author | Sylvain Thénault <sylvain.thenault@logilab.fr> |
Mon, 21 Sep 2009 11:42:09 +0200 | |
branch | stable |
changeset 3336 | d77aa97f95f9 |
parent 3252 | c0e10da6f1cf |
child 3293 | 69c0ba095536 |
child 3877 | 7ca53fc72a0a |
permissions | -rw-r--r-- |
0 | 1 |
"""functional tests for server'security |
1977
606923dff11b
big bunch of copyright / docstring update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
1802
diff
changeset
|
2 |
:license: GNU Lesser General Public License, v2.1 - http://www.gnu.org/licenses |
0 | 3 |
""" |
4 |
import sys |
|
5 |
||
6 |
from logilab.common.testlib import unittest_main, TestCase |
|
7 |
from cubicweb.devtools.apptest import RepositoryBasedTC |
|
8 |
||
9 |
from cubicweb import Unauthorized, ValidationError |
|
10 |
from cubicweb.server.querier import check_read_access |
|
11 |
||
12 |
class BaseSecurityTC(RepositoryBasedTC): |
|
13 |
||
14 |
def setUp(self): |
|
15 |
RepositoryBasedTC.setUp(self) |
|
16 |
self.create_user('iaminusersgrouponly') |
|
17 |
self.readoriggroups = self.schema['Personne'].get_groups('read') |
|
18 |
self.addoriggroups = self.schema['Personne'].get_groups('add') |
|
1802
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
1398
diff
changeset
|
19 |
|
0 | 20 |
def tearDown(self): |
21 |
RepositoryBasedTC.tearDown(self) |
|
22 |
self.schema['Personne'].set_groups('read', self.readoriggroups) |
|
23 |
self.schema['Personne'].set_groups('add', self.addoriggroups) |
|
24 |
||
1802
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
1398
diff
changeset
|
25 |
|
0 | 26 |
class LowLevelSecurityFunctionTC(BaseSecurityTC): |
1802
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
1398
diff
changeset
|
27 |
|
0 | 28 |
def test_check_read_access(self): |
29 |
rql = u'Personne U where U nom "managers"' |
|
3252
c0e10da6f1cf
tests update
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2920
diff
changeset
|
30 |
rqlst = self.repo.vreg.rqlhelper.parse(rql).children[0] |
0 | 31 |
origgroups = self.schema['Personne'].get_groups('read') |
32 |
self.schema['Personne'].set_groups('read', ('users', 'managers')) |
|
3252
c0e10da6f1cf
tests update
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2920
diff
changeset
|
33 |
self.repo.vreg.rqlhelper.compute_solutions(rqlst) |
0 | 34 |
solution = rqlst.solutions[0] |
35 |
check_read_access(self.schema, self.session.user, rqlst, solution) |
|
36 |
cnx = self.login('anon') |
|
37 |
cu = cnx.cursor() |
|
38 |
self.assertRaises(Unauthorized, |
|
39 |
check_read_access, |
|
40 |
self.schema, cnx.user(self.current_session()), rqlst, solution) |
|
41 |
self.assertRaises(Unauthorized, cu.execute, rql) |
|
1802
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
1398
diff
changeset
|
42 |
|
0 | 43 |
def test_upassword_not_selectable(self): |
44 |
self.assertRaises(Unauthorized, |
|
1398
5fe84a5f7035
rename internal entity types to have CW prefix instead of E
sylvain.thenault@logilab.fr
parents:
389
diff
changeset
|
45 |
self.execute, 'Any X,P WHERE X is CWUser, X upassword P') |
0 | 46 |
self.rollback() |
47 |
cnx = self.login('iaminusersgrouponly') |
|
48 |
cu = cnx.cursor() |
|
49 |
self.assertRaises(Unauthorized, |
|
1398
5fe84a5f7035
rename internal entity types to have CW prefix instead of E
sylvain.thenault@logilab.fr
parents:
389
diff
changeset
|
50 |
cu.execute, 'Any X,P WHERE X is CWUser, X upassword P') |
1802
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
1398
diff
changeset
|
51 |
|
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
1398
diff
changeset
|
52 |
|
0 | 53 |
class SecurityTC(BaseSecurityTC): |
1802
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
1398
diff
changeset
|
54 |
|
0 | 55 |
def setUp(self): |
56 |
BaseSecurityTC.setUp(self) |
|
57 |
# implicitly test manager can add some entities |
|
58 |
self.execute("INSERT Affaire X: X sujet 'cool'") |
|
59 |
self.execute("INSERT Societe X: X nom 'logilab'") |
|
60 |
self.execute("INSERT Personne X: X nom 'bidule'") |
|
1398
5fe84a5f7035
rename internal entity types to have CW prefix instead of E
sylvain.thenault@logilab.fr
parents:
389
diff
changeset
|
61 |
self.execute('INSERT CWGroup X: X name "staff"') |
0 | 62 |
self.commit() |
63 |
||
64 |
def test_insert_security(self): |
|
65 |
cnx = self.login('anon') |
|
66 |
cu = cnx.cursor() |
|
67 |
cu.execute("INSERT Personne X: X nom 'bidule'") |
|
68 |
self.assertRaises(Unauthorized, cnx.commit) |
|
69 |
self.assertEquals(cu.execute('Personne X').rowcount, 1) |
|
1802
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
1398
diff
changeset
|
70 |
|
0 | 71 |
def test_insert_rql_permission(self): |
72 |
