13 def setUp(self): |
13 def setUp(self): |
14 RepositoryBasedTC.setUp(self) |
14 RepositoryBasedTC.setUp(self) |
15 self.create_user('iaminusersgrouponly') |
15 self.create_user('iaminusersgrouponly') |
16 self.readoriggroups = self.schema['Personne'].get_groups('read') |
16 self.readoriggroups = self.schema['Personne'].get_groups('read') |
17 self.addoriggroups = self.schema['Personne'].get_groups('add') |
17 self.addoriggroups = self.schema['Personne'].get_groups('add') |
18 |
18 |
19 def tearDown(self): |
19 def tearDown(self): |
20 RepositoryBasedTC.tearDown(self) |
20 RepositoryBasedTC.tearDown(self) |
21 self.schema['Personne'].set_groups('read', self.readoriggroups) |
21 self.schema['Personne'].set_groups('read', self.readoriggroups) |
22 self.schema['Personne'].set_groups('add', self.addoriggroups) |
22 self.schema['Personne'].set_groups('add', self.addoriggroups) |
23 |
23 |
24 |
24 |
25 class LowLevelSecurityFunctionTC(BaseSecurityTC): |
25 class LowLevelSecurityFunctionTC(BaseSecurityTC): |
26 |
26 |
27 def test_check_read_access(self): |
27 def test_check_read_access(self): |
28 rql = u'Personne U where U nom "managers"' |
28 rql = u'Personne U where U nom "managers"' |
29 rqlst = self.repo.querier._rqlhelper.parse(rql).children[0] |
29 rqlst = self.repo.querier._rqlhelper.parse(rql).children[0] |
30 origgroups = self.schema['Personne'].get_groups('read') |
30 origgroups = self.schema['Personne'].get_groups('read') |
31 self.schema['Personne'].set_groups('read', ('users', 'managers')) |
31 self.schema['Personne'].set_groups('read', ('users', 'managers')) |
36 cu = cnx.cursor() |
36 cu = cnx.cursor() |
37 self.assertRaises(Unauthorized, |
37 self.assertRaises(Unauthorized, |
38 check_read_access, |
38 check_read_access, |
39 self.schema, cnx.user(self.current_session()), rqlst, solution) |
39 self.schema, cnx.user(self.current_session()), rqlst, solution) |
40 self.assertRaises(Unauthorized, cu.execute, rql) |
40 self.assertRaises(Unauthorized, cu.execute, rql) |
41 |
41 |
42 def test_upassword_not_selectable(self): |
42 def test_upassword_not_selectable(self): |
43 self.assertRaises(Unauthorized, |
43 self.assertRaises(Unauthorized, |
44 self.execute, 'Any X,P WHERE X is CWUser, X upassword P') |
44 self.execute, 'Any X,P WHERE X is CWUser, X upassword P') |
45 self.rollback() |
45 self.rollback() |
46 cnx = self.login('iaminusersgrouponly') |
46 cnx = self.login('iaminusersgrouponly') |
47 cu = cnx.cursor() |
47 cu = cnx.cursor() |
48 self.assertRaises(Unauthorized, |
48 self.assertRaises(Unauthorized, |
49 cu.execute, 'Any X,P WHERE X is CWUser, X upassword P') |
49 cu.execute, 'Any X,P WHERE X is CWUser, X upassword P') |
50 |
50 |
51 |
51 |
52 class SecurityTC(BaseSecurityTC): |
52 class SecurityTC(BaseSecurityTC): |
53 |
53 |
54 def setUp(self): |
54 def setUp(self): |
55 BaseSecurityTC.setUp(self) |
55 BaseSecurityTC.setUp(self) |
56 # implicitly test manager can add some entities |
56 # implicitly test manager can add some entities |
57 self.execute("INSERT Affaire X: X sujet 'cool'") |
57 self.execute("INSERT Affaire X: X sujet 'cool'") |
