exist?
372         self.assertRaises(FormError, self.parseForm, {':remove:nosy': '4'},
373             'issue', nodeid)
375     def testMultilinkRetired(self):
376         self.db.user.retire('2')
377         self.assertEqual(self.parseForm({'nosy': ['2','3']}, 'issue'),
378             ({('issue', None): {'nosy': ['2','3']}}, []))
379         nodeid = self.db.issue.create(nosy=['1','2'])
380         self.assertEqual(self.parseForm({':remove:nosy': '2'}, 'issue',
381             nodeid), ({('issue', nodeid): {'nosy': ['1']}}, []))
382         self.assertEqual(self.parseForm({':add:nosy': '3'}, 'issue', nodeid),
383             ({('issue', nodeid): {'nosy': ['1','2','3']}}, []))
385     def testAddRemoveNonexistant(self):
386         self.assertRaises(FormError, self.parseForm, {':remove:foo': '2'},
387             'issue')
388         self.assertRaises(FormError, self.parseForm, {':add:foo': '2'},
389             'issue')
391     #
392     # Password
393     #
394     def testEmptyPassword(self):
395         self.assertEqual(self.parseForm({'password': ''}, 'user'),
396             ({('user', None): {}}, []))
397         self.assertEqual(self.parseForm({'password': ''}, 'user'),
398             ({('user', None): {}}, []))
399         self.assertRaises(FormError, self.parseForm, {'password': ['', '']},
400             'user')
401         self.assertRaises(FormError, self.parseForm, {'password': 'foo',
402             ':confirm:password': ['', '']}, 'user')
404     def testSetPassword(self):
405         self.assertEqual(self.parseForm({'password': 'foo',
406             ':confirm:password': 'foo'}, 'user'),
407             ({('user', None): {'password': 'foo'}}, []))
409     def testSetPasswordConfirmBad(self):
410         self.assertRaises(FormError, self.parseForm, {'password': 'foo'},
411             'user')
412         self.assertRaises(FormError, self.parseForm, {'password': 'foo',
413             ':confirm:password': 'bar'}, 'user')
415     def testEmptyPasswordNotSet(self):
416         nodeid = self.db.user.create(username='1',
417             password=password.Password('foo'))
418         self.assertEqual(self.parseForm({'password': ''}, 'user', nodeid),
419             ({('user', nodeid): {}}, []))
420         nodeid = self.db.user.create(username='2',
421             password=password.Password('foo'))
422         self.assertEqual(self.parseForm({'password': '',
423             ':confirm:password': ''}, 'user', nodeid),
424             ({('user', nodeid): {}}, []))
426     #
427     # Boolean
428     #
429     def testEmptyBoolean(self):
430         self.assertEqual(self.parseForm({'boolean': ''}),
431             ({('test', None): {}}, []))
432         self.assertEqual(self.parseForm({'boolean': ' '}),
433             ({('test', None): {}}, []))
434         self.assertRaises(FormError, self.parseForm, {'boolean': ['', '']})
436     def testSetBoolean(self):
437         self.assertEqual(self.parseForm({'boolean': 'yes'}),
438             ({('test', None): {'boolean': 1}}, []))
439         self.assertEqual(self.parseForm({'boolean': 'a\r\nb\r\n'}),
440             ({('test', None): {'boolean': 0}}, []))
441         nodeid = self.db.test.create(boolean=1)
442         self.assertEqual(self.parseForm({'boolean': 'yes'}, 'test', nodeid),
443             ({('test', nodeid): {}}, []))
444         nodeid = self.db.test.create(boolean=0)
445         self.assertEqual(self.parseForm({'boolean': 'no'}, 'test', nodeid),
446             ({('test', nodeid): {}}, []))
448     def testEmptyBooleanSet(self):
449         nodeid = self.db.test.create(boolean=0)
450         self.assertEqual(self.parseForm({'boolean': ''}, 'test', nodeid),
451             ({('test', nodeid): {'boolean': None}}, []))
452         nodeid = self.db.test.create(boolean=1)
453         self.assertEqual(self.parseForm({'boolean': ' '}, 'test', nodeid),
