author | Christophe de Vienne <christophe@unlish.com> |
Sat, 30 Jan 2016 23:06:18 +0100 | |
changeset 11097 | 900c27ea30e9 |
parent 10388 | 90fcddcce166 |
permissions | -rw-r--r-- |
# copyright 2015 LOGILAB S.A. (Paris, FRANCE), all rights reserved. # contact http://www.logilab.fr/ -- mailto:contact@logilab.fr # # This file is part of CubicWeb. # # CubicWeb is free software: you can redistribute it and/or modify it under the # terms of the GNU Lesser General Public License as published by the Free # Software Foundation, either version 2.1 of the License, or (at your option) # any later version. # # CubicWeb is distributed in the hope that it will be useful, but WITHOUT # ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS # FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more # details. # # You should have received a copy of the GNU Lesser General Public License along # with CubicWeb. If not, see <http://www.gnu.org/licenses/>. from cubicweb.devtools.testlib import CubicWebTC from cubicweb.server import hook from cubicweb.predicates import is_instance class SecurityHooksTC(CubicWebTC): def setup_database(self): with self.admin_access.repo_cnx() as cnx: self.add_eid = cnx.create_entity('EmailAddress', address=u'hop@perdu.com', reverse_use_email=cnx.user.eid).eid cnx.commit() def test_inlined_cw_edited_relation(self): """modification of cw_edited to add an inlined relation shouldn't trigger a security error. Test for https://www.cubicweb.org/ticket/5477315 """ sender = self.repo.schema['Email'].rdef('sender') with self.temporary_permissions((sender, {'add': ()})): class MyHook(hook.Hook): __regid__ = 'test.pouet' __select__ = hook.Hook.__select__ & is_instance('Email') events = ('before_add_entity',) def __call__(self): self.entity.cw_edited['sender'] = self._cw.user.primary_email[0].eid with self.temporary_appobjects(MyHook): with self.admin_access.repo_cnx() as cnx: email = cnx.create_entity('Email', messageid=u'1234') cnx.commit() self.assertEqual(email.sender[0].eid, self.add_eid) if __name__ == '__main__': from logilab.common.testlib import unittest_main unittest_main()