58 self.execute("INSERT Societe X: X nom 'logilab'") |
58 self.execute("INSERT Societe X: X nom 'logilab'") |
64 cnx = self.login('anon') |
64 cnx = self.login('anon') |
65 cu = cnx.cursor() |
65 cu = cnx.cursor() |
66 cu.execute("INSERT Personne X: X nom 'bidule'") |
66 cu.execute("INSERT Personne X: X nom 'bidule'") |
67 self.assertRaises(Unauthorized, cnx.commit) |
67 self.assertRaises(Unauthorized, cnx.commit) |
68 self.assertEquals(cu.execute('Personne X').rowcount, 1) |
68 self.assertEquals(cu.execute('Personne X').rowcount, 1) |
69 |
69 |
70 def test_insert_rql_permission(self): |
70 def test_insert_rql_permission(self): |
71 # test user can only add une affaire related to a societe he owns |
71 # test user can only add une affaire related to a societe he owns |
72 cnx = self.login('iaminusersgrouponly') |
72 cnx = self.login('iaminusersgrouponly') |
73 cu = cnx.cursor() |
73 cu = cnx.cursor() |
74 cu.execute("INSERT Affaire X: X sujet 'cool'") |
74 cu.execute("INSERT Affaire X: X sujet 'cool'") |
80 cu = cnx.cursor() |
80 cu = cnx.cursor() |
81 cu.execute("INSERT Affaire X: X sujet 'cool'") |
81 cu.execute("INSERT Affaire X: X sujet 'cool'") |
82 cu.execute("INSERT Societe X: X nom 'chouette'") |
82 cu.execute("INSERT Societe X: X nom 'chouette'") |
83 cu.execute("SET A concerne S WHERE A sujet 'cool', S nom 'chouette'") |
83 cu.execute("SET A concerne S WHERE A sujet 'cool', S nom 'chouette'") |
84 cnx.commit() |
84 cnx.commit() |
85 |
85 |
86 def test_update_security_1(self): |
86 def test_update_security_1(self): |
87 cnx = self.login('anon') |
87 cnx = self.login('anon') |
88 cu = cnx.cursor() |
88 cu = cnx.cursor() |
89 # local security check |
89 # local security check |
90 cu.execute( "SET X nom 'bidulechouette' WHERE X is Personne") |
90 cu.execute( "SET X nom 'bidulechouette' WHERE X is Personne") |
91 self.assertRaises(Unauthorized, cnx.commit) |
91 self.assertRaises(Unauthorized, cnx.commit) |
92 self.restore_connection() |
92 self.restore_connection() |
93 self.assertEquals(self.execute('Personne X WHERE X nom "bidulechouette"').rowcount, 0) |
93 self.assertEquals(self.execute('Personne X WHERE X nom "bidulechouette"').rowcount, 0) |
94 |
94 |
95 def test_update_security_2(self): |
95 def test_update_security_2(self): |
96 cnx = self.login('anon') |
96 cnx = self.login('anon') |
97 cu = cnx.cursor() |
97 cu = cnx.cursor() |
98 self.repo.schema['Personne'].set_groups('read', ('users', 'managers')) |
98 self.repo.schema['Personne'].set_groups('read', ('users', 'managers')) |
99 self.repo.schema['Personne'].set_groups('add', ('guests', 'users', 'managers')) |
99 self.repo.schema['Personne'].set_groups('add', ('guests', 'users', 'managers')) |
107 cnx = self.login('iaminusersgrouponly') |
107 cnx = self.login('iaminusersgrouponly') |
108 cu = cnx.cursor() |
108 cu = cnx.cursor() |
109 cu.execute("INSERT Personne X: X nom 'biduuule'") |
109 cu.execute("INSERT Personne X: X nom 'biduuule'") |
110 cu.execute("INSERT Societe X: X nom 'looogilab'") |
110 cu.execute("INSERT Societe X: X nom 'looogilab'") |
111 cu.execute("SET X travaille S WHERE X nom 'biduuule', S nom 'looogilab'") |
