darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-08-17 21:19:38 -04:00
Code Issues Packages Projects Releases Wiki Activity

Fix for security hole with setting session['user_id'] before second factor of authentication has been authorised.

Browse Source
This commit is contained in:
Nicholas Staples
2016-01-07 12:43:10 +00:00
parent 10c2978f85
commit 7001d8261d
17 changed files with 162 additions and 119 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
tests/app/main/views/test_two_factor.py
View File

@@ -6,7 +6,13 @@ from tests.app.main import create_test_user
def test_should_render_two_factor_page(notifications_admin, notifications_admin_db, notify_db_session):
with notifications_admin.test_request_context():
response = notifications_admin.test_client().get(url_for('main.two_factor'))
with notifications_admin.test_client() as client:
# TODO this lives here until we work out how to
# reassign the session after it is lost mid register process
with client.session_transaction() as session:
user = create_test_user('pending')
session['user_email'] = user.email_address
response = client.get(url_for('main.two_factor'))
assert response.status_code == 200
assert '''We've sent you a text message with a verification code.''' in response.get_data(as_text=True)
@@ -16,7 +22,7 @@ def test_should_login_user_and_redirect_to_dashboard(notifications_admin, notifi
with notifications_admin.test_client() as client:
with client.session_transaction() as session:
user = create_test_user('active')
session['user_id'] = user.id
session['user_email'] = user.email_address
verify_codes_dao.add_code(user_id=user.id, code='12345', code_type='sms')
response = client.post(url_for('main.two_factor'),
data={'sms_code': '12345'})
@@ -32,7 +38,7 @@ def test_should_return_200_with_sms_code_error_when_sms_code_is_wrong(notificati
with notifications_admin.test_client() as client:
with client.session_transaction() as session:
user = create_test_user('active')
session['user_id'] = user.id
session['user_email'] = user.email_address
verify_codes_dao.add_code(user_id=user.id, code='12345', code_type='sms')
response = client.post(url_for('main.two_factor'),
data={'sms_code': '23456'})
@@ -47,7 +53,7 @@ def test_should_login_user_when_multiple_valid_codes_exist(notifications_admin,
with notifications_admin.test_client() as client:
with client.session_transaction() as session:
user = create_test_user('active')
session['user_id'] = user.id
session['user_email'] = user.email_address
verify_codes_dao.add_code(user_id=user.id, code='23456', code_type='sms')
verify_codes_dao.add_code(user_id=user.id, code='12345', code_type='sms')
verify_codes_dao.add_code(user_id=user.id, code='34567', code_type='sms')