|
@@ -425,6 +425,8 @@ def test_desktop_permissions():
|
|
|
USERNAME = 'test_core_permissions'
|
|
USERNAME = 'test_core_permissions'
|
|
|
GROUPNAME = 'default'
|
|
GROUPNAME = 'default'
|
|
|
|
|
|
|
|
|
|
+ desktop.conf.REDIRECT_WHITELIST.set_for_testing('^\/.*$,^http:\/\/testserver\/.*$')
|
|
|
|
|
+
|
|
|
c = make_logged_in_client(USERNAME, groupname=GROUPNAME, recreate=True, is_superuser=False)
|
|
c = make_logged_in_client(USERNAME, groupname=GROUPNAME, recreate=True, is_superuser=False)
|
|
|
|
|
|
|
|
# Access to the basic works
|
|
# Access to the basic works
|
|
@@ -436,6 +438,7 @@ def test_desktop_permissions():
|
|
|
def test_app_permissions():
|
|
def test_app_permissions():
|
|
|
USERNAME = 'test_app_permissions'
|
|
USERNAME = 'test_app_permissions'
|
|
|
GROUPNAME = 'impala_only'
|
|
GROUPNAME = 'impala_only'
|
|
|
|
|
+ desktop.conf.REDIRECT_WHITELIST.set_for_testing('^\/.*$,^http:\/\/testserver\/.*$')
|
|
|
|
|
|
|
|
c = make_logged_in_client(USERNAME, groupname=GROUPNAME, recreate=True, is_superuser=False)
|
|
c = make_logged_in_client(USERNAME, groupname=GROUPNAME, recreate=True, is_superuser=False)
|
|
|
|
|
|
|
@@ -645,3 +648,34 @@ def test_cx_Oracle():
|
|
|
"env var ORACLE_HOME or ORACLE_INSTANTCLIENT_HOME is not defined. "
|
|
"env var ORACLE_HOME or ORACLE_INSTANTCLIENT_HOME is not defined. "
|
|
|
"So ignore this test failure if your build does not need to work "
|
|
"So ignore this test failure if your build does not need to work "
|
|
|
"with an oracle backend.")
|
|
"with an oracle backend.")
|
|
|
|
|
+
|
|
|
|
|
+class TestStrictRedirection():
|
|
|
|
|
+
|
|
|
|
|
+ def setUp(self):
|
|
|
|
|
+ self.client = make_logged_in_client()
|
|
|
|
|
+ self.user = dict(username="test", password="test")
|
|
|
|
|
+ desktop.conf.REDIRECT_WHITELIST.set_for_testing('^\/.*$,^http:\/\/testserver\/.*$')
|
|
|
|
|
+
|
|
|
|
|
+ def test_redirection_blocked(self):
|
|
|
|
|
+ # Redirection with code 301 should be handled properly
|
|
|
|
|
+ # Redirection with Status code 301 example reference: http://www.somacon.com/p145.php
|
|
|
|
|
+ self._test_redirection(redirection_url='http://www.somacon.com/color/html_css_table_border_styles.php',
|
|
|
|
|
+ expected_status_code=403)
|
|
|
|
|
+ # Redirection with code 302 should be handled properly
|
|
|
|
|
+ self._test_redirection(redirection_url='http://www.google.com',
|
|
|
|
|
+ expected_status_code=403)
|
|
|
|
|
+
|
|
|
|
|
+ def test_redirection_allowed(self):
|
|
|
|
|
+ # Redirection to the host where Hue is running should be OK.
|
|
|
|
|
+ self._test_redirection(redirection_url='/', expected_status_code=302)
|
|
|
|
|
+ self._test_redirection(redirection_url='/pig', expected_status_code=302)
|
|
|
|
|
+ self._test_redirection(redirection_url='http://testserver/', expected_status_code=302)
|
|
|
|
|
+
|
|
|
|
|
+ def _test_redirection(self, redirection_url, expected_status_code):
|
|
|
|
|
+ self.client.get('/accounts/logout')
|
|
|
|
|
+ response = self.client.post('/accounts/login/?next=' + redirection_url, self.user)
|
|
|
|
|
+ assert_equal(expected_status_code, response.status_code)
|
|
|
|
|
+ if expected_status_code == 403:
|
|
|
|
|
+ error_msg = 'Redirect to ' + redirection_url + ' is not allowed.'
|
|
|
|
|
+ assert_true(error_msg in response.content, response.content)
|
|
|
|
|
+
|