X-Git-Url: https://git.tokkee.org/?a=blobdiff_plain;f=test%2Ftest_cgi.py;h=2d63ed4c26df63cb442ecfdcc4dbd933ad219981;hb=226665abbc075767662d110ef87aaa7fc51f8297;hp=f56224592927ef29d49def0868fd9ca98d08082a;hpb=7a031eba12231ed54db48e24261acc97e8ea7b48;p=roundup.git diff --git a/test/test_cgi.py b/test/test_cgi.py index f562245..2d63ed4 100644 --- a/test/test_cgi.py +++ b/test/test_cgi.py @@ -8,41 +8,93 @@ # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. # -# $Id: test_cgi.py,v 1.4 2003-01-15 11:14:01 richard Exp $ +# $Id: test_cgi.py,v 1.36 2008-08-07 06:12:57 richard Exp $ -import unittest, os, shutil, errno, sys, difflib, cgi +import unittest, os, shutil, errno, sys, difflib, cgi, re, StringIO -from roundup.cgi import client -from roundup import init, instance, password +from roundup.cgi import client, actions, exceptions +from roundup.cgi.exceptions import FormError +from roundup.cgi.templating import HTMLItem, HTMLRequest +from roundup.cgi.form_parser import FormParser +from roundup import init, instance, password, hyperdb, date + +from mocknull import MockNull + +import db_test_base + +NEEDS_INSTANCE = 1 + +class FileUpload: + def __init__(self, content, filename): + self.content = content + self.filename = filename def makeForm(args): form = cgi.FieldStorage() for k,v in args.items(): if type(v) is type([]): [form.list.append(cgi.MiniFieldStorage(k, x)) for x in v] + elif isinstance(v, FileUpload): + x = cgi.MiniFieldStorage(k, v.content) + x.filename = v.filename + form.list.append(x) else: form.list.append(cgi.MiniFieldStorage(k, v)) return form +cm = client.clean_message +class MessageTestCase(unittest.TestCase): + def testCleanMessageOK(self): + self.assertEqual(cm('
x
'), '
x
') + self.assertEqual(cm('x'), 'x') + self.assertEqual(cm('x'), 'x') + self.assertEqual(cm('x'), + 'x') + self.assertEqual(cm('
x
'), '
x
') + self.assertEqual(cm('x'), 'x') + self.assertEqual(cm('x'), 'x') + self.assertEqual(cm('x'), + 'x') + + def testCleanMessageBAD(self): + self.assertEqual(cm(''), + '<script>x</script>') + self.assertEqual(cm(''), + '<iframe>x</iframe>') + class FormTestCase(unittest.TestCase): def setUp(self): self.dirname = '_test_cgi_form' - try: - shutil.rmtree(self.dirname) - except OSError, error: - if error.errno not in (errno.ENOENT, errno.ESRCH): raise - # create the instance - init.install(self.dirname, 'classic', 'anydbm') - init.initialise(self.dirname, 'sekrit') - # check we can load the package - self.instance = instance.open(self.dirname) - # and open the database + # set up and open a tracker + self.instance = db_test_base.setupTracker(self.dirname) + + # open the database self.db = self.instance.open('admin') self.db.user.create(username='Chef', address='chef@bork.bork.bork', realname='Bork, Chef', roles='User') - self.db.user.create(username='mary', address='mary@test', + self.db.user.create(username='mary', address='mary@test.test', roles='User', realname='Contrary, Mary') + test = self.instance.backend.Class(self.db, "test", + string=hyperdb.String(), number=hyperdb.Number(), + boolean=hyperdb.Boolean(), link=hyperdb.Link('test'), + multilink=hyperdb.Multilink('test'), date=hyperdb.Date(), + messages=hyperdb.Multilink('msg'), interval=hyperdb.Interval()) + + # compile the labels re + classes = '|'.join(self.db.classes.keys()) + self.FV_SPECIAL = re.compile(FormParser.FV_LABELS%classes, + re.VERBOSE) + + def parseForm(self, form, classname='test', nodeid=None): + cl = client.Client(self.instance, None, {'PATH_INFO':'/', + 'REQUEST_METHOD':'POST'}, makeForm(form)) + cl.classname = classname + cl.nodeid = nodeid + cl.language = ('en',) + cl.db = self.db + return cl.parsePropsFromForm(create=1) + def tearDown(self): self.db.close() try: @@ -50,157 +102,821 @@ class FormTestCase(unittest.TestCase): except OSError, error: if error.errno not in (errno.ENOENT, errno.ESRCH): raise + # + # form label extraction + # + def tl(self, s, c, i, a, p): + m = self.FV_SPECIAL.match(s) + self.assertNotEqual(m, None) + d = m.groupdict() + self.assertEqual(d['classname'], c) + self.assertEqual(d['id'], i) + for action in 'required add remove link note file'.split(): + if a == action: + self.assertNotEqual(d[action], None) + else: + self.assertEqual(d[action], None) + self.assertEqual(d['propname'], p) + + def testLabelMatching(self): + self.tl('', None, None, None, '') + self.tl(':required', None, None, 'required', None) + self.tl(':confirm:', None, None, 'confirm', '') + self.tl(':add:', None, None, 'add', '') + self.tl(':remove:', None, None, 'remove', '') + self.tl(':link:', None, None, 'link', '') + self.tl('test1:', 'test', '1', None, '') + self.tl('test1:required', 'test', '1', 'required', None) + self.tl('test1:add:', 'test', '1', 'add', '') + self.tl('test1:remove:', 'test', '1', 'remove', '') + self.tl('test1:link:', 'test', '1', 'link', '') + self.tl('test1:confirm:', 'test', '1', 'confirm', '') + self.tl('test-1:', 'test', '-1', None, '') + self.tl('test-1:required', 'test', '-1', 'required', None) + self.tl('test-1:add:', 