cubicweb/hooks/test/unittest_security.py
author Denis Laxalde <denis.laxalde@logilab.fr>
Sat, 16 Jan 2016 13:48:51 +0100
changeset 11057 0b59724cb3f2
parent 10388 hooks/test/unittest_security.py@90fcddcce166
child 11911 37726f66ff82
permissions -rw-r--r--
Reorganize source tree to have a "cubicweb" top-level package Basically: mkdir cubicweb hg mv *.py -X setup.py cubicweb hg mv dataimport devtools entities etwist ext hooks i18n misc schemas server skeleton sobjects test web wsgi cubicweb Other changes: * adjust path to cubicweb-ctl in devtools tests * update setup.py to avoid importing __pkginfo__ (exec it instead), replace os.path.walk by os.walk and prepend `modname` here and there * update tox.ini to account for new test locations * update doc/conf.py so that it still finds __pkginfo__.py and CWDIR in doc/Makefile

# copyright 2015 LOGILAB S.A. (Paris, FRANCE), all rights reserved.
# contact http://www.logilab.fr/ -- mailto:contact@logilab.fr
#
# This file is part of CubicWeb.
#
# CubicWeb is free software: you can redistribute it and/or modify it under the
# terms of the GNU Lesser General Public License as published by the Free
# Software Foundation, either version 2.1 of the License, or (at your option)
# any later version.
#
# CubicWeb is distributed in the hope that it will be useful, but WITHOUT
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
# FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
# details.
#
# You should have received a copy of the GNU Lesser General Public License along
# with CubicWeb.  If not, see <http://www.gnu.org/licenses/>.

from cubicweb.devtools.testlib import CubicWebTC
from cubicweb.server import hook
from cubicweb.predicates import is_instance


class SecurityHooksTC(CubicWebTC):
    def setup_database(self):
        with self.admin_access.repo_cnx() as cnx:
            self.add_eid = cnx.create_entity('EmailAddress',
                                             address=u'hop@perdu.com',
                                             reverse_use_email=cnx.user.eid).eid
            cnx.commit()

    def test_inlined_cw_edited_relation(self):
        """modification of cw_edited to add an inlined relation shouldn't trigger a security error.

        Test for https://www.cubicweb.org/ticket/5477315
        """
        sender = self.repo.schema['Email'].rdef('sender')
        with self.temporary_permissions((sender, {'add': ()})):

            class MyHook(hook.Hook):
                __regid__ = 'test.pouet'
                __select__ = hook.Hook.__select__ & is_instance('Email')
                events = ('before_add_entity',)

                def __call__(self):
                    self.entity.cw_edited['sender'] = self._cw.user.primary_email[0].eid

            with self.temporary_appobjects(MyHook):
                with self.admin_access.repo_cnx() as cnx:
                    email = cnx.create_entity('Email', messageid=u'1234')
                    cnx.commit()
                    self.assertEqual(email.sender[0].eid, self.add_eid)

if __name__ == '__main__':
    from logilab.common.testlib import unittest_main
    unittest_main()