134 Personne = self.vreg['etypes'].etype_class('Personne') |
145 Personne = self.vreg['etypes'].etype_class('Personne') |
135 Societe = self.vreg['etypes'].etype_class('Societe') |
146 Societe = self.vreg['etypes'].etype_class('Societe') |
136 Note = self.vreg['etypes'].etype_class('Note') |
147 Note = self.vreg['etypes'].etype_class('Note') |
137 peschema = Personne.e_schema |
148 peschema = Personne.e_schema |
138 seschema = Societe.e_schema |
149 seschema = Societe.e_schema |
139 peschema.subjrels['travaille'].rdef(peschema, seschema).cardinality = '1*' |
150 torestore = [] |
140 peschema.subjrels['connait'].rdef(peschema, peschema).cardinality = '11' |
151 for rdef, card in [(peschema.subjrels['travaille'].rdef(peschema, seschema), '1*'), |
141 peschema.subjrels['evaluee'].rdef(peschema, Note.e_schema).cardinality = '1*' |
152 (peschema.subjrels['connait'].rdef(peschema, peschema), '11'), |
142 seschema.subjrels['evaluee'].rdef(seschema, Note.e_schema).cardinality = '1*' |
153 (peschema.subjrels['evaluee'].rdef(peschema, Note.e_schema), '1*'), |
143 # testing basic fetch_attrs attribute |
154 (seschema.subjrels['evaluee'].rdef(seschema, Note.e_schema), '1*')]: |
144 self.assertEqual(Personne.fetch_rql(user), |
155 cm = tempattr(rdef, 'cardinality', card) |
145 'Any X,AA,AB,AC ORDERBY AA ASC ' |
156 cm.__enter__() |
146 'WHERE X is Personne, X nom AA, X prenom AB, X modification_date AC') |
157 torestore.append(cm) |
147 pfetch_attrs = Personne.fetch_attrs |
|
148 sfetch_attrs = Societe.fetch_attrs |
|
149 try: |
158 try: |
|
159 # testing basic fetch_attrs attribute |
|
160 self.assertEqual(Personne.fetch_rql(user), |
|
161 'Any X,AA,AB,AC ORDERBY AA ASC ' |
|
162 'WHERE X is Personne, X nom AA, X prenom AB, X modification_date AC') |
150 # testing unknown attributes |
163 # testing unknown attributes |
151 Personne.fetch_attrs = ('bloug', 'beep') |
164 Personne.fetch_attrs = ('bloug', 'beep') |
152 self.assertEqual(Personne.fetch_rql(user), 'Any X WHERE X is Personne') |
165 self.assertEqual(Personne.fetch_rql(user), 'Any X WHERE X is Personne') |
153 # testing one non final relation |
166 # testing one non final relation |
154 Personne.fetch_attrs = ('nom', 'prenom', 'travaille') |
167 Personne.fetch_attrs = ('nom', 'prenom', 'travaille') |
225 |
239 |
226 def test_unrelated_rql_security_1_manager(self): |
240 def test_unrelated_rql_security_1_manager(self): |
227 user = self.request().user |
241 user = self.request().user |
228 rql = user.cw_unrelated_rql('use_email', 'EmailAddress', 'subject')[0] |
242 rql = user.cw_unrelated_rql('use_email', 'EmailAddress', 'subject')[0] |
229 self.assertEqual(rql, 'Any O,AA,AB,AC ORDERBY AC DESC ' |
243 self.assertEqual(rql, 'Any O,AA,AB,AC ORDERBY AC DESC ' |
230 'WHERE NOT S use_email O, S eid %(x)s, ' |
244 'WHERE NOT EXISTS(ZZ use_email O), S eid %(x)s, ' |
231 'O is EmailAddress, O address AA, O alias AB, O modification_date AC') |
245 'O is EmailAddress, O address AA, O alias AB, O modification_date AC') |
232 |
246 |
233 def test_unrelated_rql_security_1_user(self): |
247 def test_unrelated_rql_security_1_user(self): |
234 self.create_user('toto') |
248 req = self.request() |
|
249 self.create_user(req, 'toto') |
235 self.login('toto') |
250 self.login('toto') |
236 user = self.request().user |
251 user = req.user |
237 rql = user.cw_unrelated_rql('use_email', 'EmailAddress', 'subject')[0] |
252 rql = user.cw_unrelated_rql('use_email', 'EmailAddress', 'subject')[0] |
238 self.assertEqual(rql, 'Any O,AA,AB,AC ORDERBY AC DESC ' |