'test', '-1', 'add', '') + self.tl('test-1:remove:', 'test', '-1', 'remove', '') + self.tl('test-1:link:', 'test', '-1', 'link', '') + self.tl('test-1:confirm:', 'test', '-1', 'confirm', '') + self.tl(':note', None, None, 'note', None) + self.tl(':file', None, None, 'file', None) + # # Empty form # def testNothing(self): - self.assertEqual(client.parsePropsFromForm(self.db, self.db.issue, - makeForm({})), {}) + self.assertEqual(self.parseForm({}), ({('test', None): {}}, [])) def testNothingWithRequired(self): - form = makeForm({':required': 'title'}) - self.assertRaises(ValueError, client.parsePropsFromForm, self.db, - self.db.issue, form) + self.assertRaises(FormError, self.parseForm, {':required': 'string'}) + self.assertRaises(FormError, self.parseForm, + {':required': 'title,status', 'status':'1'}, 'issue') + self.assertRaises(FormError, self.parseForm, + {':required': ['title','status'], 'status':'1'}, 'issue') + self.assertRaises(FormError, self.parseForm, + {':required': 'status', 'status':''}, 'issue') + self.assertRaises(FormError, self.parseForm, + {':required': 'nosy', 'nosy':''}, 'issue') + self.assertRaises(FormError, self.parseForm, + {':required': 'msg-1@content', 'msg-1@content':''}, 'issue') + self.assertRaises(FormError, self.parseForm, + {':required': 'msg-1@content'}, 'issue') + + # + # Nonexistant edit + # + def testEditNonexistant(self): + self.assertRaises(FormError, self.parseForm, {'boolean': ''}, + 'test', '1') # # String # def testEmptyString(self): - self.assertEqual(client.parsePropsFromForm(self.db, self.db.issue, - makeForm({'title': ''})), {}) - self.assertEqual(client.parsePropsFromForm(self.db, self.db.issue, - makeForm({'title': ' '})), {}) - self.assertRaises(ValueError, client.parsePropsFromForm, self.db, - self.db.issue, makeForm({'title': ['', '']})) + self.assertEqual(self.parseForm({'string': ''}), + ({('test', None): {}}, [])) + self.assertEqual(self.parseForm({'string': ' '}), + ({('test', None): {}}, [])) + self.assertRaises(FormError, self.parseForm, {'string': ['', '']}) def testSetString(self): - self.assertEqual(client.parsePropsFromForm(self.db, self.db.issue, - makeForm({'title': 'foo'})), {'title': 'foo'}) - self.assertEqual(client.parsePropsFromForm(self.db, self.db.issue, - makeForm({'title': 'a\r\nb\r\n'})), {'title': 'a\nb'}) + self.assertEqual(self.parseForm({'string': 'foo'}), + ({('test', None): {'string': 'foo'}}, [])) + self.assertEqual(self.parseForm({'string': 'a\r\nb\r\n'}), + ({('test', None): {'string': 'a\nb'}}, [])) + nodeid = self.db.issue.create(title='foo') + self.assertEqual(self.parseForm({'title': 'foo'}, 'issue', nodeid), + ({('issue', nodeid): {}}, [])) def testEmptyStringSet(self): nodeid = self.db.issue.create(title='foo') - self.assertEqual(client.parsePropsFromForm(self.db, self.db.issue, - makeForm({'title': ''}), nodeid), {'title': ''}) + self.assertEqual(self.parseForm({'title': ''}, 'issue', nodeid), + ({('issue', nodeid): {'title': None}}, [])) nodeid = self.db.issue.create(title='foo') - self.assertEqual(client.parsePropsFromForm(self.db, self.db.issue, - makeForm({'title': ' '}), nodeid), {'title': ''}) + self.assertEqual(self.parseForm({'title': ' '}, 'issue', nodeid), + ({('issue', nodeid): {'title': None}}, [])) + + def testStringLinkId(self): + self.db.status.set('1', name='2') + self.db.status.set('2', name='1') + issue = self.db.issue.create(title='i1-status1', status='1') + self.assertEqual(self.db.issue.get(issue,'status'),'1') + self.assertEqual(self.db.status.lookup('1'),'2') + self.assertEqual(self.db.status.lookup('2'),'1') + form = cgi.FieldStorage() + cl = client.Client(self.instance, None, {'PATH_INFO':'/'}, form) + cl.classname = 'issue' + cl.nodeid = issue + cl.db = self.db + cl.language = ('en',) + item = HTMLItem(cl, 'issue', issue) + self.assertEqual(item.status.id, '1') + self.assertEqual(item.status.name, '2') + + def testStringMultilinkId(self): + id = self.db.keyword.create(name='2') + self.assertEqual(id,'1') + id = self.db.keyword.create(name='1') + self.assertEqual(id,'2') + issue = self.db.issue.create(title='i1-status1', keyword=['1']) + self.assertEqual(self.db.issue.get(issue,'keyword'),['1']) + self.assertEqual(self.db.keyword.lookup('1'),'2') + self.assertEqual(self.db.keyword.lookup('2'),'1') + form = cgi.FieldStorage() + cl = client.Client(self.instance, None, {'PATH_INFO':'/'}, form) + cl.classname = 'issue' + cl.nodeid = issue + cl.db = self.db + cl.language = ('en',) + cl.userid = '1' + item = HTMLItem(cl, 'issue', issue) + for keyword in item.keyword: + self.assertEqual(keyword.id, '1') + self.assertEqual(keyword.name, '2') + + def testFileUpload(self): + file = FileUpload('foo', 'foo.txt') + self.assertEqual(self.parseForm({'content': file}, 'file'), + ({('file', None): {'content': 'foo', 'name': 'foo.txt', + 'type': 'text/plain'}}, [])) + + def testEditFileClassAttributes(self): + self.assertEqual(self.parseForm({'name': 'foo.txt', + 'type': 'application/octet-stream'}, + 