# test user can only add une affaire related to a societe he owns |
|
73 |
cnx = self.login('iaminusersgrouponly') |
|
74 |
cu = cnx.cursor() |
|
75 |
cu.execute("INSERT Affaire X: X sujet 'cool'") |
|
76 |
self.assertRaises(Unauthorized, cnx.commit) |
|
77 |
# test nothing has actually been inserted |
|
78 |
self.restore_connection() |
|
79 |
self.assertEquals(self.execute('Affaire X').rowcount, 1) |
|
80 |
cnx = self.login('iaminusersgrouponly') |
|
81 |
cu = cnx.cursor() |
|
82 |
cu.execute("INSERT Affaire X: X sujet 'cool'") |
|
83 |
cu.execute("INSERT Societe X: X nom 'chouette'") |
|
84 |
cu.execute("SET A concerne S WHERE A sujet 'cool', S nom 'chouette'") |
|
85 |
cnx.commit() |
|
1802
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
1398
diff
changeset
|
86 |
|
0 | 87 |
def test_update_security_1(self): |
88 |
cnx = self.login('anon') |
|
89 |
cu = cnx.cursor() |
|
90 |
# local security check |
|
91 |
cu.execute( "SET X nom 'bidulechouette' WHERE X is Personne") |
|
92 |
self.assertRaises(Unauthorized, cnx.commit) |
|
93 |
self.restore_connection() |
|
94 |
self.assertEquals(self.execute('Personne X WHERE X nom "bidulechouette"').rowcount, 0) |
|
1802
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
1398
diff
changeset
|
95 |
|
0 | 96 |
def test_update_security_2(self): |
97 |
cnx = self.login('anon') |
|
98 |
cu = cnx.cursor() |
|
99 |
self.repo.schema['Personne'].set_groups('read', ('users', 'managers')) |
|
100 |
self.repo.schema['Personne'].set_groups('add', ('guests', 'users', 'managers')) |
|
101 |
self.assertRaises(Unauthorized, cu.execute, "SET X nom 'bidulechouette' WHERE X is Personne") |
|
102 |
#self.assertRaises(Unauthorized, cnx.commit) |
|
103 |
# test nothing has actually been inserted |
|
104 |
self.restore_connection() |
|
105 |
self.assertEquals(self.execute('Personne X WHERE X nom "bidulechouette"').rowcount, 0) |
|
106 |
||
107 |
def test_update_security_3(self): |
|
108 |
cnx = self.login('iaminusersgrouponly') |
|
109 |
cu = cnx.cursor() |
|
110 |
cu.execute("INSERT Personne X: X nom 'biduuule'") |
|
111 |
cu.execute("INSERT Societe X: X nom 'looogilab'") |
|
112 |
cu.execute("SET X travaille S WHERE X nom 'biduuule', S nom 'looogilab'") |
|
1802
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
1398
diff
changeset
|
113 |
|
0 | 114 |
def test_update_rql_permission(self): |
115 |
self.execute("SET A concerne S WHERE A is Affaire, S is Societe") |
|
116 |
self.commit() |
|
117 |
# test user can only update une affaire related to a societe he owns |
|
118 |
cnx = self.login('iaminusersgrouponly') |
|
119 |
cu = cnx.cursor() |
|
120 |
cu.execute("SET X sujet 'pascool' WHERE X is Affaire") |
|
121 |
# this won't actually do anything since the selection query won't return anything |
|
122 |
cnx.commit() |
|
123 |
# to actually get Unauthorized exception, try to update an entity we can read |
|
124 |
cu.execute("SET X nom 'toto' WHERE X is Societe") |
|
1802
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
1398
diff
changeset
|
125 |
self.assertRaises(Unauthorized, cnx.commit) |
0 | 126 |
cu.execute("INSERT Affaire X: X sujet 'pascool'") |
127 |
cu.execute("INSERT Societe X: X nom 'chouette'") |
|
128 |
cu.execute("SET A concerne S WHERE A sujet 'pascool', S nom 'chouette'") |
|
129 |
cu.execute("SET X sujet 'habahsicestcool' WHERE X sujet 'pascool'") |
|
130 |
cnx.commit() |
|
1802
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
1398
diff
changeset
|
131 |
|
0 | 132 |
def test_delete_security(self): |
133 |
# FIXME: sample below fails because we don't detect "owner" can't delete |
|
134 |
# user anyway, and since no user with login == 'bidule' exists, no |
|
135 |
# exception is raised |
|
136 |
#user._groups = {'guests':1} |
|
137 |
#self.assertRaises(Unauthorized, |
|
1398
5fe84a5f7035
rename internal entity types to have CW prefix instead of E
sylvain.thenault@logilab.fr
parents:
389
diff
changeset
|
138 |
# self.o.execute, user, "DELETE CWUser X WHERE X login 'bidule'") |
0 | 139 |
# check local security |
140 |
cnx = self.login('iaminusersgrouponly') |
|
141 |
cu = cnx.cursor() |
|
1398
5fe84a5f7035
rename internal entity types to have CW prefix instead of E
sylvain.thenault@logilab.fr
parents:
389
diff
changeset
|
142 |
self.assertRaises(Unauthorized, cu.execute, "DELETE CWGroup Y WHERE Y name 'staff'") |
1802
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
1398
diff
changeset
|
143 |
|
0 | 144 |
def test_delete_rql_permission(self): |
145 |
self.execute("SET A concerne S WHERE A is Affaire, S is Societe") |
|
146 |
self.commit() |
|
147 |
# test user can only dele une affaire related to a societe he owns |
|