111 cu.execute("SET X travaille S WHERE X nom 'biduuule', S nom 'looogilab'") |
112 |
112 |
113 def test_update_rql_permission(self): |
113 def test_update_rql_permission(self): |
114 self.execute("SET A concerne S WHERE A is Affaire, S is Societe") |
114 self.execute("SET A concerne S WHERE A is Affaire, S is Societe") |
115 self.commit() |
115 self.commit() |
116 # test user can only update une affaire related to a societe he owns |
116 # test user can only update une affaire related to a societe he owns |
117 cnx = self.login('iaminusersgrouponly') |
117 cnx = self.login('iaminusersgrouponly') |
119 cu.execute("SET X sujet 'pascool' WHERE X is Affaire") |
119 cu.execute("SET X sujet 'pascool' WHERE X is Affaire") |
120 # this won't actually do anything since the selection query won't return anything |
120 # this won't actually do anything since the selection query won't return anything |
121 cnx.commit() |
121 cnx.commit() |
122 # to actually get Unauthorized exception, try to update an entity we can read |
122 # to actually get Unauthorized exception, try to update an entity we can read |
123 cu.execute("SET X nom 'toto' WHERE X is Societe") |
123 cu.execute("SET X nom 'toto' WHERE X is Societe") |
124 self.assertRaises(Unauthorized, cnx.commit) |
124 self.assertRaises(Unauthorized, cnx.commit) |
125 cu.execute("INSERT Affaire X: X sujet 'pascool'") |
125 cu.execute("INSERT Affaire X: X sujet 'pascool'") |
126 cu.execute("INSERT Societe X: X nom 'chouette'") |
126 cu.execute("INSERT Societe X: X nom 'chouette'") |
127 cu.execute("SET A concerne S WHERE A sujet 'pascool', S nom 'chouette'") |
127 cu.execute("SET A concerne S WHERE A sujet 'pascool', S nom 'chouette'") |
128 cu.execute("SET X sujet 'habahsicestcool' WHERE X sujet 'pascool'") |
128 cu.execute("SET X sujet 'habahsicestcool' WHERE X sujet 'pascool'") |
129 cnx.commit() |
129 cnx.commit() |
130 |
130 |
131 def test_delete_security(self): |
131 def test_delete_security(self): |
132 # FIXME: sample below fails because we don't detect "owner" can't delete |
132 # FIXME: sample below fails because we don't detect "owner" can't delete |
133 # user anyway, and since no user with login == 'bidule' exists, no |
133 # user anyway, and since no user with login == 'bidule' exists, no |
134 # exception is raised |
134 # exception is raised |
135 #user._groups = {'guests':1} |
135 #user._groups = {'guests':1} |
137 # self.o.execute, user, "DELETE CWUser X WHERE X login 'bidule'") |
137 # self.o.execute, user, "DELETE CWUser X WHERE X login 'bidule'") |
138 # check local security |
138 # check local security |
139 cnx = self.login('iaminusersgrouponly') |
139 cnx = self.login('iaminusersgrouponly') |
140 cu = cnx.cursor() |
140 cu = cnx.cursor() |
141 self.assertRaises(Unauthorized, cu.execute, "DELETE CWGroup Y WHERE Y name 'staff'") |
141 self.assertRaises(Unauthorized, cu.execute, "DELETE CWGroup Y WHERE Y name 'staff'") |
142 |
142 |
143 def test_delete_rql_permission(self): |
143 def test_delete_rql_permission(self): |
144 self.execute("SET A concerne S WHERE A is Affaire, S is Societe") |
144 self.execute("SET A concerne S WHERE A is Affaire, S is Societe") |
