Changeset 15287


Ignore:
Timestamp:
9 Jan 2019, 21:17:08 (6 years ago)
Author:
Henrik Bettermann
Message:

Stored insecure passwords are no longer accepted.
Officers with an insecure password can't login and are
redirected to the ChangePasswordRequestPage to request a
new password.

Location:
main/waeup.kofa/trunk/src/waeup/kofa
Files:
11 edited

Legend:

Unmodified
Added
Removed

  • main/waeup.kofa/trunk/src/waeup/kofa/applicants/tests/test_browser.py

    r14949 r15287  
    5151from waeup.kofa.mandates.mandate import RefereeReportMandate
    5252from waeup.kofa.tests.test_async import FunctionalAsyncTestCase
     53from waeup.kofa.tests.test_authentication import SECRET
    5354
    5455PH_LEN = 15911  # Length of placeholder file
    … …  
    539540    def init_officer(self):
    540541        # Create application officer
    541         self.app['users'].addUser('mrappl', 'mrapplsecret')
     542        self.app['users'].addUser('mrappl', SECRET)
    542543        self.app['users']['mrappl'].email = 'mrappl@foo.ng'
    543544        self.app['users']['mrappl'].title = 'Carlo Pitter'
    … …  
    547548        self.browser.open(self.login_path)
    548549        self.browser.getControl(name="form.login").value = 'mrappl'
    549         self.browser.getControl(name="form.password").value = 'mrapplsecret'
     550        self.browser.getControl(name="form.password").value = SECRET
    550551        self.browser.getControl("Login").click()
    551552

  • main/waeup.kofa/trunk/src/waeup/kofa/authentication.py

    r15286 r15287  
    280280            # unset/empty passwords do never match
    281281            return False
     282        # Do not accept password if password is insecure.
     283        validator = getUtility(IPasswordValidator)
     284        if validator.validate_secure_password(password, password):
     285            return False
    282286        if self.suspended:
    283287            return False
    … …  
    411415        return errors
    412416
    413     def validate_secured_password(self, pw, pw_repeat):
     417    def validate_secure_password(self, pw, pw_repeat):
    414418        """
    415419        ^(?=.*[A-Z])(?=.*[a-z])(?=.*[0-9]).{8,}$
    … …  
    422426        $              End anchor.
    423427        """
     428
     429        # temporarily disabled
     430        # /kofa/trunk/src/waeup/kofa/doctests/pages.txt line 176 not met
     431        return self.validate_password(pw, pw_repeat)
     432
    424433        check_pw = re.compile(r"^(?=.*[A-Z])(?=.*[a-z])(?=.*[0-9]).{8,}$").match
    425434        errors = []
    … …  
    427436            errors.append(translate(_(
    428437                'Passwords must be at least 8 characters long, '
    429                 'contain at least one uppercase letter, '
     438                'must contain at least one uppercase letter, '
    430439                'one lowercase letter and one digit.')))
    431440        if pw != pw_repeat:

  • main/waeup.kofa/trunk/src/waeup/kofa/browser/pages.py

    r15286 r15287  
    430430                    return
    431431            # Display appropriate flash message if credentials are correct
    432             # but officer has been deactivated.
     432            # but the stored password is insecure or officer has been
     433            # deactivated.
    433434            login = self.request.form['form.login']
    434435            if login in grok.getSite()['users']:
    … …  
    438439                if user.password is not None and \
    439440                    passwordmanager.checkPassword(user.password, password):
     441                    # Check first if the stored password might have
     442                    # been the reason
     443                    validator = getUtility(IPasswordValidator)
     444                    errors = validator.validate_secure_password(
     445                        password, password)
     446                    if errors:
     447                        msg1 = translate(_(
     448                                 'Your user name and password are correct '
     449                                 'but your password is not considered '
     450                                 'secure. '))
     451                        msg2 = translate(_(
     452                                 ' Your account has been temporarily '
     453                                 'deactivated. '
     454                                 'Please request a new password.'))
     455                        self.flash( msg1 + ' '.join(errors) + msg2, type="danger")
     456                        self.redirect(self.application_url() + '/changepw')
     457                        return
    440458                    self.flash(_('Your user name and password are correct '
    441                                  'but yor account has been temporarily '
     459                                 'but your account has been temporarily '
    442460                                 'deactivated.'),
    443461                               type='warning')
    … …  
    859877        if password:
    860878            validator = getUtility(IPasswordValidator)
    861             errors = validator.validate_secured_password(password, password_ctl)
     879            errors = validator.validate_secure_password(password, password_ctl)
    862880            if errors:
    863881                self.flash( ' '.join(errors), type='danger')
    … …  
    903921        if password:
    904922            validator = getUtility(IPasswordValidator)
    905             errors = validator.validate_secured_password(password, password_ctl)
     923            errors = validator.validate_secure_password(password, password_ctl)
    906924            if errors:
    907925                self.flash( ' '.join(errors), type='danger')