148 |
cnx = self.login('iaminusersgrouponly') |
|
149 |
cu = cnx.cursor() |
|
1802
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
1398
diff
changeset
|
150 |
# this won't actually do anything since the selection query won't return anything |
0 | 151 |
cu.execute("DELETE Affaire X") |
152 |
cnx.commit() |
|
153 |
# to actually get Unauthorized exception, try to delete an entity we can read |
|
154 |
self.assertRaises(Unauthorized, cu.execute, "DELETE Societe S") |
|
155 |
cu.execute("INSERT Affaire X: X sujet 'pascool'") |
|
156 |
cu.execute("INSERT Societe X: X nom 'chouette'") |
|
157 |
cu.execute("SET A concerne S WHERE A sujet 'pascool', S nom 'chouette'") |
|
158 |
cnx.commit() |
|
159 |
## # this one should fail since it will try to delete two affaires, one authorized |
|
160 |
## # and the other not |
|
161 |
## self.assertRaises(Unauthorized, cu.execute, "DELETE Affaire X") |
|
162 |
cu.execute("DELETE Affaire X WHERE X sujet 'pascool'") |
|
163 |
cnx.commit() |
|
164 |
||
165 |
||
166 |
def test_insert_relation_rql_permission(self): |
|
167 |
cnx = self.login('iaminusersgrouponly') |
|
168 |
session = self.current_session() |
|
169 |
cu = cnx.cursor(session) |
|
170 |
cu.execute("SET A concerne S WHERE A is Affaire, S is Societe") |
|
171 |
# should raise Unauthorized since user don't own S |
|
172 |
# though this won't actually do anything since the selection query won't return anything |
|
173 |
cnx.commit() |
|
174 |
# to actually get Unauthorized exception, try to insert a relation were we can read both entities |
|
175 |
rset = cu.execute('Personne P') |
|
176 |
self.assertEquals(len(rset), 1) |
|
177 |
ent = rset.get_entity(0, 0) |
|
178 |
session.set_pool() # necessary |
|
179 |
self.assertRaises(Unauthorized, |
|
180 |
ent.e_schema.check_perm, session, 'update', ent.eid) |
|
181 |
self.assertRaises(Unauthorized, |
|
182 |
cu.execute, "SET P travaille S WHERE P is Personne, S is Societe") |
|
183 |
# test nothing has actually been inserted: |
|
184 |
self.assertEquals(cu.execute('Any P,S WHERE P travaille S,P is Personne, S is Societe').rowcount, 0) |
|
185 |
cu.execute("INSERT Societe X: X nom 'chouette'") |
|
186 |
cu.execute("SET A concerne S WHERE A is Affaire, S nom 'chouette'") |
|
187 |
cnx.commit() |
|
188 |
||
189 |
def test_delete_relation_rql_permission(self): |
|
190 |
self.execute("SET A concerne S WHERE A is Affaire, S is Societe") |
|
191 |
self.commit() |
|
192 |
cnx = self.login('iaminusersgrouponly') |
|
193 |
cu = cnx.cursor() |
|
194 |
# this won't actually do anything since the selection query won't return anything |
|
195 |
cu.execute("DELETE A concerne S") |
|
196 |
cnx.commit() |
|
197 |
# to actually get Unauthorized exception, try to delete a relation we can read |
|
198 |
self.restore_connection() |
|
199 |
eid = self.execute("INSERT Affaire X: X sujet 'pascool'")[0][0] |
|
200 |
self.execute('SET X owned_by U WHERE X eid %(x)s, U login "iaminusersgrouponly"', {'x': eid}, 'x') |
|
201 |
self.execute("SET A concerne S WHERE A sujet 'pascool', S is Societe") |
|
202 |
self.commit() |
|
203 |
cnx = self.login('iaminusersgrouponly') |
|
204 |
cu = cnx.cursor() |
|
205 |
self.assertRaises(Unauthorized, cu.execute, "DELETE A concerne S") |
|
206 |
cu.execute("INSERT Societe X: X nom 'chouette'") |
|
207 |
cu.execute("SET A concerne S WHERE A is Affaire, S nom 'chouette'") |
|
208 |
cnx.commit() |
|
209 |
cu.execute("DELETE A concerne S WHERE S nom 'chouette'") |
|
210 |
||
211 |
||
212 |
def test_user_can_change_its_upassword(self): |
|
213 |
ueid = self.create_user('user') |
|
214 |
cnx = self.login('user') |
|
215 |
cu = cnx.cursor() |
|
216 |
cu.execute('SET X upassword %(passwd)s WHERE X eid %(x)s', |
|
217 |
{'x': ueid, 'passwd': 'newpwd'}, 'x') |
|
218 |
cnx.commit() |
|
219 |
cnx.close() |
|
220 |
cnx = self.login('user', 'newpwd') |
|
221 |
||
222 |
def test_user_cant_change_other_upassword(self): |
|
223 |
ueid = self.create_user('otheruser') |
|
224 |
cnx = self.login('iaminusersgrouponly') |
|
225 |
cu = cnx.cursor() |
|
226 |
cu.execute('SET X upassword %(passwd)s WHERE X eid %(x)s', |
|
227 |
{'x': ueid, 'passwd': 'newpwd'}, 'x') |
|
228 |
self.assertRaises(Unauthorized, cnx.commit) |
|
229 |
||
230 |
# read security test |
|
1802
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
1398
diff
changeset
|
231 |
|
0 | 232 |
def test_read_base(self): |
233 |
self.schema['Personne'].set_groups('read', ('users', 'managers')) |
|
234 |
cnx = self.login('anon') |
|
235 |
cu = cnx.cursor() |
|
236 |
self.assertRaises(Unauthorized, |
|
237 |
cu.execute, 'Personne U where U nom "managers"') |