'file'), + ({('file', None): {'name': 'foo.txt', + 'type': 'application/octet-stream'}},[])) + + # + # Link + # + def testEmptyLink(self): + self.assertEqual(self.parseForm({'link': ''}), + ({('test', None): {}}, [])) + self.assertEqual(self.parseForm({'link': ' '}), + ({('test', None): {}}, [])) + self.assertRaises(FormError, self.parseForm, {'link': ['', '']}) + self.assertEqual(self.parseForm({'link': '-1'}), + ({('test', None): {}}, [])) + + def testSetLink(self): + self.assertEqual(self.parseForm({'status': 'unread'}, 'issue'), + ({('issue', None): {'status': '1'}}, [])) + self.assertEqual(self.parseForm({'status': '1'}, 'issue'), + ({('issue', None): {'status': '1'}}, [])) + nodeid = self.db.issue.create(status='unread') + self.assertEqual(self.parseForm({'status': 'unread'}, 'issue', nodeid), + ({('issue', nodeid): {}}, [])) + + def testUnsetLink(self): + nodeid = self.db.issue.create(status='unread') + self.assertEqual(self.parseForm({'status': '-1'}, 'issue', nodeid), + ({('issue', nodeid): {'status': None}}, [])) + + def testInvalidLinkValue(self): +# XXX This is not the current behaviour - should we enforce this? +# self.assertRaises(IndexError, self.parseForm, +# {'status': '4'})) + self.assertRaises(FormError, self.parseForm, {'link': 'frozzle'}) + self.assertRaises(FormError, self.parseForm, {'status': 'frozzle'}, + 'issue') # # Multilink # def testEmptyMultilink(self): - self.assertEqual(client.parsePropsFromForm(self.db, self.db.issue, - makeForm({'nosy': ''})), {}) - self.assertEqual(client.parsePropsFromForm(self.db, self.db.issue, - makeForm({'nosy': ' '})), {}) + self.assertEqual(self.parseForm({'nosy': ''}), + ({('test', None): {}}, [])) + self.assertEqual(self.parseForm({'nosy': ' '}), + ({('test', None): {}}, [])) def testSetMultilink(self): - self.assertEqual(client.parsePropsFromForm(self.db, self.db.issue, - makeForm({'nosy': '1'})), {'nosy': ['1']}) - self.assertEqual(client.parsePropsFromForm(self.db, self.db.issue, - makeForm({'nosy': 'admin'})), {'nosy': ['1']}) - self.assertEqual(client.parsePropsFromForm(self.db, self.db.issue, - makeForm({'nosy': ['1','2']})), {'nosy': ['1','2']}) - self.assertEqual(client.parsePropsFromForm(self.db, self.db.issue, - makeForm({'nosy': '1,2'})), {'nosy': ['1','2']}) - self.assertEqual(client.parsePropsFromForm(self.db, self.db.issue, - makeForm({'nosy': 'admin,2'})), {'nosy': ['1','2']}) + self.assertEqual(self.parseForm({'nosy': '1'}, 'issue'), + ({('issue', None): {'nosy': ['1']}}, [])) + self.assertEqual(self.parseForm({'nosy': 'admin'}, 'issue'), + ({('issue', None): {'nosy': ['1']}}, [])) + self.assertEqual(self.parseForm({'nosy': ['1','2']}, 'issue'), + ({('issue', None): {'nosy': ['1','2']}}, [])) + self.assertEqual(self.parseForm({'nosy': '1,2'}, 'issue'), + ({('issue', None): {'nosy': ['1','2']}}, [])) + self.assertEqual(self.parseForm({'nosy': 'admin,2'}, 'issue'), + ({('issue', None): {'nosy': ['1','2']}}, [])) + + def testMixedMultilink(self): + form = cgi.FieldStorage() + form.list.append(cgi.MiniFieldStorage('nosy', '1,2')) + form.list.append(cgi.MiniFieldStorage('nosy', '3')) + cl = client.Client(self.instance, None, {'PATH_INFO':'/'}, form) + cl.classname = 'issue' + cl.nodeid = None + cl.db = self.db + cl.language = ('en',) + self.assertEqual(cl.parsePropsFromForm(create=1), + ({('issue', None): {'nosy': ['1','2', '3']}}, [])) def testEmptyMultilinkSet(self): nodeid = self.db.issue.create(nosy=['1','2']) - self.assertEqual(client.parsePropsFromForm(self.db, self.db.issue, - makeForm({'nosy': ''}), nodeid), {'nosy': []}) + self.assertEqual(self.parseForm({'nosy': ''}, 'issue', nodeid), + ({('issue', nodeid): {'nosy': []}}, [])) nodeid = self.db.issue.create(nosy=['1','2']) - self.assertEqual(client.parsePropsFromForm(self.db, self.db.issue, - makeForm({'nosy': ' '}), nodeid), {'nosy': []}) + self.assertEqual(self.parseForm({'nosy': ' '}, 'issue', nodeid), + ({('issue', nodeid): {'nosy': []}}, [])) + self.assertEqual(self.parseForm({'nosy': '1,2'}, 'issue', nodeid), + ({('issue', nodeid): {}}, [])) def testInvalidMultilinkValue(self): # XXX This is not the current behaviour - should we enforce this? -# self.assertRaises(IndexError, client.parsePropsFromForm, self.db, -# self.db.issue, makeForm({'nosy': '4'})) - self.assertRaises(ValueError, client.parsePropsFromForm, self.db, - self.db.issue, makeForm({'nosy': 'frozzle'})) - self.assertRaises(ValueError, client.parsePropsFromForm, self.db, - self.db.issue, makeForm({'nosy': '1,frozzle'})) -# XXX need a test for the TypeError (where the ML class doesn't define a key +# self.assertRaises(IndexError, self.parseForm, +# {'nosy': '4'})) + self.assertRaises(FormError, self.parseForm, {'nosy': 'frozzle'}, + 'issue') + self.assertRaises(FormError, self.parseForm, {'nosy': '1,frozzle'}, + 'issue') + self.assertRaises(FormError, self.parseForm, {'multilink': 'frozzle'}) def testMultilinkAdd(self): nodeid = self.db.issue.create(nosy=['1']) # do nothing - self.assertEqual(client.parsePropsFromForm(self.db, self.db.issue, - makeForm({':add:nosy': ''}), nodeid), {}) + self.assertEqual(self.parseForm({':add:nosy': ''}, 'issue', nodeid), + ({('issue', nodeid): {}}, [])) # do something ;) - self.assertEqual(client.parsePropsFromForm(self.db, self.db.issue, - makeForm({':add:nosy': '2'}), nodeid), {'nosy': ['1','2']}) - self.assertEqual(client.parsePropsFromForm(self.db, self.db.issue, - makeForm({':add:nosy': '2,mary'}), nodeid), {'nosy': ['1','2','4']}) - self.assertEqual(client.parsePropsFromForm(self.db, self.db.issue, - makeForm({':add:nosy': ['2','3']}), nodeid), {'nosy': ['1','2','3']}) + self.assertEqual(self.parseForm({':add:nosy': '2'}, 'issue', nodeid), + ({('issue', nodeid): {'nosy': ['1','2']}}, [])) + self.assertEqual(self.parseForm({':add:nosy': '2,mary'}, 'issue', + nodeid), ({('issue', nodeid): {'nosy': ['1','2','4']}}, [])) + self.assertEqual(self.parseForm({':add:nosy': ['2','3']}, 'issue', + nodeid), ({('issue', nodeid): {'nosy': ['1','2','3']}}, [])) def testMultilinkAddNew(self): - self.assertEqual(client.parsePropsFromForm(self.db, self.db.issue, - makeForm({':add:nosy': ['2','3']})), {'nosy': ['2','3']}) + self.assertEqual(self.parseForm({':add:nosy': ['2','3']}, 'issue'), + ({('issue', None): {'nosy': ['2','3']}}, [])) def testMultilinkRemove(self): nodeid = self.db.issue.create(nosy=['1','2']) # do nothing - self.assertEqual(client.parsePropsFromForm(self.db, self.db.issue, - makeForm({':remove:nosy': ''}), nodeid), {}) + self.assertEqual(self.parseForm({':remove:nosy': ''}, 'issue', nodeid), + ({('issue', nodeid): {}}, [])) # do something ;) - self.assertEqual(client.parsePropsFromForm(self.db, self.db.issue, - makeForm({':remove:nosy': '1'}), nodeid), {'nosy': ['2']}) - self.assertEqual(client.parsePropsFromForm(self.db, self.db.issue, - makeForm({':remove:nosy': 'admin,2'}), nodeid), {'nosy': []}) - self.assertEqual(client.parsePropsFromForm(self.db, self.db.issue, - makeForm({':remove:nosy': ['1','2']}), nodeid), {'nosy': []}) + self.assertEqual(self.parseForm({':remove:nosy': '1'}, 'issue', + nodeid), ({('issue', nodeid): {'nosy': ['2']}}, [])) + self.assertEqual(self.parseForm({':remove:nosy': 'admin,2'}, + 'issue', nodeid), ({('issue', nodeid): {'nosy': []}}, [])) + self.assertEqual(self.parseForm({':remove:nosy': ['1','2']}, + 'issue', nodeid), ({('issue', nodeid): {'nosy': []}}, [])) + + # add and remove + self.assertEqual(self.parseForm({':add:nosy': ['3'], + ':remove:nosy': ['1','2']}, + 'issue', nodeid), ({('issue', nodeid): {'nosy': ['3']}}, [])) # remove one that doesn't exist? - self.assertRaises(ValueError, client.parsePropsFromForm, self.db, - self.db.issue, makeForm({':remove:nosy': '4'}), nodeid) + self.assertRaises(FormError, self.parseForm, {':remove:nosy': '4'}, + 'issue', nodeid) + + def testMultilinkRetired(self): + self.db.user.retire('2') + self.assertEqual(self.parseForm({'nosy': ['2','3']}, 'issue'), + ({('issue', None): {'nosy': ['2','3']}}, [])) + nodeid = self.db.issue.create(nosy=['1','2']) + self.assertEqual(self.parseForm({':remove:nosy': '2'}, 'issue', + nodeid), ({('issue', nodeid): {'nosy': ['1']}}, [])) + self.assertEqual(self.parseForm({':add:nosy': '3'}, 'issue', nodeid), + ({('issue', nodeid): {'nosy': ['1','2','3']}}, [])) + + def testAddRemoveNonexistant(self): + self.assertRaises(FormError, self.parseForm, {':remove:foo': '2'}, + 'issue') + self.assertRaises(FormError, self.parseForm, {':add:foo': '2'}, + 'issue') # # Password # def testEmptyPassword(self): - self.assertEqual(client.parsePropsFromForm(self.db, self.db.user, - makeForm({'password': ''})), {}) - self.assertEqual(client.parsePropsFromForm(self.db, self.db.user, - makeForm({'password': ''})), {}) - self.assertRaises(ValueError, client.parsePropsFromForm, self.db, - self.db.user, makeForm({'password': ['', '']})) - self.assertRaises(ValueError, client.parsePropsFromForm, self.db, - self.db.user, makeForm({'password': 'foo', - 'password:confirm': ['', '']})) + self.assertEqual(self.parseForm({'password': ''}, 'user'), + ({('user', None): {}}, [])) + self.assertEqual(self.parseForm({'password': ''}, 'user'), + ({('user', None): {}}, [])) + self.assertRaises(FormError, self.parseForm, {'password': ['', '']}, + 'user') + self.assertRaises(FormError, self.parseForm, {'password': 'foo', + ':confirm:password': ['', '']}, 'user') def testSetPassword(self): - self.assertEqual(client.parsePropsFromForm(self.db, self.db.user, - makeForm({'password': 'foo', 'password:confirm': 'foo'})), - {'password': 'foo'}) + self.assertEqual(self.parseForm({'password': 'foo', + ':confirm:password': 'foo'}, 'user'), + ({('user', None): {'password': 'foo'}}, [])) def testSetPasswordConfirmBad(self): - self.assertRaises(ValueError, client.parsePropsFromForm, self.db, - self.db.user, makeForm({'password': 'foo'})) - self.assertRaises(ValueError, client.parsePropsFromForm, self.db, - self.db.user, makeForm({'password': 'foo', - 'password:confirm': 'bar'})) + self.assertRaises(FormError, self.parseForm, {'password': 'foo'}, + 