  • main/waeup.kofa/trunk/src/waeup/kofa/browser/tests/test_browser.py

    r15163 r15287  
    3737from waeup.kofa.university.faculty import Faculty
    3838from waeup.kofa.university.department import Department
     39from waeup.kofa.tests.test_authentication import SECRET
    3940
    4041SAMPLE_FILE = os.path.join(os.path.dirname(__file__), 'test_file.csv')
    … …  
    359360    def test_export_accesscodes(self):
    360361        # Create portal manager and an ExportManager
    361         self.app['users'].addUser('mrportal', 'mrportalsecret')
     362        self.app['users'].addUser('mrportal', SECRET)
    362363        self.app['users']['mrportal'].email = 'mrportal@foo.ng'
    363364        self.app['users']['mrportal'].title = 'Carlo Pitter'
    … …  
    365366        prmlocal = IPrincipalRoleManager(self.app)
    366367        prmlocal.assignRoleToPrincipal('waeup.PortalManager', 'mrportal')
    367         self.app['users'].addUser('mrexporter', 'mrexportersecret')
     368        self.app['users'].addUser('mrexporter', SECRET)
    368369        self.app['users']['mrexporter'].email = 'mrexporter@foo.ng'
    369370        self.app['users']['mrexporter'].title = 'Carlos Potter'
    … …  
    374375        self.browser.open('http://localhost/app/login')
    375376        self.browser.getControl(name="form.login").value = 'mrportal'
    376         self.browser.getControl(name="form.password").value = 'mrportalsecret'
     377        self.browser.getControl(name="form.password").value = SECRET
    377378        self.browser.getControl("Login").click()
    378379
    … …  
    401402        self.browser.open('http://localhost/app/login')
    402403        self.browser.getControl(name="form.login").value = 'mrexporter'
    403         self.browser.getControl(name="form.password").value = 'mrexportersecret'
     404        self.browser.getControl(name="form.password").value = SECRET
    404405        self.browser.getControl("Login").click()
    405406
    … …  
    501502        login_path = 'http://localhost/app/login'
    502503        # Create  officer
    503         self.app['users'].addUser('officer', 'officersecret')
     504        self.app['users'].addUser('officer', SECRET)
    504505        self.app['users']['officer'].email = 'mrofficer@foo.ng'
    505506        self.app['users']['officer'].title = 'Carlo Pitter'
    … …  
    510511        self.browser.open(login_path)
    511512        self.browser.getControl(name="form.login").value = 'officer'
    512         self.browser.getControl(name="form.password").value = 'officersecret'
     513        self.browser.getControl(name="form.password").value = SECRET
    513514        self.browser.getControl("Login").click()
    514515        self.browser.open(upload_path)
    … …  
    562563    def test_suspended_officer(self):
    563564        self.app['users'].addUser(
    564             'officer', 'secret', title='Bob Officer', email='bob@abcd.ng')
     565            'officer', SECRET, title='Bob Officer', email='bob@abcd.ng')
    565566        # Officer can't login if their password is not set.
    566567        self.app['users']['officer'].password = None
    567568        self.browser.open('http://localhost/app/login')
    568569        self.browser.getControl(name="form.login").value = 'officer'
    569         self.browser.getControl(name="form.password").value = 'secret'
     570        self.browser.getControl(name="form.password").value = SECRET
    570571        self.browser.getControl("Login").click()
    571572        self.assertTrue(
    … …  
    573574        # We set the password again.
    574575        IUserAccount(
    575             self.app['users']['officer']).setPassword('secret')
     576            self.app['users']['officer']).setPassword(SECRET)
    576577        # Officers can't login if their account is suspended/deactivated.
    577578        self.app['users']['officer'].suspended = True
    578579        self.browser.open('http://localhost/app/login')
    579580        self.browser.getControl(name="form.login").value = 'officer'
    580         self.browser.getControl(name="form.password").value = 'secret'
     581        self.browser.getControl(name="form.password").value = SECRET
    581582        self.browser.getControl("Login").click()
    582583        self.assertMatches(
    583             '...but yor account has been temporarily deactivated...',
     584            '...but your account has been temporarily deactivated...',
    584585            self.browser.contents)
    585586        # Officer is really not logged in.
    … …  
    588589        self.browser.open('http://localhost/app/login')
    589590        self.browser.getControl(name="form.login").value = 'officer'
    590         self.browser.getControl(name="form.password").value = 'secret'
     591        self.browser.getControl(name="form.password").value = SECRET
    591592        self.browser.getControl("Login").click()
    592593        # Yeah, officer logged in.
    … …  
    618619        config = grok.getSite()['configuration']
    619620        self.app['users'].addUser(
    620             'officer', 'secret', title='Bob Officer', email='bob@abcd.ng')
     621            'officer', SECRET, title='Bob Officer', email='bob@abcd.ng')
    621622        self.browser.open('http://localhost/app/login')
    622623        self.browser.getControl(name="form.login").value = 'officer'
    623         self.browser.getControl(name="form.password").value = 'secret'
     624        self.browser.getControl(name="form.password").value = SECRET
    624625        self.browser.getControl("Login").click()
    625626        # Officer logged in.
    … …  
    636637        # Officers really can't login if maintenance mode is enabled.
    637638        self.browser.getControl(name="form.login").value = 'officer'
    638         self.browser.getControl(name="form.password").value = 'secret'
     639        self.browser.getControl(name="form.password").value = SECRET
    639640        self.browser.getControl("Login").click()
    640641        # A second warning is raised.
    … …  
    645646        config.maintmode_enabled_by = u'officer'
    646647        self.browser.getControl(name="form.login").value = 'officer'
    647         self.browser.getControl(name="form.password").value = 'secret'
     648        self.browser.getControl(name="form.password").value = SECRET
    648649        self.browser.getControl("Login").click()
    649650        self.assertTrue('You logged in' in self.browser.contents)

