瀏覽代碼

HUE-7073 [backend] When user is login using LdapBackEnd, restrict certain characters from the Hue login name.

When LDAPBackEnd is used we would like to prevents '(', ')' and '*' as character in login name.

(cherry picked from commit df5b51fa1fdbb121db3e28dd9d0a50fc505b27d2)
Prakash Ranade 8 年之前
父節點
當前提交
94c9708
共有 2 個文件被更改,包括 11 次插入0 次删除
  1. 3 0
      desktop/core/src/desktop/auth/forms.py
  2. 8 0
      desktop/core/src/desktop/auth/views_test.py

+ 3 - 0
desktop/core/src/desktop/auth/forms.py

@@ -96,6 +96,9 @@ class LdapAuthenticationForm(AuthenticationForm):
     password = self.cleaned_data.get('password')
     server = self.cleaned_data.get('server')
 
+    if ('(' in username) or (')' in username) or ('*' in username):
+      raise ValidationError(self.error_messages['invalid_login'])
+
     if username and password:
       self.user_cache = authenticate(username=username,
                                      password=password,

+ 8 - 0
desktop/core/src/desktop/auth/views_test.py

@@ -194,6 +194,14 @@ class TestLdapLogin(PseudoHdfsTestBase):
     assert_equal(200, response.status_code, "Expected ok status.")
     assert_false(response.context['first_login_ever'])
 
+  def test_login_failure_for_bad_username(self):
+    response = self.c.get('/accounts/login/')
+    assert_equal(200, response.status_code, "Expected ok status.")
+
+    response = self.c.post('/accounts/login/', dict(username="test1*)(&(objectClass=*)", password="foo"))
+    assert_equal(200, response.status_code, "Expected ok status.")
+    assert_true('Invalid username or password' in response.content, response)
+
   def test_login_does_not_reset_groups(self):
     client = make_logged_in_client(username=self.test_username, password="test")