145 self.commit() |
145 self.commit() |
146 # test user can only dele une affaire related to a societe he owns |
146 # test user can only dele une affaire related to a societe he owns |
147 cnx = self.login('iaminusersgrouponly') |
147 cnx = self.login('iaminusersgrouponly') |
148 cu = cnx.cursor() |
148 cu = cnx.cursor() |
149 # this won't actually do anything since the selection query won't return anything |
149 # this won't actually do anything since the selection query won't return anything |
150 cu.execute("DELETE Affaire X") |
150 cu.execute("DELETE Affaire X") |
151 cnx.commit() |
151 cnx.commit() |
152 # to actually get Unauthorized exception, try to delete an entity we can read |
152 # to actually get Unauthorized exception, try to delete an entity we can read |
153 self.assertRaises(Unauthorized, cu.execute, "DELETE Societe S") |
153 self.assertRaises(Unauthorized, cu.execute, "DELETE Societe S") |
154 cu.execute("INSERT Affaire X: X sujet 'pascool'") |
154 cu.execute("INSERT Affaire X: X sujet 'pascool'") |
225 cu.execute('SET X upassword %(passwd)s WHERE X eid %(x)s', |
225 cu.execute('SET X upassword %(passwd)s WHERE X eid %(x)s', |
226 {'x': ueid, 'passwd': 'newpwd'}, 'x') |
226 {'x': ueid, 'passwd': 'newpwd'}, 'x') |
227 self.assertRaises(Unauthorized, cnx.commit) |
227 self.assertRaises(Unauthorized, cnx.commit) |
228 |
228 |
229 # read security test |
229 # read security test |
230 |
230 |
231 def test_read_base(self): |
231 def test_read_base(self): |
232 self.schema['Personne'].set_groups('read', ('users', 'managers')) |
232 self.schema['Personne'].set_groups('read', ('users', 'managers')) |
233 cnx = self.login('anon') |
233 cnx = self.login('anon') |
234 cu = cnx.cursor() |
234 cu = cnx.cursor() |
235 self.assertRaises(Unauthorized, |
235 self.assertRaises(Unauthorized, |
254 # more cache test w/ NOT eid |
254 # more cache test w/ NOT eid |
255 rset = cu.execute('Affaire X WHERE NOT X eid %(x)s', {'x': eid}, 'x') |
255 rset = cu.execute('Affaire X WHERE NOT X eid %(x)s', {'x': eid}, 'x') |
256 self.assertEquals(rset.rows, [[aff2]]) |
256 self.assertEquals(rset.rows, [[aff2]]) |
257 rset = cu.execute('Affaire X WHERE NOT X eid %(x)s', {'x': aff2}, 'x') |
257 rset = cu.execute('Affaire X WHERE NOT X eid %(x)s', {'x': aff2}, 'x') |
258 self.assertEquals(rset.rows, []) |
258 self.assertEquals(rset.rows, []) |
259 |
259 |
260 def test_read_erqlexpr_has_text1(self): |
260 def test_read_erqlexpr_has_text1(self): |
261 aff1 = self.execute("INSERT Affaire X: X sujet 'cool'")[0][0] |
261 aff1 = self.execute("INSERT Affaire X: X sujet 'cool'")[0][0] |
262 card1 = self.execute("INSERT Card X: X title 'cool'")[0][0] |
262 card1 = self.execute("INSERT Card X: X title 'cool'")[0][0] |
263 self.execute('SET X owned_by U WHERE X eid %(x)s, U login "iaminusersgrouponly"', {'x': card1}, 'x') |
263 self.execute('SET X owned_by U WHERE X eid %(x)s, U login "iaminusersgrouponly"', {'x': card1}, 'x') |
264 self.commit() |
264 self.commit() |
284 cnx = self.login('iaminusersgrouponly') |
284 cnx = self.login('iaminusersgrouponly') |
285 cu = cnx.cursor() |
