darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-08-11 09:28:27 -04:00
Code Issues Packages Projects Releases Wiki Activity

Fix for security hole with setting session['user_id'] before second factor of authentication has been authorised.

Browse Source
This commit is contained in:
Nicholas Staples
2016-01-07 12:43:10 +00:00
parent 10c2978f85
commit 7001d8261d
17 changed files with 162 additions and 119 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
tests/app/main/test_two_factor_form.py
View File

@@ -9,8 +9,8 @@ def test_form_is_valid_returns_no_errors(notifications_admin, notifications_admi
with notifications_admin.test_request_context(method='POST',
data={'sms_code': '12345'}) as req:
user = set_up_test_data()
req.session['user_id'] = user.id
form = TwoFactorForm(req.request.form)
codes = verify_codes_dao.get_codes(user.id)
form = TwoFactorForm(codes)
assert form.validate() is True
assert len(form.errors) == 0
@@ -19,8 +19,8 @@ def test_returns_errors_when_code_is_too_short(notifications_admin, notification
with notifications_admin.test_request_context(method='POST',
data={'sms_code': '145'}) as req:
user = set_up_test_data()
req.session['user_id'] = user.id
form = TwoFactorForm(req.request.form)
codes = verify_codes_dao.get_codes(user.id)
form = TwoFactorForm(codes)
assert form.validate() is False
assert len(form.errors) == 1
assert set(form.errors) == set({'sms_code': ['Code must be 5 digits', 'Code does not match']})
@@ -30,8 +30,8 @@ def test_returns_errors_when_code_is_missing(notifications_admin, notifications_
with notifications_admin.test_request_context(method='POST',
data={}) as req:
user = set_up_test_data()
req.session['user_id'] = user.id
form = TwoFactorForm(req.request.form)
codes = verify_codes_dao.get_codes(user.id)
form = TwoFactorForm(codes)
assert form.validate() is False
assert len(form.errors) == 1
assert set(form.errors) == set({'sms_code': ['Code must not be empty']})
@@ -41,8 +41,8 @@ def test_returns_errors_when_code_contains_letters(notifications_admin, notifica
with notifications_admin.test_request_context(method='POST',
data={'sms_code': 'asdfg'}) as req:
user = set_up_test_data()
req.session['user_id'] = user.id
form = TwoFactorForm(req.request.form)
codes = verify_codes_dao.get_codes(user.id)
form = TwoFactorForm(codes)
assert form.validate() is False
assert len(form.errors) == 1
assert set(form.errors) == set({'sms_code': ['Code must be 5 digits', 'Code does not match']})
@@ -52,12 +52,12 @@ def test_should_return_errors_when_code_is_expired(notifications_admin, notifica
with notifications_admin.test_request_context(method='POST',
data={'sms_code': '23456'}) as req:
user = create_test_user('active')
req.session['user_id'] = user.id
verify_codes_dao.add_code_with_expiry(user_id=user.id,
code='23456',
code_type='sms',
expiry=datetime.now() + timedelta(hours=-2))
form = TwoFactorForm(req.request.form)
codes = verify_codes_dao.get_codes(user.id)
form = TwoFactorForm(codes)
assert form.validate() is False
errors = form.errors
assert len(errors) == 1