454             ({('test', nodeid): {'boolean': None}}, []))
456     def testRequiredBoolean(self):
457         self.assertRaises(FormError, self.parseForm, {'boolean': '',
458             ':required': 'boolean'})
459         try:
460             self.parseForm({'boolean': 'no', ':required': 'boolean'})
461         except FormError:
462             self.fail('boolean "no" raised "required missing"')
464     #
465     # Number
466     #
467     def testEmptyNumber(self):
468         self.assertEqual(self.parseForm({'number': ''}),
469             ({('test', None): {}}, []))
470         self.assertEqual(self.parseForm({'number': ' '}),
471             ({('test', None): {}}, []))
472         self.assertRaises(FormError, self.parseForm, {'number': ['', '']})
474     def testInvalidNumber(self):
475         self.assertRaises(FormError, self.parseForm, {'number': 'hi, mum!'})
477     def testSetNumber(self):
478         self.assertEqual(self.parseForm({'number': '1'}),
479             ({('test', None): {'number': 1}}, []))
480         self.assertEqual(self.parseForm({'number': '0'}),
481             ({('test', None): {'number': 0}}, []))
482         self.assertEqual(self.parseForm({'number': '\n0\n'}),
483             ({('test', None): {'number': 0}}, []))
485     def testSetNumberReplaceOne(self):
486         nodeid = self.db.test.create(number=1)
487         self.assertEqual(self.parseForm({'number': '1'}, 'test', nodeid),
488             ({('test', nodeid): {}}, []))
489         self.assertEqual(self.parseForm({'number': '0'}, 'test', nodeid),
490             ({('test', nodeid): {'number': 0}}, []))
492     def testSetNumberReplaceZero(self):
493         nodeid = self.db.test.create(number=0)
494         self.assertEqual(self.parseForm({'number': '0'}, 'test', nodeid),
495             ({('test', nodeid): {}}, []))
497     def testSetNumberReplaceNone(self):
498         nodeid = self.db.test.create()
499         self.assertEqual(self.parseForm({'number': '0'}, 'test', nodeid),
500             ({('test', nodeid): {'number': 0}}, []))
501         self.assertEqual(self.parseForm({'number': '1'}, 'test', nodeid),
502             ({('test', nodeid): {'number': 1}}, []))
504     def testEmptyNumberSet(self):
505         nodeid = self.db.test.create(number=0)
506         self.assertEqual(self.parseForm({'number': ''}, 'test', nodeid),
507             ({('test', nodeid): {'number': None}}, []))
508         nodeid = self.db.test.create(number=1)
509         self.assertEqual(self.parseForm({'number': ' '}, 'test', nodeid),
510             ({('test', nodeid): {'number': None}}, []))
512     def testRequiredNumber(self):
513         self.assertRaises(FormError, self.parseForm, {'number': '',
514             ':required': 'number'})
515         try:
516             self.parseForm({'number': '0', ':required': 'number'})
517         except FormError:
518             self.fail('number "no" raised "required missing"')
520     #
521     # Date
522     #
523     def testEmptyDate(self):
524         self.assertEqual(self.parseForm({'date': ''}),
525             ({('test', None): {}}, []))
526         self.assertEqual(self.parseForm({'date': ' '}),
527             ({('test', None): {}}, []))
528         self.assertRaises(FormError, self.parseForm, {'date': ['', '']})
530     def testInvalidDate(self):
531         self.assertRaises(FormError, self.parseForm, {'date': '12'})
533     def testSetDate(self):
534         self.assertEqual(self.parseForm({'date': '2003-01-01'}),
535             ({('test', None): {'date': date.Date('2003-01-01')}}, []))
536         nodeid = self.db.test.create(date=date.Date('2003-01-01'))
537         self.assertEqual(self.parseForm({'date': '2003-01-01'}, 'test',
538             nodeid), ({('test', nodeid): {}}, []))
540     def testEmptyDateSet(self):
541         nodeid = self.db.test.create(date=date.Date('.'))