285 cu = cnx.cursor() |
286 rset = cu.execute('Any N WHERE N has_text "bidule"') |
286 rset = cu.execute('Any N WHERE N has_text "bidule"') |
287 self.assertEquals(len(rset.rows), 1, rset.rows) |
287 self.assertEquals(len(rset.rows), 1, rset.rows) |
288 rset = cu.execute('Any N WITH N BEING (Any N WHERE N has_text "bidule")') |
288 rset = cu.execute('Any N WITH N BEING (Any N WHERE N has_text "bidule")') |
289 self.assertEquals(len(rset.rows), 1, rset.rows) |
289 self.assertEquals(len(rset.rows), 1, rset.rows) |
290 |
290 |
291 def test_read_erqlexpr_optional_rel(self): |
291 def test_read_erqlexpr_optional_rel(self): |
292 self.execute("INSERT Personne X: X nom 'bidule'") |
292 self.execute("INSERT Personne X: X nom 'bidule'") |
293 self.execute("INSERT Societe X: X nom 'bidule'") |
293 self.execute("INSERT Societe X: X nom 'bidule'") |
294 self.commit() |
294 self.commit() |
302 self.execute("INSERT Affaire X: X sujet 'cool'")[0][0] |
302 self.execute("INSERT Affaire X: X sujet 'cool'")[0][0] |
303 self.commit() |
303 self.commit() |
304 cnx = self.login('iaminusersgrouponly') |
304 cnx = self.login('iaminusersgrouponly') |
305 cu = cnx.cursor() |
305 cu = cnx.cursor() |
306 rset = cu.execute('Any COUNT(X) WHERE X is Affaire') |
306 rset = cu.execute('Any COUNT(X) WHERE X is Affaire') |
307 self.assertEquals(rset.rows, [[0]]) |
307 self.assertEquals(rset.rows, [[0]]) |
308 aff2 = cu.execute("INSERT Affaire X: X sujet 'cool'")[0][0] |
308 aff2 = cu.execute("INSERT Affaire X: X sujet 'cool'")[0][0] |
309 soc1 = cu.execute("INSERT Societe X: X nom 'chouette'")[0][0] |
309 soc1 = cu.execute("INSERT Societe X: X nom 'chouette'")[0][0] |
310 cu.execute("SET A concerne S WHERE A is Affaire, S is Societe") |
310 cu.execute("SET A concerne S WHERE A is Affaire, S is Societe") |
311 cnx.commit() |
311 cnx.commit() |
312 rset = cu.execute('Any COUNT(X) WHERE X is Affaire') |
312 rset = cu.execute('Any COUNT(X) WHERE X is Affaire') |
318 rset = cu.execute('Any ETN, COUNT(X) GROUPBY ETN WHERE X is ET, ET name ETN WITH X BEING ((Affaire X) UNION (Societe X))') |
318 rset = cu.execute('Any ETN, COUNT(X) GROUPBY ETN WHERE X is ET, ET name ETN WITH X BEING ((Affaire X) UNION (Societe X))') |
319 self.assertEquals(len(rset), 2) |
319 self.assertEquals(len(rset), 2) |
320 values = dict(rset) |
320 values = dict(rset) |
321 self.assertEquals(values['Affaire'], 1) |
321 self.assertEquals(values['Affaire'], 1) |
322 self.assertEquals(values['Societe'], 2) |
322 self.assertEquals(values['Societe'], 2) |
323 |
323 |
324 |
324 |
325 def test_attribute_security(self): |
325 def test_attribute_security(self): |
326 # only managers should be able to edit the 'test' attribute of Personne entities |
326 # only managers should be able to edit the 'test' attribute of Personne entities |
327 eid = self.execute("INSERT Personne X: X nom 'bidule', X web 'http://www.debian.org', X test TRUE")[0][0] |
327 eid = self.execute("INSERT Personne X: X nom 'bidule', X web 'http://www.debian.org', X test TRUE")[0][0] |
328 self.commit() |
328 self.commit() |
341 cu.execute('SET X test TRUE WHERE X eid %(x)s', {'x': eid}, 'x') |