'user') + self.assertRaises(FormError, self.parseForm, {'password': 'foo', + ':confirm:password': 'bar'}, 'user') + + def testEmptyPasswordNotSet(self): + nodeid = self.db.user.create(username='1', + password=password.Password('foo')) + self.assertEqual(self.parseForm({'password': ''}, 'user', nodeid), + ({('user', nodeid): {}}, [])) + nodeid = self.db.user.create(username='2', + password=password.Password('foo')) + self.assertEqual(self.parseForm({'password': '', + ':confirm:password': ''}, 'user', nodeid), + ({('user', nodeid): {}}, [])) + + def testPasswordMigration(self): + chef = self.db.user.lookup('Chef') + form = dict(__login_name='Chef', __login_password='foo') + cl = self._make_client(form) + # assume that the "best" algorithm is the first one and doesn't + # need migration, all others should be migrated. + for scheme in password.Password.deprecated_schemes: + pw1 = password.Password('foo', scheme=scheme) + self.assertEqual(pw1.needs_migration(), True) + self.db.user.set(chef, password=pw1) + self.db.commit() + actions.LoginAction(cl).handle() + pw = self.db.user.get(chef, 'password') + self.assertEqual(pw, 'foo') + self.assertEqual(pw.needs_migration(), False) + pw1 = pw + self.assertEqual(pw1.needs_migration(), False) + scheme = password.Password.known_schemes[0] + self.assertEqual(scheme, pw1.scheme) + actions.LoginAction(cl).handle() + pw = self.db.user.get(chef, 'password') + self.assertEqual(pw, 'foo') + self.assertEqual(pw, pw1) + + # + # Boolean + # + def testEmptyBoolean(self): + self.assertEqual(self.parseForm({'boolean': ''}), + ({('test', None): {}}, [])) + self.assertEqual(self.parseForm({'boolean': ' '}), + ({('test', None): {}}, [])) + self.assertRaises(FormError, self.parseForm, {'boolean': ['', '']}) + + def testSetBoolean(self): + self.assertEqual(self.parseForm({'boolean': 'yes'}), + ({('test', None): {'boolean': 1}}, [])) + self.assertEqual(self.parseForm({'boolean': 'a\r\nb\r\n'}), + ({('test', None): {'boolean': 0}}, [])) + nodeid = self.db.test.create(boolean=1) + self.assertEqual(self.parseForm({'boolean': 'yes'}, 'test', nodeid), + ({('test', nodeid): {}}, [])) + nodeid = self.db.test.create(boolean=0) + self.assertEqual(self.parseForm({'boolean': 'no'}, 'test', nodeid), + ({('test', nodeid): {}}, [])) + + def testEmptyBooleanSet(self): + nodeid = self.db.test.create(boolean=0) + self.assertEqual(self.parseForm({'boolean': ''}, 'test', nodeid), + ({('test', nodeid): {'boolean': None}}, [])) + nodeid = self.db.test.create(boolean=1) + self.assertEqual(self.parseForm({'boolean': ' '}, 'test', nodeid), + ({('test', nodeid): {'boolean': None}}, [])) + + def testRequiredBoolean(self): + self.assertRaises(FormError, self.parseForm, {'boolean': '', + ':required': 'boolean'}) + try: + self.parseForm({'boolean': 'no', ':required': 'boolean'}) + except FormError: + self.fail('boolean "no" raised "required missing"') + + # + # Number + # + def testEmptyNumber(self): + self.assertEqual(self.parseForm({'number': ''}), + ({('test', None): {}}, [])) + self.assertEqual(self.parseForm({'number': ' '}), + ({('test', None): {}}, [])) + self.assertRaises(FormError, self.parseForm, {'number': ['', '']}) + + def testInvalidNumber(self): + self.assertRaises(FormError, self.parseForm, {'number': 'hi, mum!'}) + + def testSetNumber(self): + self.assertEqual(self.parseForm({'number': '1'}), + ({('test', None): {'number': 1}}, [])) + self.assertEqual(self.parseForm({'number': '0'}), + ({('test', None): {'number': 0}}, [])) + self.assertEqual(self.parseForm({'number': '\n0\n'}), + ({('test', None): {'number': 0}}, [])) + + def testSetNumberReplaceOne(self): + nodeid = self.db.test.create(number=1) + self.assertEqual(self.parseForm({'number': '1'}, 'test', nodeid), + ({('test', nodeid): {}}, [])) + self.assertEqual(self.parseForm({'number': '0'}, 'test', nodeid), + ({('test', nodeid): {'number': 0}}, [])) + + def testSetNumberReplaceZero(self): + nodeid = self.db.test.create(number=0) + self.assertEqual(self.parseForm({'number': '0'}, 'test', nodeid), + ({('test', nodeid): {}}, [])) + + def testSetNumberReplaceNone(self): + nodeid = self.db.test.create() + self.assertEqual(self.parseForm({'number': '0'}, 'test', nodeid), + ({('test', nodeid): {'number': 0}}, [])) + self.assertEqual(self.parseForm({'number': '1'}, 'test', nodeid), + ({('test', nodeid): {'number': 1}}, [])) + + def testEmptyNumberSet(self): + nodeid = self.db.test.create(number=0) + self.assertEqual(self.parseForm({'number': ''}, 'test', nodeid), + ({('test', nodeid): {'number': None}}, [])) + nodeid = self.db.test.create(number=1) + self.assertEqual(self.parseForm({'number': ' '}, 'test', nodeid), + ({('test', nodeid): {'number': None}}, [])) + + def testRequiredNumber(self): + self.assertRaises(FormError, self.parseForm, {'number': '', + ':required': 'number'}) + try: + self.parseForm({'number': '0', ':required': 'number'}) + except FormError: + self.fail('number "no" raised "required missing"') + + # + # Date + # + def