|
238 |
||
321
247947250382
fix security bug w/ query using 'NOT X eid 123'
Sylvain Thenault <sylvain.thenault@logilab.fr>
parents:
0
diff
changeset
|
239 |
def test_read_erqlexpr_base(self): |
0 | 240 |
eid = self.execute("INSERT Affaire X: X sujet 'cool'")[0][0] |
241 |
self.commit() |
|
242 |
cnx = self.login('iaminusersgrouponly') |
|
243 |
cu = cnx.cursor() |
|
244 |
rset = cu.execute('Affaire X') |
|
245 |
self.assertEquals(rset.rows, []) |
|
246 |
self.assertRaises(Unauthorized, cu.execute, 'Any X WHERE X eid %(x)s', {'x': eid}, 'x') |
|
321
247947250382
fix security bug w/ query using 'NOT X eid 123'
Sylvain Thenault <sylvain.thenault@logilab.fr>
parents:
0
diff
changeset
|
247 |
# cache test |
0 | 248 |
self.assertRaises(Unauthorized, cu.execute, 'Any X WHERE X eid %(x)s', {'x': eid}, 'x') |
249 |
aff2 = cu.execute("INSERT Affaire X: X sujet 'cool'")[0][0] |
|
250 |
soc1 = cu.execute("INSERT Societe X: X nom 'chouette'")[0][0] |
|
251 |
cu.execute("SET A concerne S WHERE A is Affaire, S is Societe") |
|
252 |
cnx.commit() |
|
253 |
rset = cu.execute('Any X WHERE X eid %(x)s', {'x': aff2}, 'x') |
|
254 |
self.assertEquals(rset.rows, [[aff2]]) |
|
321
247947250382
fix security bug w/ query using 'NOT X eid 123'
Sylvain Thenault <sylvain.thenault@logilab.fr>
parents:
0
diff
changeset
|
255 |
# more cache test w/ NOT eid |
247947250382
fix security bug w/ query using 'NOT X eid 123'
Sylvain Thenault <sylvain.thenault@logilab.fr>
parents:
0
diff
changeset
|
256 |
rset = cu.execute('Affaire X WHERE NOT X eid %(x)s', {'x': eid}, 'x') |
389 | 257 |
self.assertEquals(rset.rows, [[aff2]]) |
321
247947250382
fix security bug w/ query using 'NOT X eid 123'
Sylvain Thenault <sylvain.thenault@logilab.fr>
parents:
0
diff
changeset
|
258 |
rset = cu.execute('Affaire X WHERE NOT X eid %(x)s', {'x': aff2}, 'x') |
247947250382
fix security bug w/ query using 'NOT X eid 123'
Sylvain Thenault <sylvain.thenault@logilab.fr>
parents:
0
diff
changeset
|
259 |
self.assertEquals(rset.rows, []) |
1802
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
1398
diff
changeset
|
260 |
|
0 | 261 |
def test_read_erqlexpr_has_text1(self): |
262 |
aff1 = self.execute("INSERT Affaire X: X sujet 'cool'")[0][0] |
|
263 |
card1 = self.execute("INSERT Card X: X title 'cool'")[0][0] |
|
264 |
self.execute('SET X owned_by U WHERE X eid %(x)s, U login "iaminusersgrouponly"', {'x': card1}, 'x') |
|
265 |
self.commit() |
|
266 |
cnx = self.login('iaminusersgrouponly') |
|
267 |
cu = cnx.cursor() |
|
2920
64322aa83a1d
start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2608
diff
changeset
|
268 |
aff2 = cu.execute("INSERT Affaire X: X sujet 'cool'")[0][0] |
0 | 269 |
soc1 = cu.execute("INSERT Societe X: X nom 'chouette'")[0][0] |
270 |
cu.execute("SET A concerne S WHERE A eid %(a)s, S eid %(s)s", {'a': aff2, 's': soc1}, |
|
271 |
('a', 's')) |
|
272 |
cnx.commit() |
|
273 |
self.assertRaises(Unauthorized, cu.execute, 'Any X WHERE X eid %(x)s', {'x':aff1}, 'x') |
|
274 |
self.failUnless(cu.execute('Any X WHERE X eid %(x)s', {'x':aff2}, 'x')) |
|
275 |
self.failUnless(cu.execute('Any X WHERE X eid %(x)s', {'x':card1}, 'x')) |
|
276 |
rset = cu.execute("Any X WHERE X has_text 'cool'") |
|
277 |
self.assertEquals(sorted(eid for eid, in rset.rows), |
|
278 |
[card1, aff2]) |
|
279 |
||
280 |
def test_read_erqlexpr_has_text2(self): |
|
281 |
self.execute("INSERT Personne X: X nom 'bidule'") |
|
282 |
self.execute("INSERT Societe X: X nom 'bidule'") |
|
283 |
self.commit() |
|
284 |
self.schema['Personne'].set_groups('read', ('managers',)) |
|
285 |
cnx = self.login('iaminusersgrouponly') |
|
286 |
cu = cnx.cursor() |
|
287 |
rset = cu.execute('Any N WHERE N has_text "bidule"') |
|
288 |
self.assertEquals(len(rset.rows), 1, rset.rows) |
|
289 |
rset = cu.execute('Any N WITH N BEING (Any N WHERE N has_text "bidule")') |
|
1802
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
1398
diff
changeset
|
290 |
self.assertEquals(len(rset.rows), 1, rset.rows) |
0 | 291 |
|
292 |
def test_read_erqlexpr_optional_rel(self): |
|
293 |
self.execute("INSERT Personne X: X nom 'bidule'") |
|
294 |
self.execute("INSERT Societe X: X nom 'bidule'") |
|
295 |
self.commit() |
|
296 |
self.schema['Personne'].set_groups('read', ('managers',)) |
|
297 |
cnx = self.login('anon') |
|
298 |
cu = cnx.cursor() |
|
299 |
rset = cu.execute('Any N,U WHERE N has_text "bidule", N owned_by U?') |
|
300 |
self.assertEquals(len(rset.rows), 1, rset.rows) |
|
301 |
||
302 |
def test_read_erqlexpr_aggregat(self): |
|
303 |
self.execute("INSERT Affaire X: X sujet 'cool'")[0][0] |
|
304 |
self.commit() |
|