341 cu.execute('SET X test TRUE WHERE X eid %(x)s', {'x': eid}, 'x') |
342 self.assertRaises(Unauthorized, cnx.commit) |
342 self.assertRaises(Unauthorized, cnx.commit) |
343 cu.execute('SET X web "http://www.logilab.org" WHERE X eid %(x)s', {'x': eid}, 'x') |
343 cu.execute('SET X web "http://www.logilab.org" WHERE X eid %(x)s', {'x': eid}, 'x') |
344 cnx.commit() |
344 cnx.commit() |
345 cnx.close() |
345 cnx.close() |
346 |
346 |
347 def test_attribute_security_rqlexpr(self): |
347 def test_attribute_security_rqlexpr(self): |
348 # Note.para attribute editable by managers or if the note is in "todo" state |
348 # Note.para attribute editable by managers or if the note is in "todo" state |
349 eid = self.execute("INSERT Note X: X para 'bidule', X in_state S WHERE S name 'done'")[0][0] |
349 eid = self.execute("INSERT Note X: X para 'bidule', X in_state S WHERE S name 'done'")[0][0] |
350 self.commit() |
350 self.commit() |
351 self.execute('SET X para "truc" WHERE X eid %(x)s', {'x': eid}, 'x') |
351 self.execute('SET X para "truc" WHERE X eid %(x)s', {'x': eid}, 'x') |
382 x.complete() |
382 x.complete() |
383 self.assertEquals(x.login, None) |
383 self.assertEquals(x.login, None) |
384 self.failUnless(x.creation_date) |
384 self.failUnless(x.creation_date) |
385 cnx.rollback() |
385 cnx.rollback() |
386 |
386 |
387 |
387 |
388 class BaseSchemaSecurityTC(BaseSecurityTC): |
388 class BaseSchemaSecurityTC(BaseSecurityTC): |
389 """tests related to the base schema permission configuration""" |
389 """tests related to the base schema permission configuration""" |
390 |
390 |
391 def test_user_can_delete_object_he_created(self): |
391 def test_user_can_delete_object_he_created(self): |
392 # even if some other user have changed object'state |
392 # even if some other user have changed object'state |
393 cnx = self.login('iaminusersgrouponly') |
393 cnx = self.login('iaminusersgrouponly') |
394 cu = cnx.cursor() |
394 cu = cnx.cursor() |
395 # due to security test, affaire has to concerne a societe the user owns |
395 # due to security test, affaire has to concerne a societe the user owns |
398 cnx.commit() |
398 cnx.commit() |
399 self.restore_connection() |
399 self.restore_connection() |
400 self.execute('SET X in_state S WHERE X ref "ARCT01", S name "ben non"') |
400 self.execute('SET X in_state S WHERE X ref "ARCT01", S name "ben non"') |
401 self.commit() |
401 self.commit() |
402 self.assertEquals(len(self.execute('TrInfo X WHERE X wf_info_for A, A ref "ARCT01"')), |
402 self.assertEquals(len(self.execute('TrInfo X WHERE X wf_info_for A, A ref "ARCT01"')), |
403 2) |
403 2) |
404 self.assertEquals(len(self.execute('TrInfo X WHERE X wf_info_for A, A ref "ARCT01",' |
404 self.assertEquals(len(self.execute('TrInfo X WHERE X wf_info_for A, A ref "ARCT01",' |
405 'X owned_by U, U login "admin"')), |
405 'X owned_by U, U login "admin"')), |
406 1) # TrInfo at the above state change |
406 1) # TrInfo at the above state change |
407 self.assertEquals(len(self.execute('TrInfo X WHERE X wf_info_for A, A ref "ARCT01",' |
407 self.assertEquals(len(self.execute('TrInfo X WHERE X wf_info_for A, A ref "ARCT01",' |
