forked from CGM_Public/pretix_original
Add more thourough tests for the pretix control permission layer
This commit is contained in:
Raphael Michel
@@ -1,69 +1,148 @@
|
||||
from django.test import TestCase, Client
|
||||
from datetime import timedelta
|
||||
from django.test import Client, TestCase
|
||||
from django.utils.timezone import now
|
||||
import pytest
|
||||
|
||||
from pretix.base.models import Event, Organizer, User, EventPermission
|
||||
from pretix.base.models import Event, Organizer, User, EventPermission, Order
|
||||
|
||||
|
||||
class PermissionMiddlewareTest(TestCase):
|
||||
"""
|
||||
This test case tests various methods around the properties /
|
||||
variations concept.
|
||||
"""
|
||||
@pytest.fixture
|
||||
def env():
|
||||
o = Organizer.objects.create(name='Dummy', slug='dummy')
|
||||
event = Event.objects.create(
|
||||
organizer=o, name='Dummy', slug='dummy',
|
||||
date_from=now(), plugins='pretix.plugins.banktransfer'
|
||||
)
|
||||
user = User.objects.create_user('dummy@dummy.dummy', 'dummy@dummy.dummy', 'dummy')
|
||||
Order.objects.create(
|
||||
code='FOO', event=event,
|
||||
user=user, status=Order.STATUS_PENDING,
|
||||
datetime=now(), expires=now() + timedelta(days=10),
|
||||
total=0, payment_provider='banktransfer'
|
||||
)
|
||||
return event, user
|
||||
|
||||
def setUp(self):
|
||||
o = Organizer.objects.create(name='Dummy', slug='dummy')
|
||||
self.event = Event.objects.create(
|
||||
organizer=o, name='Dummy', slug='dummy',
|
||||
date_from=now(),
|
||||
)
|
||||
self.user = User.objects.create_user('dummy@dummy.dummy', 'dummy@dummy.dummy', 'dummy')
|
||||
|
||||
def test_logged_out(self):
|
||||
c = Client()
|
||||
response = c.get('/control/login')
|
||||
self.assertEqual(response.status_code, 200)
|
||||
response = c.get('/control/events/')
|
||||
self.assertEqual(response.status_code, 302)
|
||||
event_urls = [
|
||||
"",
|
||||
"settings/",
|
||||
"settings/plugins",
|
||||
"settings/payment",
|
||||
"settings/tickets",
|
||||
"items/",
|
||||
"items/add",
|
||||
"items/abc/",
|
||||
"items/abc/variations",
|
||||
"items/abc/restrictions",
|
||||
"categories/",
|
||||
"categories/add",
|
||||
"categories/abc/",
|
||||
"categories/abc/up",
|
||||
"categories/abc/down",
|
||||
"categories/abc/delete",
|
||||
"questions/",
|
||||
"questions/abc/delete",
|
||||
"questions/abc/",
|
||||
"questions/add",
|
||||
"properties/",
|
||||
"properties/abc/delete",
|
||||
"properties/abc/",
|
||||
"properties/add",
|
||||
"quotas/",
|
||||
"quotas/abc/delete",
|
||||
"quotas/abc/",
|
||||
"quotas/add",
|
||||
"orders/ABC/transition",
|
||||
"orders/ABC/extend",
|
||||
"orders/ABC/",
|
||||
"orders/",
|
||||
]
|
||||
|
||||
def test_wrong_event(self):
|
||||
c = Client()
|
||||
response = c.post('/control/login', {
|
||||
'email': 'dummy@dummy.dummy',
|
||||
'password': 'dummy',
|
||||
})
|
||||
self.assertEqual(response.status_code, 302)
|
||||
|
||||
response = c.get('/control/event/dummy/dummy/settings/')
|
||||
self.assertIn(response.status_code, (403, 404))
|
||||
@pytest.mark.django_db
|
||||
@pytest.mark.parametrize("url", [
|
||||
"",
|
||||
"settings",
|
||||
"organizers/",
|
||||
"organizers/add",
|
||||
"organizer/dummy/edit",
|
||||
"events/",
|
||||
"events/add",
|
||||
"event/dummy/add",
|
||||
] + ['event/dummy/dummy/' + u for u in event_urls])
|
||||
def test_logged_out(client, env, url):
|
||||
client.logout()
|
||||
response = client.get('/control/' + url)
|
||||
assert response.status_code == 302
|
||||
assert "/control/login" in response['Location']
|
||||
|
||||
def test_wrong_event_permission(self):
|
||||
EventPermission.objects.create(
|
||||
event=self.event, user=self.user,
|
||||
can_change_settings=False,
|
||||
can_change_items=True,
|
||||
)
|
||||
c = Client()
|
||||
response = c.post('/control/login', {
|
||||