testEmptyDate(self): + self.assertEqual(self.parseForm({'date': ''}), + ({('test', None): {}}, [])) + self.assertEqual(self.parseForm({'date': ' '}), + ({('test', None): {}}, [])) + self.assertRaises(FormError, self.parseForm, {'date': ['', '']}) + + def testInvalidDate(self): + self.assertRaises(FormError, self.parseForm, {'date': '12'}) + + def testSetDate(self): + self.assertEqual(self.parseForm({'date': '2003-01-01'}), + ({('test', None): {'date': date.Date('2003-01-01')}}, [])) + nodeid = self.db.test.create(date=date.Date('2003-01-01')) + self.assertEqual(self.parseForm({'date': '2003-01-01'}, 'test', + nodeid), ({('test', nodeid): {}}, [])) + + def testEmptyDateSet(self): + nodeid = self.db.test.create(date=date.Date('.')) + self.assertEqual(self.parseForm({'date': ''}, 'test', nodeid), + ({('test', nodeid): {'date': None}}, [])) + nodeid = self.db.test.create(date=date.Date('1970-01-01.00:00:00')) + self.assertEqual(self.parseForm({'date': ' '}, 'test', nodeid), + ({('test', nodeid): {'date': None}}, [])) + + # + # Test multiple items in form + # + def testMultiple(self): + self.assertEqual(self.parseForm({'string': 'a', 'issue-1@title': 'b'}), + ({('test', None): {'string': 'a'}, + ('issue', '-1'): {'title': 'b'} + }, [])) + + def testMultipleExistingContext(self): + nodeid = self.db.test.create() + self.assertEqual(self.parseForm({'string': 'a', 'issue-1@title': 'b'}, + 'test', nodeid),({('test', nodeid): {'string': 'a'}, + ('issue', '-1'): {'title': 'b'}}, [])) + + def testLinking(self): + self.assertEqual(self.parseForm({ + 'string': 'a', + 'issue-1@add@nosy': '1', + 'issue-2@link@superseder': 'issue-1', + }), + ({('test', None): {'string': 'a'}, + ('issue', '-1'): {'nosy': ['1']}, + }, + [('issue', '-2', 'superseder', [('issue', '-1')]) + ] + ) + ) + + def testMessages(self): + self.assertEqual(self.parseForm({ + 'msg-1@content': 'asdf', + 'msg-2@content': 'qwer', + '@link@messages': 'msg-1, msg-2'}), + ({('test', None): {}, + ('msg', '-2'): {'content': 'qwer'}, + ('msg', '-1'): {'content': 'asdf'}}, + [('test', None, 'messages', [('msg', '-1'), ('msg', '-2')])] + ) + ) + + def testLinkBadDesignator(self): + self.assertRaises(FormError, self.parseForm, + {'test-1@link@link': 'blah'}) + self.assertRaises(FormError, self.parseForm, + {'test-1@link@link': 'issue'}) + + def testLinkNotLink(self): + self.assertRaises(FormError, self.parseForm, + {'test-1@link@boolean': 'issue-1'}) + self.assertRaises(FormError, self.parseForm, + {'test-1@link@string': 'issue-1'}) + + def testBackwardsCompat(self): + res = self.parseForm({':note': 'spam'}, 'issue') + date = res[0][('msg', '-1')]['date'] + self.assertEqual(res, ({('issue', None): {}, ('msg', '-1'): + {'content': 'spam', 'author': '1', 'date': date}}, + [('issue', None, 'messages', [('msg', '-1')])])) + file = FileUpload('foo', 'foo.txt') + self.assertEqual(self.parseForm({':file': file}, 'issue'), + ({('issue', None): {}, ('file', '-1'): {'content': 'foo', + 'name': 'foo.txt', 'type': 'text/plain'}}, + [('issue', None, 'files', [('file', '-1')])])) + + # + # SECURITY + # + # XXX test all default permissions + def _make_client(self, form, classname='user', nodeid='1', + userid='2', template='item'): + cl = client.Client(self.instance, None, {'PATH_INFO':'/', + 'REQUEST_METHOD':'POST'}, makeForm(form)) + cl.classname = classname + if nodeid is not None: + cl.nodeid = nodeid + cl.db = self.db + cl.userid = userid + cl.language = ('en',) + cl.error_message = [] + cl.template = template + return cl + + def testClassPermission(self): + cl = self._make_client(dict(username='bob')) + self.failUnlessRaises(exceptions.Unauthorised, + actions.EditItemAction(cl).handle) + cl.nodeid = '1' + self.assertRaises(exceptions.Unauthorised, + actions.EditItemAction(cl).handle) + + def testCheckAndPropertyPermission(self): + self.db.security.permissions = {} + def own_record(db, userid, itemid): + return userid == itemid + p = self.db.security.addPermission(name='Edit', klass='user', + check=own_record, properties=("password", )) + self.db.security.addPermissionToRole('User', p) + + cl = self._make_client(dict(username='bob')) + self.assertRaises(exceptions.Unauthorised, + actions.EditItemAction(cl).handle) + cl = self._make_client(dict(roles='User,Admin'), userid='4', nodeid='4') + self.assertRaises(exceptions.Unauthorised, + actions.EditItemAction(cl).handle) + cl = self._make_client(dict(roles='User,Admin'), userid='4') + self.assertRaises(exceptions.Unauthorised, + actions.EditItemAction(cl).handle) + cl = self._make_client(dict(roles='User,Admin')) + self.assertRaises(exceptions.Unauthorised, + actions.EditItemAction(cl).handle) + # working example, mary may change her pw + cl = self._make_client({'password':'ob', '@confirm@password':'ob'}, + nodeid='4', userid='4') + self.assertRaises(exceptions.Redirect, + actions.EditItemAction(cl).handle) + cl = self._make_client({'password':'bob', '@confirm@password':'bob'}) + self.failUnlessRaises(exceptions.Unauthorised, + actions.EditItemAction(cl).handle) + + def testCreatePermission(self): + # this