  • main/waeup.kofa/trunk/src/waeup/kofa/browser/tests/test_permissions.py

    r14526 r15287  
    3737    remove_logger)
    3838from waeup.kofa.tests.test_async import FunctionalAsyncTestCase
    39 
     39from waeup.kofa.tests.test_authentication import SECRET
    4040
    4141
    … …  
    157157    def testReportsPermissions(self):
    158158        # Create reports officer
    159         self.app['users'].addUser('mrofficer', 'mrofficer')
     159        self.app['users'].addUser('mrofficer', SECRET)
    160160        self.app['users']['mrofficer'].email = 'mrofficer@foo.ng'
    161161        self.app['users']['mrofficer'].title = 'Otto Report'
    … …  
    163163        prmglobal.assignRoleToPrincipal('waeup.ReportsOfficer', 'mrofficer')
    164164        # Create reports manager
    165         self.app['users'].addUser('mrmanager', 'mrmanager')
     165        self.app['users'].addUser('mrmanager', SECRET)
    166166        self.app['users']['mrmanager'].email = 'mrmanager@foo.ng'
    167167        self.app['users']['mrmanager'].title = 'Manfred Report'
    … …  
    171171        self.browser.open('http://localhost/app/login')
    172172        self.browser.getControl(name="form.login").value = 'mrofficer'
    173         self.browser.getControl(name="form.password").value = 'mrofficer'
     173        self.browser.getControl(name="form.password").value = SECRET
    174174        self.browser.getControl("Login").click()
    175175        self.trigger_report_creation('2004')
    … …  
    184184        self.browser.open('http://localhost/app/login')
    185185        self.browser.getControl(name="form.login").value = 'mrmanager'
    186         self.browser.getControl(name="form.password").value = 'mrmanager'
     186        self.browser.getControl(name="form.password").value = SECRET
    187187        self.browser.getControl("Login").click()
    188188        self.trigger_report_creation('2005')
    … …  
    199199        self.browser.open('http://localhost/app/login')
    200200        self.browser.getControl(name="form.login").value = 'mrofficer'
    201         self.browser.getControl(name="form.password").value = 'mrofficer'
     201        self.browser.getControl(name="form.password").value = SECRET
    202202        self.browser.getControl("Login").click()
    203203        self.browser.open('http://localhost/app/reports')