305 |
cnx = self.login('iaminusersgrouponly') |
|
306 |
cu = cnx.cursor() |
|
307 |
rset = cu.execute('Any COUNT(X) WHERE X is Affaire') |
|
1802
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
1398
diff
changeset
|
308 |
self.assertEquals(rset.rows, [[0]]) |
0 | 309 |
aff2 = cu.execute("INSERT Affaire X: X sujet 'cool'")[0][0] |
310 |
soc1 = cu.execute("INSERT Societe X: X nom 'chouette'")[0][0] |
|
311 |
cu.execute("SET A concerne S WHERE A is Affaire, S is Societe") |
|
312 |
cnx.commit() |
|
313 |
rset = cu.execute('Any COUNT(X) WHERE X is Affaire') |
|
314 |
self.assertEquals(rset.rows, [[1]]) |
|
315 |
rset = cu.execute('Any ETN, COUNT(X) GROUPBY ETN WHERE X is ET, ET name ETN') |
|
316 |
values = dict(rset) |
|
317 |
self.assertEquals(values['Affaire'], 1) |
|
318 |
self.assertEquals(values['Societe'], 2) |
|
319 |
rset = cu.execute('Any ETN, COUNT(X) GROUPBY ETN WHERE X is ET, ET name ETN WITH X BEING ((Affaire X) UNION (Societe X))') |
|
320 |
self.assertEquals(len(rset), 2) |
|
321 |
values = dict(rset) |
|
322 |
self.assertEquals(values['Affaire'], 1) |
|
323 |
self.assertEquals(values['Societe'], 2) |
|
1802
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
1398
diff
changeset
|
324 |
|
0 | 325 |
|
326 |
def test_attribute_security(self): |
|
327 |
# only managers should be able to edit the 'test' attribute of Personne entities |
|
328 |
eid = self.execute("INSERT Personne X: X nom 'bidule', X web 'http://www.debian.org', X test TRUE")[0][0] |
|
329 |
self.commit() |
|
330 |
self.execute('SET X test FALSE WHERE X eid %(x)s', {'x': eid}, 'x') |
|
331 |
self.commit() |
|
332 |
cnx = self.login('iaminusersgrouponly') |
|
333 |
cu = cnx.cursor() |
|
334 |
cu.execute("INSERT Personne X: X nom 'bidule', X web 'http://www.debian.org', X test TRUE") |
|
335 |
self.assertRaises(Unauthorized, cnx.commit) |
|
336 |
cu.execute("INSERT Personne X: X nom 'bidule', X web 'http://www.debian.org', X test FALSE") |
|
337 |
self.assertRaises(Unauthorized, cnx.commit) |
|
338 |
eid = cu.execute("INSERT Personne X: X nom 'bidule', X web 'http://www.debian.org'")[0][0] |
|
339 |
cnx.commit() |
|
340 |
cu.execute('SET X test FALSE WHERE X eid %(x)s', {'x': eid}, 'x') |
|
341 |
self.assertRaises(Unauthorized, cnx.commit) |
|
342 |
cu.execute('SET X test TRUE WHERE X eid %(x)s', {'x': eid}, 'x') |
|
343 |
self.assertRaises(Unauthorized, cnx.commit) |
|
344 |
cu.execute('SET X web "http://www.logilab.org" WHERE X eid %(x)s', {'x': eid}, 'x') |
|
345 |
cnx.commit() |
|
346 |
cnx.close() |
|
1802
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
1398
diff
changeset
|
347 |
|
0 | 348 |
def test_attribute_security_rqlexpr(self): |
349 |
# Note.para attribute editable by managers or if the note is in "todo" state |
|
2920
64322aa83a1d
start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2608
diff
changeset
|
350 |
note = self.execute("INSERT Note X: X para 'bidule'").get_entity(0, 0) |
0 | 351 |
self.commit() |
2920
64322aa83a1d
start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2608
diff
changeset
|
352 |
note.fire_transition('markasdone') |
64322aa83a1d
start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2608
diff
changeset
|
353 |
self.execute('SET X para "truc" WHERE X eid %(x)s', {'x': note.eid}, 'x') |
0 | 354 |
self.commit() |
355 |
cnx = self.login('iaminusersgrouponly') |
|
356 |
cu = cnx.cursor() |
|
2920
64322aa83a1d
start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2608
diff
changeset
|
357 |
cu.execute("SET X para 'chouette' WHERE X eid %(x)s", {'x': note.eid}, 'x') |
0 | 358 |
self.assertRaises(Unauthorized, cnx.commit) |
2920
64322aa83a1d
start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2608
diff
changeset
|
359 |
note2 = cu.execute("INSERT Note X: X para 'bidule'").get_entity(0, 0) |
0 | 360 |
cnx.commit() |
2920
64322aa83a1d
start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2608
diff
changeset
|
361 |
note2.fire_transition('markasdone') |
0 | 362 |
cnx.commit() |
2920
64322aa83a1d
start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2608
diff
changeset
|
363 |
self.assertEquals(len(cu.execute('Any X WHERE X in_state S, S name "todo", X eid %(x)s', {'x': note2.eid}, 'x')), |
0 | 364 |
0) |
2920
64322aa83a1d
start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2608
diff
changeset
|
365 |
cu.execute("SET X para 'chouette' WHERE X eid %(x)s", {'x': note2.eid}, 'x') |
0 | 366 |
self.assertRaises(Unauthorized, cnx.commit) |
2920
64322aa83a1d
start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2608
diff
changeset
|
367 |
note2.fire_transition('redoit') |
0 | 368 |
cnx.commit() |
2920