253 self.assertEqual(rql, 'Any O,AA,AB,AC ORDERBY AC DESC ' |
239 'WHERE NOT S use_email O, S eid %(x)s, ' |
254 'WHERE NOT EXISTS(ZZ use_email O), S eid %(x)s, ' |
240 'O is EmailAddress, O address AA, O alias AB, O modification_date AC') |
255 'O is EmailAddress, O address AA, O alias AB, O modification_date AC') |
241 user = self.execute('Any X WHERE X login "admin"').get_entity(0, 0) |
256 user = self.execute('Any X WHERE X login "admin"').get_entity(0, 0) |
242 rql = user.cw_unrelated_rql('use_email', 'EmailAddress', 'subject')[0] |
257 rql = user.cw_unrelated_rql('use_email', 'EmailAddress', 'subject')[0] |
243 self.assertEqual(rql, 'Any O,AA,AB,AC ORDERBY AC DESC WHERE ' |
258 self.assertEqual(rql, 'Any O,AA,AB,AC ORDERBY AC DESC ' |
244 'NOT EXISTS(S use_email O), S eid %(x)s, ' |
259 'WHERE NOT EXISTS(ZZ use_email O, ZZ is CWUser), S eid %(x)s, ' |
245 'O is EmailAddress, O address AA, O alias AB, O modification_date AC, ' |
260 'O is EmailAddress, O address AA, O alias AB, O modification_date AC, A eid %(B)s, ' |
246 'A eid %(B)s, EXISTS(S identity A, NOT A in_group C, C name "guests", C is CWGroup)') |
261 'EXISTS(S identity A, NOT A in_group C, C name "guests", C is CWGroup)') |
247 |
262 |
248 def test_unrelated_rql_security_1_anon(self): |
263 def test_unrelated_rql_security_1_anon(self): |
249 self.login('anon') |
264 self.login('anon') |
250 user = self.request().user |
265 user = self.request().user |
251 rql = user.cw_unrelated_rql('use_email', 'EmailAddress', 'subject')[0] |
266 rql = user.cw_unrelated_rql('use_email', 'EmailAddress', 'subject')[0] |
252 self.assertEqual(rql, 'Any O,AA,AB,AC ORDERBY AC DESC WHERE ' |
267 self.assertEqual(rql, 'Any O,AA,AB,AC ORDERBY AC DESC ' |
253 'NOT EXISTS(S use_email O), S eid %(x)s, ' |
268 'WHERE NOT EXISTS(ZZ use_email O, ZZ is CWUser), S eid %(x)s, ' |
254 'O is EmailAddress, O address AA, O alias AB, O modification_date AC, ' |
269 'O is EmailAddress, O address AA, O alias AB, O modification_date AC, A eid %(B)s, ' |
255 'A eid %(B)s, EXISTS(S identity A, NOT A in_group C, C name "guests", C is CWGroup)') |
270 'EXISTS(S identity A, NOT A in_group C, C name "guests", C is CWGroup)') |
256 |
271 |
257 def test_unrelated_rql_security_2(self): |
272 def test_unrelated_rql_security_2(self): |
258 email = self.execute('INSERT EmailAddress X: X address "hop"').get_entity(0, 0) |
273 email = self.execute('INSERT EmailAddress X: X address "hop"').get_entity(0, 0) |
259 rql = email.cw_unrelated_rql('use_email', 'CWUser', 'object')[0] |
274 rql = email.cw_unrelated_rql('use_email', 'CWUser', 'object')[0] |
260 self.assertEqual(rql, 'Any S,AA,AB,AC,AD ORDERBY AA ASC ' |
275 self.assertEqual(rql, 'Any S,AA,AB,AC,AD ORDERBY AA ' |
261 'WHERE NOT S use_email O, O eid %(x)s, S is CWUser, S login AA, S firstname AB, S surname AC, S modification_date AD') |
276 'WHERE NOT EXISTS(S use_email O), O eid %(x)s, S is CWUser, ' |
|
277 'S login AA, S firstname AB, S surname AC, S modification_date AD') |
262 self.login('anon') |
278 self.login('anon') |
263 email = self.execute('Any X WHERE X eid %(x)s', {'x': email.eid}).get_entity(0, 0) |
279 email = self.execute('Any X WHERE X eid %(x)s', {'x': email.eid}).get_entity(0, 0) |
264 rql = email.cw_unrelated_rql('use_email', 'CWUser', 'object')[0] |
280 rql = email.cw_unrelated_rql('use_email', 'CWUser', 'object')[0] |
265 self.assertEqual(rql, 'Any S,AA,AB,AC,AD ORDERBY AA ' |
281 self.assertEqual(rql, 'Any S,AA,AB,AC,AD ORDERBY AA ' |
266 'WHERE NOT EXISTS(S use_email O), O eid %(x)s, S is CWUser, S login AA, S firstname AB, S surname AC, S modification_date AD, ' |