'email': 'dummy@dummy.dummy',
|
||||
'password': 'dummy',
|
||||
})
|
||||
self.assertEqual(response.status_code, 302)
|
||||
|
||||
response = c.get('/control/event/dummy/dummy/settings/')
|
||||
self.assertIn(response.status_code, (403, 404))
|
||||
@pytest.mark.django_db
|
||||
@pytest.mark.parametrize("url", event_urls)
|
||||
def test_wrong_event(client, env, url):
|
||||
client.login(identifier='dummy@dummy.dummy', password='dummy')
|
||||
response = client.get('/control/event/dummy/dummy/' + url)
|
||||
# These permission violations do not yield a 403 error, but
|
||||
# a 404 error to prevent information leakage
|
||||
assert response.status_code == 404
|
||||
|
||||
def test_correct(self):
|
||||
EventPermission.objects.create(
|
||||
event=self.event, user=self.user,
|
||||
can_change_settings=True,
|
||||
can_change_items=True,
|
||||
)
|
||||
c = Client()
|
||||
response = c.post('/control/login', {
|
||||
'email': 'dummy@dummy.dummy',
|
||||
'password': 'dummy',
|
||||
})
|
||||
self.assertEqual(response.status_code, 302)
|
||||
|
||||
response = c.get('/control/event/dummy/dummy/settings/')
|
||||
self.assertEqual(response.status_code, 200)
|
||||
event_permission_urls = [
|
||||
("can_change_settings", "settings/", 200),
|
||||
("can_change_settings", "settings/plugins", 200),
|
||||
("can_change_settings", "settings/payment", 200),
|
||||
("can_change_settings", "settings/tickets", 200),
|
||||
# Lists are currently not access-controlled
|
||||
# ("can_change_items", "items/", 200),
|
||||
("can_change_items", "items/add", 200),
|
||||
# ("can_change_items", "categories/", 200),
|
||||
# We don't have to create categories and similar objects
|
||||
# for testing this, it is enough to test that a 404 error
|
||||
# is returned instead of a 403 one.
|
||||
("can_change_items", "categories/abc/", 404),
|
||||
("can_change_items", "categories/abc/delete", 404),
|
||||
("can_change_items", "categories/add", 200),
|
||||
# ("can_change_items", "questions/", 200),
|
||||
("can_change_items", "questions/abc/", 404),
|
||||
("can_change_items", "questions/abc/delete", 404),
|
||||
("can_change_items", "questions/add", 200),
|
||||
# ("can_change_items", "properties/", 200),
|
||||
("can_change_items", "properties/abc/", 404),
|
||||
("can_change_items", "properties/abc/delete", 404),
|
||||
("can_change_items", "properties/add", 200),
|
||||
# ("can_change_items", "quotas/", 200),
|
||||
("can_change_items", "quotas/abc/", 404),
|
||||
("can_change_items", "quotas/abc/delete", 404),
|
||||
("can_change_items", "quotas/add", 200),
|
||||
("can_view_orders", "orders/overview/", 200),
|
||||
("can_view_orders", "orders/", 200),
|
||||
("can_view_orders", "orders/FOO/", 200),
|
||||
("can_change_orders", "orders/FOO/extend", 200),
|
||||
("can_change_orders", "orders/FOO/transition", 405),
|
||||
]
|
||||
|
||||
|
||||
@pytest.mark.django_db
|
||||
@pytest.mark.parametrize("perm,url,code", event_permission_urls)
|
||||
def test_wrong_event_permission(client, env, perm, url, code):
|
||||
ep = EventPermission(
|
||||
event=env[0], user=env[1],
|
||||
)
|
||||
setattr(ep, perm, False)
|
||||
ep.save()
|
||||
client.login(identifier='dummy@dummy.dummy', password='dummy')
|
||||
response = client.get('/control/event/dummy/dummy/' + url)
|
||||
assert response.status_code == 403
|
||||
|
||||
|
||||
@pytest.mark.django_db
|
||||
@pytest.mark.parametrize("perm,url,code", event_permission_urls)
|
||||
def test_correct_event_permission(client, env, perm, url, code):
|
||||
ep = EventPermission(
|
||||
event=env[0], user=env[1],
|
||||
)
|
||||
setattr(ep, perm, True)
|
||||
ep.save()
|
||||
client.login(identifier='dummy@dummy.dummy', password='dummy')
|
||||
response = client.get('/control/event/dummy/dummy/' + url)
|
||||
assert response.status_code == code
|
||||
|
||||
Reference in New Issue
Block a user