408 'X owned_by U, U login "iaminusersgrouponly"')), |
408 'X owned_by U, U login "iaminusersgrouponly"')), |
424 self.assertEquals(rset.rows, [[anon.eid]]) |
424 self.assertEquals(rset.rows, [[anon.eid]]) |
425 # anonymous user can read groups (necessary to check allowed transitions for instance) |
425 # anonymous user can read groups (necessary to check allowed transitions for instance) |
426 self.assert_(cu.execute('CWGroup X')) |
426 self.assert_(cu.execute('CWGroup X')) |
427 # should only be able to read the anonymous user, not another one |
427 # should only be able to read the anonymous user, not another one |
428 origuser = self.session.user |
428 origuser = self.session.user |
429 self.assertRaises(Unauthorized, |
429 self.assertRaises(Unauthorized, |
430 cu.execute, 'CWUser X WHERE X eid %(x)s', {'x': origuser.eid}, 'x') |
430 cu.execute, 'CWUser X WHERE X eid %(x)s', {'x': origuser.eid}, 'x') |
431 # nothing selected, nothing updated, no exception raised |
431 # nothing selected, nothing updated, no exception raised |
432 #self.assertRaises(Unauthorized, |
432 #self.assertRaises(Unauthorized, |
433 # cu.execute, 'SET X login "toto" WHERE X eid %(x)s', |
433 # cu.execute, 'SET X login "toto" WHERE X eid %(x)s', |
434 # {'x': self.user.eid}) |
434 # {'x': self.user.eid}) |
435 |
435 |
436 rset = cu.execute('CWUser X WHERE X eid %(x)s', {'x': anon.eid}, 'x') |
436 rset = cu.execute('CWUser X WHERE X eid %(x)s', {'x': anon.eid}, 'x') |
437 self.assertEquals(rset.rows, [[anon.eid]]) |
437 self.assertEquals(rset.rows, [[anon.eid]]) |
438 # but can't modify it |
438 # but can't modify it |
439 cu.execute('SET X login "toto" WHERE X eid %(x)s', {'x': anon.eid}) |
439 cu.execute('SET X login "toto" WHERE X eid %(x)s', {'x': anon.eid}) |
440 self.assertRaises(Unauthorized, cnx.commit) |
440 self.assertRaises(Unauthorized, cnx.commit) |
441 |
441 |
442 def test_in_group_relation(self): |
442 def test_in_group_relation(self): |
443 cnx = self.login('iaminusersgrouponly') |
443 cnx = self.login('iaminusersgrouponly') |
444 cu = cnx.cursor() |
444 cu = cnx.cursor() |
445 rql = u"DELETE U in_group G WHERE U login 'admin'" |
445 rql = u"DELETE U in_group G WHERE U login 'admin'" |
446 self.assertRaises(Unauthorized, cu.execute, rql) |
446 self.assertRaises(Unauthorized, cu.execute, rql) |
452 self.commit() |
452 self.commit() |
453 cnx = self.login('iaminusersgrouponly') |
453 cnx = self.login('iaminusersgrouponly') |
454 cu = cnx.cursor() |
454 cu = cnx.cursor() |
455 rql = u"SET X owned_by U WHERE U login 'iaminusersgrouponly', X is Personne" |
455 rql = u"SET X owned_by U WHERE U login 'iaminusersgrouponly', X is Personne" |
456 self.assertRaises(Unauthorized, cu.execute, rql) |
456 self.assertRaises(Unauthorized, cu.execute, rql) |
457 |
457 |
458 def test_bookmarked_by_guests_security(self): |
458 def test_bookmarked_by_guests_security(self): |
459 beid1 = self.execute('INSERT Bookmark B: B path "?vid=manage", B title "manage"')[0][0] |
459 beid1 = self.execute('INSERT Bookmark B: B path "?vid=manage", B title "manage"')[0][0] |