64322aa83a1d
start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2608
diff
changeset
|
369 |
cu.execute("SET X para 'chouette' WHERE X eid %(x)s", {'x': note2.eid}, 'x') |
0 | 370 |
cnx.commit() |
371 |
||
372 |
def test_attribute_read_security(self): |
|
373 |
# anon not allowed to see users'login, but they can see users |
|
1398
5fe84a5f7035
rename internal entity types to have CW prefix instead of E
sylvain.thenault@logilab.fr
parents:
389
diff
changeset
|
374 |
self.repo.schema['CWUser'].set_groups('read', ('guests', 'users', 'managers')) |
0 | 375 |
self.repo.schema['login'].set_groups('read', ('users', 'managers')) |
376 |
cnx = self.login('anon') |
|
377 |
cu = cnx.cursor() |
|
1398
5fe84a5f7035
rename internal entity types to have CW prefix instead of E
sylvain.thenault@logilab.fr
parents:
389
diff
changeset
|
378 |
rset = cu.execute('CWUser X') |
0 | 379 |
self.failUnless(rset) |
380 |
x = rset.get_entity(0, 0) |
|
381 |
self.assertEquals(x.login, None) |
|
382 |
self.failUnless(x.creation_date) |
|
383 |
x = rset.get_entity(1, 0) |
|
384 |
x.complete() |
|
385 |
self.assertEquals(x.login, None) |
|
386 |
self.failUnless(x.creation_date) |
|
387 |
cnx.rollback() |
|
388 |
||
1802
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
1398
diff
changeset
|
389 |
|
0 | 390 |
class BaseSchemaSecurityTC(BaseSecurityTC): |
391 |
"""tests related to the base schema permission configuration""" |
|
1802
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
1398
diff
changeset
|
392 |
|
0 | 393 |
def test_user_can_delete_object_he_created(self): |
394 |
# even if some other user have changed object'state |
|
395 |
cnx = self.login('iaminusersgrouponly') |
|
396 |
cu = cnx.cursor() |
|
397 |
# due to security test, affaire has to concerne a societe the user owns |
|
398 |
cu.execute('INSERT Societe X: X nom "ARCTIA"') |
|
399 |
cu.execute('INSERT Affaire X: X ref "ARCT01", X concerne S WHERE S nom "ARCTIA"') |
|
400 |
cnx.commit() |
|
401 |
self.restore_connection() |
|
2920
64322aa83a1d
start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2608
diff
changeset
|
402 |
affaire = self.execute('Any X WHERE X ref "ARCT01"').get_entity(0, 0) |
64322aa83a1d
start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2608
diff
changeset
|
403 |
affaire.fire_transition('abort') |
0 | 404 |
self.commit() |
405 |
self.assertEquals(len(self.execute('TrInfo X WHERE X wf_info_for A, A ref "ARCT01"')), |
|
2920
64322aa83a1d
start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2608
diff
changeset
|
406 |
1) |
0 | 407 |
self.assertEquals(len(self.execute('TrInfo X WHERE X wf_info_for A, A ref "ARCT01",' |
408 |
'X owned_by U, U login "admin"')), |
|
409 |
1) # TrInfo at the above state change |
|
410 |
cnx = self.login('iaminusersgrouponly') |
|
411 |
cu = cnx.cursor() |
|
412 |
cu.execute('DELETE Affaire X WHERE X ref "ARCT01"') |
|
413 |
cnx.commit() |
|
414 |
self.failIf(cu.execute('Affaire X')) |
|
415 |
||
416 |
def test_users_and_groups_non_readable_by_guests(self): |
|
417 |
cnx = self.login('anon') |
|
418 |
anon = cnx.user(self.current_session()) |
|
419 |
cu = cnx.cursor() |
|
420 |
# anonymous user can only read itself |
|
421 |
rset = cu.execute('Any L WHERE X owned_by U, U login L') |
|
422 |
self.assertEquals(rset.rows, [['anon']]) |
|
1398
5fe84a5f7035
rename internal entity types to have CW prefix instead of E
sylvain.thenault@logilab.fr
parents:
389
diff
changeset
|
423 |
rset = cu.execute('CWUser X') |
0 | 424 |
self.assertEquals(rset.rows, [[anon.eid]]) |
425 |
# anonymous user can read groups (necessary to check allowed transitions for instance) |
|
1398
5fe84a5f7035
rename internal entity types to have CW prefix instead of E
sylvain.thenault@logilab.fr
parents:
389
diff
changeset
|
426 |
self.assert_(cu.execute('CWGroup X')) |
0 | 427 |
# should only be able to read the anonymous user, not another one |
428 |
origuser = self.session.user |
|
1802
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
1398
diff
changeset
|
429 |
self.assertRaises(Unauthorized, |
1398
5fe84a5f7035
rename internal entity types to have CW prefix instead of E
sylvain.thenault@logilab.fr
parents:
389
diff
changeset
|
430 |
cu.execute, 'CWUser X WHERE X eid %(x)s', {'x': origuser.eid}, 'x') |
0 | 431 |
# nothing selected, nothing updated, no exception raised |
432 |
#self.assertRaises(Unauthorized, |
|
433 |
# cu.execute, 'SET X login "toto" WHERE X eid %(x)s', |
|
434 |
# {'x': self.user.eid}) |
|
1802
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
1398
diff
changeset
|
435 |
|
1398
5fe84a5f7035
rename internal entity types to have CW prefix instead of E