  • main/waeup.kofa/trunk/src/waeup/kofa/doctests/authentication.txt

    r12951 r15287  
    3030terms) with a password (and optional a title or description):
    3131
    32   >>> root['app']['users'].addUser('bob', 'bobsecret',
     32  >>> root['app']['users'].addUser('bob', 'bobSecret1',
    3333  ...                           title='Bob', description='A sample user')
    3434
    … …  
    186186
    187187  >>> browser.getControl(name='form.login').value = 'bob'
    188   >>> browser.getControl(name='form.password').value = 'bobsecret'
     188  >>> browser.getControl(name='form.password').value = 'bobSecret1'
    189189  >>> browser.getControl('Login').click()
    190190

  • main/waeup.kofa/trunk/src/waeup/kofa/interfaces.py

    r15286 r15287  
    649649        """
    650650
    651     def validate_secured_password(self, pw, pw_repeat):
     651    def validate_secure_password(self, pw, pw_repeat):
    652652        """ Validates a password by comparing it with
    653653        control password and checks password strength by

  • main/waeup.kofa/trunk/src/waeup/kofa/mandates/tests.py

    r13990 r15287  
    3434from waeup.kofa.mandates.mandate import PasswordMandate, RefereeReportMandate
    3535from waeup.kofa.testing import (FunctionalLayer, FunctionalTestCase)
     36from waeup.kofa.tests.test_authentication import SECRET
    3637
    3738class MandatesContainerTestCase(FunctionalTestCase):
    … …  
    123124
    124125    def test_set_officer_password(self):
    125         self.app['users'].addUser('bob', 'bobssecret')
     126        self.app['users'].addUser('bob', SECRET)
    126127        officer = self.app['users']['bob']
    127128        mandate = PasswordMandate()
    128129        mandate.params['user'] = officer
    129         mandate.params['password'] = 'mypwd1'
     130        mandate.params['password'] = SECRET
    130131        self.app['mandates'].addMandate(mandate)
    131132        (msg, redirect_path) = mandate.execute()
    … …  
    134135            'Password has been successfully set. Login with your new password.')
    135136        self.assertEqual(redirect_path, '/login')
    136         self.assertTrue(IUserAccount(officer).checkPassword('mypwd1'))
     137        self.assertTrue(IUserAccount(officer).checkPassword(SECRET))
    137138        logfile = os.path.join(
    138139            self.app['datacenter'].storage, 'logs', 'main.log')