542         self.assertEqual(self.parseForm({'date': ''}, 'test', nodeid),
543             ({('test', nodeid): {'date': None}}, []))
544         nodeid = self.db.test.create(date=date.Date('1970-01-01.00:00:00'))
545         self.assertEqual(self.parseForm({'date': ' '}, 'test', nodeid),
546             ({('test', nodeid): {'date': None}}, []))
548     #
549     # Test multiple items in form
550     #
551     def testMultiple(self):
552         self.assertEqual(self.parseForm({'string': 'a', 'issue-1@title': 'b'}),
553             ({('test', None): {'string': 'a'},
554               ('issue', '-1'): {'title': 'b'}
555              }, []))
557     def testMultipleExistingContext(self):
558         nodeid = self.db.test.create()
559         self.assertEqual(self.parseForm({'string': 'a', 'issue-1@title': 'b'},
560             'test', nodeid),({('test', nodeid): {'string': 'a'},
561             ('issue', '-1'): {'title': 'b'}}, []))
563     def testLinking(self):
564         self.assertEqual(self.parseForm({
565             'string': 'a',
566             'issue-1@add@nosy': '1',
567             'issue-2@link@superseder': 'issue-1',
568             }),
569             ({('test', None): {'string': 'a'},
570               ('issue', '-1'): {'nosy': ['1']},
571              },
572              [('issue', '-2', 'superseder', [('issue', '-1')])
573              ]
574             )
575         )
577     def testMessages(self):
578         self.assertEqual(self.parseForm({
579             'msg-1@content': 'asdf',
580             'msg-2@content': 'qwer',
581             '@link@messages': 'msg-1, msg-2'}),
582             ({('test', None): {},
583               ('msg', '-2'): {'content': 'qwer'},
584               ('msg', '-1'): {'content': 'asdf'}},
585              [('test', None, 'messages', [('msg', '-1'), ('msg', '-2')])]
586             )
587         )
589     def testLinkBadDesignator(self):
590         self.assertRaises(FormError, self.parseForm,
591             {'test-1@link@link': 'blah'})
592         self.assertRaises(FormError, self.parseForm,
593             {'test-1@link@link': 'issue'})
595     def testLinkNotLink(self):
596         self.assertRaises(FormError, self.parseForm,
597             {'test-1@link@boolean': 'issue-1'})
598         self.assertRaises(FormError, self.parseForm,
599             {'test-1@link@string': 'issue-1'})
601     def testBackwardsCompat(self):
602         res = self.parseForm({':note': 'spam'}, 'issue')
603         date = res[0][('msg', '-1')]['date']
604         self.assertEqual(res, ({('issue', None): {}, ('msg', '-1'):
605             {'content': 'spam', 'author': '1', 'date': date}},
606             [('issue', None, 'messages', [('msg', '-1')])]))
607         file = FileUpload('foo', 'foo.txt')
608         self.assertEqual(self.parseForm({':file': file}, 'issue'),
609             ({('issue', None): {}, ('file', '-1'): {'content': 'foo',
610             'name': 'foo.txt', 'type': 'text/plain'}},
611             [('issue', None, 'files', [('file', '-1')])]))
613     #
614     # SECURITY
615     #
616     # XXX test all default permissions
617     def _make_client(self, form, classname='user', nodeid='2', userid='2'):
618         cl = client.Client(self.instance, None, {'PATH_INFO':'/',
619             'REQUEST_METHOD':'POST'}, makeForm(form))
620         cl.classname = 'user'
621         cl.nodeid = '1'
622         cl.db = self.db
623         cl.userid = '2'
624         cl.language = ('en',)
625         return cl
627     def testClassPermission(self):
628         cl = self._make_client(dict(username='bob'))
629         self.failUnlessRaises(exceptions.Unauthorised,
630             actions.EditItemAction(cl).handle)
631         cl.nodeid = '1'
632         self.assertRaises(exceptions.Unauthorised,
633             actions.EditItemAction(cl).handle)
635     def testCheckAndPropertyPermission(self):
636         self.db.security.permissions = {}
637         def own_record(db, userid, itemid): return userid == itemid
638         p = self.db.security.addPermission(name='Edit', klass='user',
639             check=own_record, properties=("password", ))
640         self.db.security.addPermissionToRole('User', p)
642         cl = self._make_client(dict(username='bob'))
643         self.assertRaises(exceptions.Unauthorised,
644             actions.EditItemAction(cl).handle)
645         cl = self._make_client({'password':'bob', '@confirm@password':'bob'})
646         self.failUnlessRaises(exceptions.Unauthorised,
647             actions.EditItemAction(cl).handle)
649 def test_suite():
650     suite = unittest.TestSuite()
651     suite.addTest(unittest.makeSuite(FormTestCase))
652     suite.addTest(unittest.makeSuite(MessageTestCase))
653     return suite
655 if __name__ == '__main__':
656     runner = unittest.TextTestRunner()
657     unittest.main(testRunner=runner)
659 # vim: set filetype=python sts=4 sw=4 et si :