sylvain.thenault@logilab.fr
parents:
389
diff
changeset
|
436 |
rset = cu.execute('CWUser X WHERE X eid %(x)s', {'x': anon.eid}, 'x') |
0 | 437 |
self.assertEquals(rset.rows, [[anon.eid]]) |
438 |
# but can't modify it |
|
439 |
cu.execute('SET X login "toto" WHERE X eid %(x)s', {'x': anon.eid}) |
|
440 |
self.assertRaises(Unauthorized, cnx.commit) |
|
1802
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
1398
diff
changeset
|
441 |
|
0 | 442 |
def test_in_group_relation(self): |
443 |
cnx = self.login('iaminusersgrouponly') |
|
444 |
cu = cnx.cursor() |
|
445 |
rql = u"DELETE U in_group G WHERE U login 'admin'" |
|
446 |
self.assertRaises(Unauthorized, cu.execute, rql) |
|
447 |
rql = u"SET U in_group G WHERE U login 'admin', G name 'users'" |
|
448 |
self.assertRaises(Unauthorized, cu.execute, rql) |
|
449 |
||
450 |
def test_owned_by(self): |
|
451 |
self.execute("INSERT Personne X: X nom 'bidule'") |
|
452 |
self.commit() |
|
453 |
cnx = self.login('iaminusersgrouponly') |
|
454 |
cu = cnx.cursor() |
|
455 |
rql = u"SET X owned_by U WHERE U login 'iaminusersgrouponly', X is Personne" |
|
456 |
self.assertRaises(Unauthorized, cu.execute, rql) |
|
1802
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
1398
diff
changeset
|
457 |
|
0 | 458 |
def test_bookmarked_by_guests_security(self): |
459 |
beid1 = self.execute('INSERT Bookmark B: B path "?vid=manage", B title "manage"')[0][0] |
|
460 |
beid2 = self.execute('INSERT Bookmark B: B path "?vid=index", B title "index", B bookmarked_by U WHERE U login "anon"')[0][0] |
|
461 |
self.commit() |
|
462 |
cnx = self.login('anon') |
|
463 |
cu = cnx.cursor() |
|
464 |
anoneid = self.current_session().user.eid |
|
465 |
self.assertEquals(cu.execute('Any T,P ORDERBY lower(T) WHERE B is Bookmark,B title T,B path P,' |
|
466 |
'B bookmarked_by U, U eid %s' % anoneid).rows, |
|
467 |
[['index', '?vid=index']]) |
|
468 |
self.assertEquals(cu.execute('Any T,P ORDERBY lower(T) WHERE B is Bookmark,B title T,B path P,' |
|
469 |
'B bookmarked_by U, U eid %(x)s', {'x': anoneid}).rows, |
|
470 |
[['index', '?vid=index']]) |
|
471 |
# can read others bookmarks as well |
|
472 |
self.assertEquals(cu.execute('Any B where B is Bookmark, NOT B bookmarked_by U').rows, |
|
473 |
[[beid1]]) |
|
474 |
self.assertRaises(Unauthorized, cu.execute,'DELETE B bookmarked_by U') |
|
475 |
self.assertRaises(Unauthorized, |
|
476 |
cu.execute, 'SET B bookmarked_by U WHERE U eid %(x)s, B eid %(b)s', |
|
477 |
{'x': anoneid, 'b': beid1}, 'x') |
|
1802
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
1398
diff
changeset
|
478 |
|
0 | 479 |
|
480 |
def test_ambigous_ordered(self): |
|
481 |
cnx = self.login('anon') |
|
482 |
cu = cnx.cursor() |
|
483 |
names = [t for t, in cu.execute('Any N ORDERBY lower(N) WHERE X name N')] |
|
484 |
self.assertEquals(names, sorted(names, key=lambda x: x.lower())) |
|
485 |
||
486 |
def test_in_state_without_update_perm(self): |
|
487 |
"""check a user change in_state without having update permission on the |
|
488 |
subject |
|
489 |
""" |
|
490 |
eid = self.execute('INSERT Affaire X: X ref "ARCT01"')[0][0] |
|
491 |
self.commit() |
|
492 |
cnx = self.login('iaminusersgrouponly') |
|
493 |
session = self.current_session() |
|
494 |
# needed to avoid check_perm error |
|
495 |
session.set_pool() |
|
496 |
# needed to remove rql expr granting update perm to the user |
|
1802
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
1398
diff
changeset
|
497 |
self.schema['Affaire'].set_rqlexprs('update', ()) |
0 | 498 |
self.assertRaises(Unauthorized, |
499 |
self.schema['Affaire'].check_perm, session, 'update', eid) |
|
500 |
cu = cnx.cursor() |
|
2920
64322aa83a1d
start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2608
diff
changeset
|
501 |
self.schema['Affaire'].set_groups('read', ('users',)) |
64322aa83a1d
start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2608
diff
changeset
|
502 |
try: |
64322aa83a1d
start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2608
diff
changeset
|
503 |
aff = cu.execute('Any X WHERE X ref "ARCT01"').get_entity(0, 0) |
64322aa83a1d
start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2608
diff
changeset
|
504 |
aff.fire_transition('abort') |
64322aa83a1d
start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2608
diff
changeset
|
505 |
cnx.commit() |
64322aa83a1d
start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2608
diff
changeset
|
506 |
# though changing a user state (even logged user) is reserved to managers |
64322aa83a1d
start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2608
diff
changeset
|
507 |