checks if we properly differentiate between create and + # edit permissions + self.db.security.permissions = {} + self.db.security.addRole(name='UserAdd') + # Don't allow roles + p = self.db.security.addPermission(name='Create', klass='user', + properties=("username", "password", "address", + "alternate_address", "realname", "phone", "organisation", + "timezone")) + self.db.security.addPermissionToRole('UserAdd', p) + # Don't allow roles *and* don't allow username + p = self.db.security.addPermission(name='Edit', klass='user', + properties=("password", "address", "alternate_address", + "realname", "phone", "organisation", "timezone")) + self.db.security.addPermissionToRole('UserAdd', p) + self.db.user.set('4', roles='UserAdd') + + # anonymous may not + cl = self._make_client({'username':'new_user', 'password':'secret', + '@confirm@password':'secret', 'address':'new_user@bork.bork', + 'roles':'Admin'}, nodeid=None, userid='2') + self.assertRaises(exceptions.Unauthorised, + actions.NewItemAction(cl).handle) + # Don't allow creating new user with roles + cl = self._make_client({'username':'new_user', 'password':'secret', + '@confirm@password':'secret', 'address':'new_user@bork.bork', + 'roles':'Admin'}, nodeid=None, userid='4') + self.assertRaises(exceptions.Unauthorised, + actions.NewItemAction(cl).handle) + self.assertEqual(cl.error_message,[]) + # this should work + cl = self._make_client({'username':'new_user', 'password':'secret', + '@confirm@password':'secret', 'address':'new_user@bork.bork'}, + nodeid=None, userid='4') + self.assertRaises(exceptions.Redirect, + actions.NewItemAction(cl).handle) + self.assertEqual(cl.error_message,[]) + # don't allow changing (my own) username (in this example) + cl = self._make_client(dict(username='new_user42'), userid='4') + self.assertRaises(exceptions.Unauthorised, + actions.EditItemAction(cl).handle) + cl = self._make_client(dict(username='new_user42'), userid='4', + nodeid='4') + self.assertRaises(exceptions.Unauthorised, + actions.EditItemAction(cl).handle) + # don't allow changing (my own) roles + cl = self._make_client(dict(roles='User,Admin'), userid='4', + nodeid='4') + self.assertRaises(exceptions.Unauthorised, + actions.EditItemAction(cl).handle) + cl = self._make_client(dict(roles='User,Admin'), userid='4') + self.assertRaises(exceptions.Unauthorised, + actions.EditItemAction(cl).handle) + cl = self._make_client(dict(roles='User,Admin')) + self.assertRaises(exceptions.Unauthorised, + actions.EditItemAction(cl).handle) + + def testSearchPermission(self): + # this checks if we properly check for search permissions + self.db.security.permissions = {} + self.db.security.addRole(name='User') + self.db.security.addRole(name='Project') + self.db.security.addPermissionToRole('User', 'Web Access') + self.db.security.addPermissionToRole('Project', 'Web Access') + # Allow viewing department + p = self.db.security.addPermission(name='View', klass='department') + self.db.security.addPermissionToRole('User', p) + # Allow viewing interesting things (but not department) on iss + # But users might only view issues where they are on nosy + # (so in the real world the check method would be better) + p = self.db.security.addPermission(name='View', klass='iss', + properties=("title", "status"), check=lambda x,y,z: True) + self.db.security.addPermissionToRole('User', p) + # Allow all relevant roles access to stat + p = self.db.security.addPermission(name='View', klass='stat') + self.db.security.addPermissionToRole('User', p) + self.db.security.addPermissionToRole('Project', p) + # Allow role "Project" access to whole iss + p = self.db.security.addPermission(name='View', klass='iss') + self.db.security.addPermissionToRole('Project', p) + + department = self.instance.backend.Class(self.db, "department", + name=hyperdb.String()) + status = self.instance.backend.Class(self.db, "stat", + name=hyperdb.String()) + issue = self.instance.backend.Class(self.db, "iss", + title=hyperdb.String(), status=hyperdb.Link('stat'), + department=hyperdb.Link('department')) + + d1 = department.create(name='d1') + d2 = department.create(name='d2') + open = status.create(name='open') + closed = status.create(name='closed') + issue.create(title='i1', status=open, department=d2) + issue.create(title='i2', status=open, department=d1) + issue.create(title='i2', status=closed, department=d1) + + chef = self.db.user.lookup('Chef') + mary = self.db.user.lookup('mary') + self.db.user.set(chef, roles = 'User, Project') + + perm = self.db.security.hasPermission + search = self.db.security.hasSearchPermission + self.assert_(perm('View', chef, 'iss', 'department', '1')) + self.assert_(perm('View', chef, 'iss', 'department', '2')) + self.assert_(perm('View', chef, 'iss', 'department', '3')) + self.assert_(search(chef, 'iss', 'department')) + + self.assert_(not perm('View', mary, 'iss', 'department')) + self.assert_(perm('View', mary, 'iss', 'status')) + # Conditionally allow view of whole iss (check is False here, + # this might