mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 19:26:48 +00:00
3210ef2eee
Django's login form gives the username its max_length after the field is built, so a longer username was not refused and reached authentication. django-axes then stored it in its 255-character column, which PostgreSQL refuses: a login with a 300-character username was a 500 (SQLite does not enforce the length). Both login forms, with and without OTP, now check the length, so such a username is a form error and never reaches authentication, the lockout or the Logs page. This also turns the PostgreSQL leg of CI green again: the S-16 test from #167 hit exactly this.
86 lines
3.8 KiB
Python
86 lines
3.8 KiB
Python
"""Logins, failed logins, lockouts and logouts write rows on the Logs page."""
|
|
|
|
from appsettings.models import AppSettings
|
|
from django.contrib.auth import get_user_model
|
|
from django.test import TestCase, override_settings
|
|
from django.urls import reverse
|
|
|
|
from logs.models import Logs
|
|
|
|
|
|
def rows():
|
|
return list(Logs.objects.order_by("id").values_list("user", "host", "message", "success", "ip"))
|
|
|
|
|
|
@override_settings(OTP_ENABLED=False)
|
|
class LoginRowsTests(TestCase):
|
|
def setUp(self):
|
|
get_user_model().objects.create_user("bob", password="right-pass-1")
|
|
AppSettings.objects.filter(key="LOGIN_FAILURE_LIMIT").update(value="3")
|
|
|
|
def login(self, password, username="bob"):
|
|
return self.client.post(reverse("accounts:login"), {"username": username, "password": password})
|
|
|
|
def test_a_login_and_a_logout_write_rows(self):
|
|
self.assertEqual(self.login("right-pass-1").status_code, 302)
|
|
self.client.post(reverse("accounts:logout"))
|
|
self.assertEqual(rows(), [
|
|
("bob", "-", "Login", True, "127.0.0.1"),
|
|
("bob", "-", "Logout", True, "127.0.0.1"),
|
|
])
|
|
|
|
def test_a_failed_login_writes_the_typed_username(self):
|
|
self.assertEqual(self.login("wrong").status_code, 200)
|
|
self.assertEqual(rows(), [("bob", "-", "Login failed", False, "127.0.0.1")])
|
|
|
|
def test_an_empty_username_is_no_attempt(self):
|
|
# the form stops it before authentication: no row and no error
|
|
self.assertEqual(self.login("wrong", username="").status_code, 200)
|
|
self.assertEqual(rows(), [])
|
|
|
|
def test_the_attempt_at_the_limit_and_one_while_locked(self):
|
|
self.login("wrong")
|
|
self.login("wrong")
|
|
self.assertEqual(self.login("wrong").status_code, 429)
|
|
# django-axes sends the lockout from its own failure receiver, before ours
|
|
messages = [r[2] for r in rows()]
|
|
self.assertEqual(messages, ["Login failed", "Login failed", "Locked out", "Login failed"])
|
|
|
|
self.assertEqual(self.login("right-pass-1").status_code, 429)
|
|
self.assertEqual([r[2] for r in rows()][4:], ["Locked out", "Login failed"])
|
|
self.assertTrue(all(r[0] == "bob" and r[3] is False for r in rows()))
|
|
|
|
|
|
@override_settings(OTP_ENABLED=False)
|
|
class LoginRowInputTests(TestCase):
|
|
"""S-16: what a failed login writes cannot break the row or forge another record."""
|
|
|
|
def login(self, username):
|
|
return self.client.post(reverse("accounts:login"), {"username": username, "password": "wrong"})
|
|
|
|
def test_an_oversized_username_is_refused_by_the_form(self):
|
|
# longer than the username field: no login attempt, so nothing for
|
|
# django-axes to store (its 255-character column refused it on PostgreSQL)
|
|
response = self.login("x" * 300)
|
|
self.assertEqual(response.status_code, 200)
|
|
self.assertIn("username", response.context["form"].errors)
|
|
self.assertFalse(Logs.objects.exists())
|
|
|
|
def test_a_crlf_username_stays_in_its_row(self):
|
|
forged = "bob\r\nadmin - Login"
|
|
self.login(forged)
|
|
self.assertEqual(rows(), [(forged, "-", "Login failed", False, "127.0.0.1")])
|
|
admin = get_user_model().objects.create_superuser("s16-admin", "s16@example.com", "pw")
|
|
self.client.force_login(admin)
|
|
page = self.client.get(reverse("admin:logs")).content.decode()
|
|
self.assertEqual(page.count("Login failed"), 1)
|
|
|
|
def test_a_crlf_username_is_one_line_in_the_file_log(self):
|
|
from unittest.mock import patch
|
|
|
|
with patch.object(Logs.objects, "create", side_effect=RuntimeError("db down")), \
|
|
self.assertLogs("logs.audit", "WARNING") as logged:
|
|
self.login("bob\r\nforged record")
|
|
[line] = logged.output
|
|
self.assertNotIn("\r", line)
|
|
self.assertNotIn("\n", line)
|