460 beid2 = self.execute('INSERT Bookmark B: B path "?vid=index", B title "index", B bookmarked_by U WHERE U login "anon"')[0][0] |
460 beid2 = self.execute('INSERT Bookmark B: B path "?vid=index", B title "index", B bookmarked_by U WHERE U login "anon"')[0][0] |
461 self.commit() |
461 self.commit() |
462 cnx = self.login('anon') |
462 cnx = self.login('anon') |
473 [[beid1]]) |
473 [[beid1]]) |
474 self.assertRaises(Unauthorized, cu.execute,'DELETE B bookmarked_by U') |
474 self.assertRaises(Unauthorized, cu.execute,'DELETE B bookmarked_by U') |
475 self.assertRaises(Unauthorized, |
475 self.assertRaises(Unauthorized, |
476 cu.execute, 'SET B bookmarked_by U WHERE U eid %(x)s, B eid %(b)s', |
476 cu.execute, 'SET B bookmarked_by U WHERE U eid %(x)s, B eid %(b)s', |
477 {'x': anoneid, 'b': beid1}, 'x') |
477 {'x': anoneid, 'b': beid1}, 'x') |
478 |
478 |
479 |
479 |
480 def test_ambigous_ordered(self): |
480 def test_ambigous_ordered(self): |
481 cnx = self.login('anon') |
481 cnx = self.login('anon') |
482 cu = cnx.cursor() |
482 cu = cnx.cursor() |
483 names = [t for t, in cu.execute('Any N ORDERBY lower(N) WHERE X name N')] |
483 names = [t for t, in cu.execute('Any N ORDERBY lower(N) WHERE X name N')] |
492 cnx = self.login('iaminusersgrouponly') |
492 cnx = self.login('iaminusersgrouponly') |
493 session = self.current_session() |
493 session = self.current_session() |
494 # needed to avoid check_perm error |
494 # needed to avoid check_perm error |
495 session.set_pool() |
495 session.set_pool() |
496 # needed to remove rql expr granting update perm to the user |
496 # needed to remove rql expr granting update perm to the user |
497 self.schema['Affaire'].set_rqlexprs('update', ()) |
497 self.schema['Affaire'].set_rqlexprs('update', ()) |
498 self.assertRaises(Unauthorized, |
498 self.assertRaises(Unauthorized, |
499 self.schema['Affaire'].check_perm, session, 'update', eid) |
499 self.schema['Affaire'].check_perm, session, 'update', eid) |
500 cu = cnx.cursor() |
500 cu = cnx.cursor() |
501 cu.execute('SET X in_state S WHERE X ref "ARCT01", S name "abort"') |
501 cu.execute('SET X in_state S WHERE X ref "ARCT01", S name "abort"') |
502 cnx.commit() |
502 cnx.commit() |
504 rql = u"SET X in_state S WHERE X eid %(x)s, S name 'deactivated'" |
504 rql = u"SET X in_state S WHERE X eid %(x)s, S name 'deactivated'" |
505 # XXX wether it should raise Unauthorized or ValidationError is not clear |
505 # XXX wether it should raise Unauthorized or ValidationError is not clear |
506 # the best would probably ValidationError if the transition doesn't exist |
506 # the best would probably ValidationError if the transition doesn't exist |
507 # from the current state but Unauthorized if it exists but user can't pass it |
507 # from the current state but Unauthorized if it exists but user can't pass it |
508 self.assertRaises(ValidationError, cu.execute, rql, {'x': cnx.user(self.current_session()).eid}, 'x') |
508 self.assertRaises(ValidationError, cu.execute, rql, {'x': cnx.user(self.current_session()).eid}, 'x') |
509 |
509 |
510 if __name__ == '__main__': |
510 if __name__ == '__main__': |
511 unittest_main() |
511 unittest_main() |