user = cnx.user(self.current_session()) |
64322aa83a1d
start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2608
diff
changeset
|
508 |
# XXX wether it should raise Unauthorized or ValidationError is not clear |
64322aa83a1d
start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2608
diff
changeset
|
509 |
# the best would probably ValidationError if the transition doesn't exist |
64322aa83a1d
start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2608
diff
changeset
|
510 |
# from the current state but Unauthorized if it exists but user can't pass it |
64322aa83a1d
start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2608
diff
changeset
|
511 |
self.assertRaises(ValidationError, user.fire_transition, 'deactivate') |
64322aa83a1d
start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2608
diff
changeset
|
512 |
finally: |
64322aa83a1d
start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2608
diff
changeset
|
513 |
self.schema['Affaire'].set_groups('read', ('managers',)) |
1802
d628defebc17
delete-trailing-whitespace + some copyright update
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
1398
diff
changeset
|
514 |
|
2501
fa86d99c2c3a
test and fix wf history security
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2500
diff
changeset
|
515 |
def test_trinfo_security(self): |
fa86d99c2c3a
test and fix wf history security
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2500
diff
changeset
|
516 |
aff = self.execute('INSERT Affaire X: X ref "ARCT01"').get_entity(0, 0) |
fa86d99c2c3a
test and fix wf history security
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2500
diff
changeset
|
517 |
self.commit() |
2920
64322aa83a1d
start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2608
diff
changeset
|
518 |
aff.fire_transition('abort') |
64322aa83a1d
start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2608
diff
changeset
|
519 |
self.commit() |
2501
fa86d99c2c3a
test and fix wf history security
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2500
diff
changeset
|
520 |
# can change tr info comment |
fa86d99c2c3a
test and fix wf history security
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2500
diff
changeset
|
521 |
self.execute('SET TI comment %(c)s WHERE TI wf_info_for X, X ref "ARCT01"', |
2920
64322aa83a1d
start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2608
diff
changeset
|
522 |
{'c': u'bouh!'}) |
2501
fa86d99c2c3a
test and fix wf history security
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2500
diff
changeset
|
523 |
self.commit() |
2608
21856eda34f6
[F repo tests] tests have to be updated:
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2501
diff
changeset
|
524 |
aff.clear_related_cache('wf_info_for', 'object') |
2920
64322aa83a1d
start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2608
diff
changeset
|
525 |
trinfo = aff.latest_trinfo() |
64322aa83a1d
start a new workflow engine
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2608
diff
changeset
|
526 |
self.assertEquals(trinfo.comment, 'bouh!') |
2501
fa86d99c2c3a
test and fix wf history security
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2500
diff
changeset
|
527 |
# but not from_state/to_state |
fa86d99c2c3a
test and fix wf history security
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2500
diff
changeset
|
528 |
aff.clear_related_cache('wf_info_for', role='object') |
fa86d99c2c3a
test and fix wf history security
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2500
diff
changeset
|
529 |
self.assertRaises(Unauthorized, |
fa86d99c2c3a
test and fix wf history security
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2500
diff
changeset
|
530 |
self.execute, 'SET TI from_state S WHERE TI eid %(ti)s, S name "ben non"', |
fa86d99c2c3a
test and fix wf history security
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2500
diff
changeset
|
531 |
{'ti': trinfo.eid}, 'ti') |
fa86d99c2c3a
test and fix wf history security
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2500
diff
changeset
|
532 |
self.assertRaises(Unauthorized, |
fa86d99c2c3a
test and fix wf history security
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2500
diff
changeset
|
533 |
self.execute, 'SET TI to_state S WHERE TI eid %(ti)s, S name "pitetre"', |
fa86d99c2c3a
test and fix wf history security
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2500
diff
changeset
|
534 |
{'ti': trinfo.eid}, 'ti') |
fa86d99c2c3a
test and fix wf history security
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents:
2500
diff
changeset
|
535 |
|
0 | 536 |
if __name__ == '__main__': |
537 |
unittest_main() |