check for department owner in the real world) + p = self.db.security.addPermission(name='View', klass='iss', + check=lambda x,y,z: False) + self.db.security.addPermissionToRole('User', p) + self.assert_(perm('View', mary, 'iss', 'department')) + self.assert_(not perm('View', mary, 'iss', 'department', '1')) + self.assert_(not search(mary, 'iss', 'department')) + + self.assert_(perm('View', mary, 'iss', 'status')) + self.assert_(not search(mary, 'iss', 'status')) + # Allow user to search for iss.status + p = self.db.security.addPermission(name='Search', klass='iss', + properties=("status",)) + self.db.security.addPermissionToRole('User', p) + self.assert_(search(mary, 'iss', 'status')) + + dep = {'@action':'search','columns':'id','@filter':'department', + 'department':'1'} + stat = {'@action':'search','columns':'id','@filter':'status', + 'status':'1'} + depsort = {'@action':'search','columns':'id','@sort':'department'} + depgrp = {'@action':'search','columns':'id','@group':'department'} + + # Filter on department ignored for role 'User': + cl = self._make_client(dep, classname='iss', nodeid=None, userid=mary, + template='index') + h = HTMLRequest(cl) + self.assertEqual([x.id for x in h.batch()],['1', '2', '3']) + # Filter on department works for role 'Project': + cl = self._make_client(dep, classname='iss', nodeid=None, userid=chef, + template='index') + h = HTMLRequest(cl) + self.assertEqual([x.id for x in h.batch()],['2', '3']) + # Filter on status works for all: + cl = self._make_client(stat, classname='iss', nodeid=None, userid=mary, + template='index') + h = HTMLRequest(cl) + self.assertEqual([x.id for x in h.batch()],['1', '2']) + cl = self._make_client(stat, classname='iss', nodeid=None, userid=chef, + template='index') + h = HTMLRequest(cl) + self.assertEqual([x.id for x in h.batch()],['1', '2']) + # Sorting and grouping for class Project works: + cl = self._make_client(depsort, classname='iss', nodeid=None, + userid=chef, template='index') + h = HTMLRequest(cl) + self.assertEqual([x.id for x in h.batch()],['2', '3', '1']) + cl = self._make_client(depgrp, classname='iss', nodeid=None, + userid=chef, template='index') + h = HTMLRequest(cl) + self.assertEqual([x.id for x in h.batch()],['2', '3', '1']) + # Sorting and grouping for class User fails: + cl = self._make_client(depsort, classname='iss', nodeid=None, + userid=mary, template='index') + h = HTMLRequest(cl) + self.assertEqual([x.id for x in h.batch()],['1', '2', '3']) + cl = self._make_client(depgrp, classname='iss', nodeid=None, + userid=mary, template='index') + h = HTMLRequest(cl) + self.assertEqual([x.id for x in h.batch()],['1', '2', '3']) + + def testRoles(self): + cl = self._make_client({}) + self.db.user.set('1', roles='aDmin, uSer') + item = HTMLItem(cl, 'user', '1') + self.assert_(item.hasRole('Admin')) + self.assert_(item.hasRole('User')) + self.assert_(item.hasRole('AdmiN')) + self.assert_(item.hasRole('UseR')) + self.assert_(item.hasRole('UseR','Admin')) + self.assert_(item.hasRole('UseR','somethingelse')) + self.assert_(item.hasRole('somethingelse','Admin')) + self.assert_(not item.hasRole('userr')) + self.assert_(not item.hasRole('adminn')) + self.assert_(not item.hasRole('')) + self.assert_(not item.hasRole(' ')) + self.db.user.set('1', roles='') + self.assert_(not item.hasRole('')) + + def testCSVExport(self): + cl = self._make_client({'@columns': 'id,name'}, nodeid=None, + userid='1') + cl.classname = 'status' + output = StringIO.StringIO() + cl.request = MockNull() + cl.request.wfile = output + actions.ExportCSVAction(cl).handle() + self.assertEquals('id,name\r\n1,unread\r\n2,deferred\r\n3,chatting\r\n' + '4,need-eg\r\n5,in-progress\r\n6,testing\r\n7,done-cbb\r\n' + '8,resolved\r\n', + output.getvalue()) + + def testCSVExportFailPermission(self): + cl = self._make_client({'@columns': 'id,email,password'}, nodeid=None, + userid='2') + cl.classname = 'user' + output = StringIO.StringIO() + cl.request = MockNull() + cl.request.wfile = output + self.assertRaises(exceptions.Unauthorised, + actions.ExportCSVAction(cl).handle) - def testEmptyPasswordNOTSet(self): - nodeid = self.db.user.create(username='1', password=password.Password('foo')) - self.assertEqual(client.parsePropsFromForm(self.db, self.db.user, - makeForm({'password': ''}), nodeid), {}) - nodeid = self.db.user.create(username='2', password=password.Password('foo')) - self.assertEqual(client.parsePropsFromForm(self.db, self.db.user, - makeForm({'password': '', 'password:confirm': ''}), nodeid), {}) +def test_suite(): + suite = unittest.TestSuite() -def suite(): - l = [unittest.makeSuite(FormTestCase), - ] - return unittest.TestSuite(l) +def test_suite(): + suite = unittest.TestSuite() + suite.addTest(unittest.makeSuite(FormTestCase)) + suite.addTest(unittest.makeSuite(MessageTestCase)) + return suite +if __name__ == '__main__': + runner = unittest.TextTestRunner() + unittest.main(testRunner=runner) -# vim: set filetype=python ts=4 sw=4 et si +# vim: set filetype=python sts=4 sw=4 et si :