221 self.vreg['etypes'].etype_class(ttype).fetch_attrs = ('modification_date',) |
221 self.vreg['etypes'].etype_class(ttype).fetch_attrs = ('modification_date',) |
222 self.assertEqual(tag.cw_related_rql('tags', 'subject'), |
222 self.assertEqual(tag.cw_related_rql('tags', 'subject'), |
223 'Any X,AA ORDERBY AA DESC ' |
223 'Any X,AA ORDERBY AA DESC ' |
224 'WHERE E eid %(x)s, E tags X, X modification_date AA') |
224 'WHERE E eid %(x)s, E tags X, X modification_date AA') |
225 |
225 |
226 def test_unrelated_rql_security_1(self): |
226 def test_unrelated_rql_security_1_manager(self): |
227 user = self.request().user |
227 user = self.request().user |
228 rql = user.cw_unrelated_rql('use_email', 'EmailAddress', 'subject')[0] |
228 rql = user.cw_unrelated_rql('use_email', 'EmailAddress', 'subject')[0] |
229 self.assertEqual(rql, 'Any O,AA,AB,AC ORDERBY AC DESC ' |
229 self.assertEqual(rql, 'Any O,AA,AB,AC ORDERBY AC DESC ' |
230 'WHERE NOT S use_email O, S eid %(x)s, O is EmailAddress, O address AA, O alias AB, O modification_date AC') |
230 'WHERE NOT S use_email O, S eid %(x)s, ' |
|
231 'O is EmailAddress, O address AA, O alias AB, O modification_date AC') |
|
232 |
|
233 def test_unrelated_rql_security_1_user(self): |
231 self.create_user('toto') |
234 self.create_user('toto') |
232 self.login('toto') |
235 self.login('toto') |
233 user = self.request().user |
236 user = self.request().user |
234 rql = user.cw_unrelated_rql('use_email', 'EmailAddress', 'subject')[0] |
237 rql = user.cw_unrelated_rql('use_email', 'EmailAddress', 'subject')[0] |
235 self.assertEqual(rql, 'Any O,AA,AB,AC ORDERBY AC DESC ' |
238 self.assertEqual(rql, 'Any O,AA,AB,AC ORDERBY AC DESC ' |
236 'WHERE NOT S use_email O, S eid %(x)s, O is EmailAddress, O address AA, O alias AB, O modification_date AC') |
239 'WHERE NOT S use_email O, S eid %(x)s, ' |
|
240 'O is EmailAddress, O address AA, O alias AB, O modification_date AC') |
237 user = self.execute('Any X WHERE X login "admin"').get_entity(0, 0) |
241 user = self.execute('Any X WHERE X login "admin"').get_entity(0, 0) |
238 self.assertRaises(Unauthorized, user.cw_unrelated_rql, 'use_email', 'EmailAddress', 'subject') |
242 rql = user.cw_unrelated_rql('use_email', 'EmailAddress', 'subject')[0] |
|
243 self.assertEqual(rql, 'Any O,AA,AB,AC ORDERBY AC DESC WHERE ' |
|
244 'NOT EXISTS(S use_email O), S eid %(x)s, ' |
|
245 'O is EmailAddress, O address AA, O alias AB, O modification_date AC, ' |
|
246 'A eid %(B)s, EXISTS(S identity A, NOT A in_group C, C name "guests", C is CWGroup)') |
|
247 |
|
248 def test_unrelated_rql_security_1_anon(self): |
239 self.login('anon') |
249 self.login('anon') |
240 user = self.request().user |
250 user = self.request().user |
241 self.assertRaises(Unauthorized, user.cw_unrelated_rql, 'use_email', 'EmailAddress', 'subject') |
251 rql = user.cw_unrelated_rql('use_email', 'EmailAddress', 'subject')[0] |
|
252 self.assertEqual(rql, 'Any O,AA,AB,AC ORDERBY AC DESC WHERE ' |
|
253 'NOT EXISTS(S use_email O), S eid %(x)s, ' |
|
254 'O is EmailAddress, O address AA, O alias AB, O modification_date AC, ' |
|
255 'A eid %(B)s, EXISTS(S identity A, NOT A in_group C, C name "guests", C is CWGroup)') |
242 |
256 |
243 def test_unrelated_rql_security_2(self): |
257 def test_unrelated_rql_security_2(self): |
244 email = self.execute('INSERT EmailAddress X: X address "hop"').get_entity(0, 0) |
258 email = self.execute('INSERT EmailAddress X: X address "hop"').get_entity(0, 0) |
245 rql = email.cw_unrelated_rql('use_email', 'CWUser', 'object')[0] |
259 rql = email.cw_unrelated_rql('use_email', 'CWUser', 'object')[0] |
246 self.assertEqual(rql, 'Any S,AA,AB,AC,AD ORDERBY AA ASC ' |
260 self.assertEqual(rql, 'Any S,AA,AB,AC,AD ORDERBY AA ASC ' |
247 'WHERE NOT S use_email O, O eid %(x)s, S is CWUser, S login AA, S firstname AB, S surname AC, S modification_date AD') |
261 'WHERE NOT S use_email O, O eid %(x)s, S is CWUser, S login AA, S firstname AB, S surname AC, S modification_date AD') |
248 #rql = email.cw_unrelated_rql('use_email', 'Person', 'object')[0] |
|
249 #self.assertEqual(rql, '') |
|
250 self.login('anon') |
262 self.login('anon') |
251 email = self.execute('Any X WHERE X eid %(x)s', {'x': email.eid}).get_entity(0, 0) |
263 email = self.execute('Any X WHERE X eid %(x)s', {'x': email.eid}).get_entity(0, 0) |
252 rql = email.cw_unrelated_rql('use_email', 'CWUser', 'object')[0] |
264 rql = email.cw_unrelated_rql('use_email', 'CWUser', 'object')[0] |
253 self.assertEqual(rql, 'Any S,AA,AB,AC,AD ORDERBY AA ' |
265 self.assertEqual(rql, 'Any S,AA,AB,AC,AD ORDERBY AA ' |
254 'WHERE NOT EXISTS(S use_email O), O eid %(x)s, S is CWUser, S login AA, S firstname AB, S surname AC, S modification_date AD, ' |
266 'WHERE NOT EXISTS(S use_email O), O eid %(x)s, S is CWUser, S login AA, S firstname AB, S surname AC, S modification_date AD, ' |
255 'A eid %(B)s, EXISTS(S identity A, NOT A in_group C, C name "guests", C is CWGroup)') |
267 'A eid %(B)s, EXISTS(S identity A, NOT A in_group C, C name "guests", C is CWGroup)') |
256 #rql = email.cw_unrelated_rql('use_email', 'Person', 'object')[0] |
|
257 #self.assertEqual(rql, '') |
|
258 |
268 |
259 def test_unrelated_rql_security_nonexistant(self): |
269 def test_unrelated_rql_security_nonexistant(self): |
260 self.login('anon') |
270 self.login('anon') |
261 email = self.vreg['etypes'].etype_class('EmailAddress')(self.request()) |
271 email = self.vreg['etypes'].etype_class('EmailAddress')(self.request()) |
262 rql = email.cw_unrelated_rql('use_email', 'CWUser', 'object')[0] |
272 rql = email.cw_unrelated_rql('use_email', 'CWUser', 'object')[0] |