282 'WHERE NOT EXISTS(S use_email O), O eid %(x)s, S is CWUser, ' |
267 'A eid %(B)s, EXISTS(S identity A, NOT A in_group C, C name "guests", C is CWGroup)') |
283 'S login AA, S firstname AB, S surname AC, S modification_date AD, ' |
|
284 'A eid %(B)s, EXISTS(S identity A, NOT A in_group C, C name "guests", C is CWGroup)') |
268 |
285 |
269 def test_unrelated_rql_security_nonexistant(self): |
286 def test_unrelated_rql_security_nonexistant(self): |
270 self.login('anon') |
287 self.login('anon') |
271 email = self.vreg['etypes'].etype_class('EmailAddress')(self.request()) |
288 email = self.vreg['etypes'].etype_class('EmailAddress')(self.request()) |
272 rql = email.cw_unrelated_rql('use_email', 'CWUser', 'object')[0] |
289 rql = email.cw_unrelated_rql('use_email', 'CWUser', 'object')[0] |
273 self.assertEqual(rql, 'Any S,AA,AB,AC,AD ORDERBY AA ' |
290 self.assertEqual(rql, 'Any S,AA,AB,AC,AD ORDERBY AA ' |
274 'WHERE S is CWUser, S login AA, S firstname AB, S surname AC, S modification_date AD, ' |
291 'WHERE S is CWUser, ' |
275 'A eid %(B)s, EXISTS(S identity A, NOT A in_group C, C name "guests", C is CWGroup)') |
292 'S login AA, S firstname AB, S surname AC, S modification_date AD, ' |
|
293 'A eid %(B)s, EXISTS(S identity A, NOT A in_group C, C name "guests", C is CWGroup)') |
|
294 |
|
295 def test_unrelated_rql_constraints_creation_subject(self): |
|
296 person = self.vreg['etypes'].etype_class('Personne')(self.request()) |
|
297 rql = person.cw_unrelated_rql('connait', 'Personne', 'subject')[0] |
|
298 self.assertEqual( |
|
299 rql, 'Any O,AA,AB,AC ORDERBY AC DESC WHERE ' |
|
300 'O is Personne, O nom AA, O prenom AB, O modification_date AC') |
|
301 |
|
302 def test_unrelated_rql_constraints_creation_object(self): |
|
303 person = self.vreg['etypes'].etype_class('Personne')(self.request()) |
|
304 rql = person.cw_unrelated_rql('connait', 'Personne', 'object')[0] |
|
305 self.assertEqual( |
|
306 rql, 'Any S,AA,AB,AC ORDERBY AC DESC WHERE ' |
|
307 'S is Personne, S nom AA, S prenom AB, S modification_date AC, ' |
|
308 'NOT (S connait A, A nom "toto"), A is Personne, EXISTS(S travaille B, B nom "tutu")') |
|
309 |
|
310 def test_unrelated_rql_constraints_edition_subject(self): |
|
311 person = self.request().create_entity('Personne', nom=u'sylvain') |
|
312 rql = person.cw_unrelated_rql('connait', 'Personne', 'subject')[0] |
|
313 self.assertEqual( |
|
314 rql, 'Any O,AA,AB,AC ORDERBY AC DESC WHERE ' |
|
315 'NOT EXISTS(S connait O), S eid %(x)s, O is Personne, ' |
|
316 'O nom AA, O prenom AB, O modification_date AC, ' |
|
317 'NOT S identity O') |
|
318 |
|
319 def test_unrelated_rql_constraints_edition_object(self): |
|
320 person = self.request().create_entity('Personne', nom=u'sylvain') |
|
321 rql = person.cw_unrelated_rql('connait', 'Personne', 'object')[0] |
|
322 self.assertEqual( |
|
323 rql, 'Any S,AA,AB,AC ORDERBY AC DESC WHERE ' |
|
324 'NOT EXISTS(S connait O), O eid %(x)s, S is Personne, ' |
|
325 'S nom AA, S prenom AB, S modification_date AC, ' |
|
326 'NOT S identity O, NOT (S connait A, A nom "toto"), ' |
|
327 'EXISTS(S travaille B, B nom "tutu")') |
276 |
328 |
277 def test_unrelated_base(self): |
329 def test_unrelated_base(self): |
278 req = self.request() |
330 req = self.request() |
279 p = req.create_entity('Personne', nom=u'di mascio', prenom=u'adrien') |
331 p = req.create_entity('Personne', nom=u'di mascio', prenom=u'adrien') |
280 e = req.create_entity('Tag', name=u'x') |
332 e = req.create_entity('Tag', name=u'x') |