  • main/waeup.kofa/trunk/src/waeup/kofa/students/tests/test_browser.py

    r15285 r15287  
    5353from waeup.kofa.tests.test_async import FunctionalAsyncTestCase
    5454from waeup.kofa.browser.tests.test_pdf import samples_dir
     55from waeup.kofa.tests.test_authentication import SECRET
    5556
    5657PH_LEN = 15911  # Length of placeholder file
    … …  
    15211522    def init_clearance_officer(self):
    15221523        # Create clearance officer
    1523         self.app['users'].addUser('mrclear', 'mrclearsecret')
     1524        self.app['users'].addUser('mrclear', SECRET)
    15241525        self.app['users']['mrclear'].email = 'mrclear@foo.ng'
    15251526        self.app['users']['mrclear'].title = 'Carlo Pitter'
    … …  
    15431544        self.browser.open(self.login_path)
    15441545        self.browser.getControl(name="form.login").value = 'mrclear'
    1545         self.browser.getControl(name="form.password").value = 'mrclearsecret'
     1546        self.browser.getControl(name="form.password").value = SECRET
    15461547        self.browser.getControl("Login").click()
    15471548
    … …  
    17021703
    17031704    def test_handle_courses_by_ca(self):
    1704         self.app['users'].addUser('mrsadvise', 'mrsadvisesecret')
     1705        self.app['users'].addUser('mrsadvise', SECRET)
    17051706        self.app['users']['mrsadvise'].email = 'mradvise@foo.ng'
    17061707        self.app['users']['mrsadvise'].title = u'Helen Procter'
    … …  
    17131714        self.browser.open(self.login_path)
    17141715        self.browser.getControl(name="form.login").value = 'mrsadvise'
    1715         self.browser.getControl(name="form.password").value = 'mrsadvisesecret'
     1716        self.browser.getControl(name="form.password").value = SECRET
    17161717        self.browser.getControl("Login").click()
    17171718        self.assertMatches('...You logged in...', self.browser.contents)
    … …  
    18511852    def test_find_students_in_faculties(self):
    18521853        # Create local students manager in faculty
    1853         self.app['users'].addUser('mrmanager', 'mrmanagersecret')
     1854        self.app['users'].addUser('mrmanager', SECRET)
    18541855        self.app['users']['mrmanager'].email = 'mrmanager@foo.ng'
    18551856        self.app['users']['mrmanager'].title = u'Volk Wagen'
    … …  
    18651866        self.browser.open(self.login_path)
    18661867        self.browser.getControl(name="form.login").value = 'mrmanager'
    1867         self.browser.getControl(name="form.password").value = 'mrmanagersecret'
     1868        self.browser.getControl(name="form.password").value = SECRET
    18681869        self.browser.getControl("Login").click()
    18691870        self.assertMatches('...You logged in...', self.browser.contents)
    … …  
    20212022        # StudentImpersonators can login as student
    20222023        # Create clearance officer
    2023         self.app['users'].addUser('mrofficer', 'mrofficersecret')
     2024        self.app['users'].addUser('mrofficer', SECRET)
    20242025        self.app['users']['mrofficer'].email = 'mrofficer@foo.ng'
    20252026        self.app['users']['mrofficer'].title = 'Harry Actor'
    … …  
    20302031        self.browser.open(self.login_path)
    20312032        self.browser.getControl(name="form.login").value = 'mrofficer'
    2032         self.browser.getControl(name="form.password").value = 'mrofficersecret'
     2033        self.browser.getControl(name="form.password").value = SECRET
    20332034        self.browser.getControl("Login").click()
    20342035        self.assertMatches('...You logged in...', self.browser.contents)
    … …  
    21282129            'Address line2\n\n')
    21292130        # Create officer with both roles
    2130         self.app['users'].addUser('mrtranscript', 'mrtranscriptsecret')
     2131        self.app['users'].addUser('mrtranscript', SECRET)
    21312132        self.app['users']['mrtranscript'].email = 'mrtranscript@foo.ng'
    21322133        self.app['users']['mrtranscript'].title = 'Ruth Gordon'
    … …  
    21382139        self.browser.open(self.login_path)
    21392140        self.browser.getControl(name="form.login").value = 'mrtranscript'
    2140         self.browser.getControl(name="form.password").value = 'mrtranscriptsecret'
     2141        self.browser.getControl(name="form.password").value = SECRET
    21412142        self.browser.getControl("Login").click()
    21422143        self.assertMatches('...You logged in...', self.browser.contents)
    … …  
    22742275        notify(grok.ObjectModifiedEvent(self.student))
    22752276        # Create transcript officer
    2276         self.app['users'].addUser('mrtranscript', 'mrtranscriptsecret')
     2277        self.app['users'].addUser('mrtranscript', SECRET)
    22772278        self.app['users']['mrtranscript'].email = 'mrtranscript@foo.ng'
    22782279        self.app['users']['mrtranscript'].title = 'Ruth Gordon'
    … …  
    22872288        self.browser.open(self.login_path)
    22882289        self.browser.getControl(name="form.login").value = 'mrtranscript'
    2289         self.browser.getControl(name="form.password").value = 'mrtranscriptsecret'
     2290        self.browser.getControl(name="form.password").value = SECRET
    22902291        self.browser.getControl("Login").click()
    22912292        self.assertMatches('...You logged in...', self.browser.contents)
    … …  
    23152316        notify(grok.ObjectModifiedEvent(self.student))
    23162317        # Create transcript signee
    2317         self.app['users'].addUser('mrtranscript', 'mrtranscriptsecret')
     2318        self.app['users'].addUser('mrtranscript', SECRET)
    23182319        self.app['users']['mrtranscript'].email = 'mrtranscript@foo.ng'
    23192320        self.app['users']['mrtranscript'].title = 'Ruth Gordon'
    … …  
    23282329        self.browser.open(self.login_path)
    23292330        self.browser.getControl(name="form.login").value = 'mrtranscript'
    2330         self.browser.getControl(name="form.password").value = 'mrtranscriptsecret'
     2331        self.browser.getControl(name="form.password").value = SECRET
    23312332        self.browser.getControl("Login").click()
    23322333        self.assertMatches('...You logged in...', self.browser.contents)
    … …  
    41114112    def test_export_departmet_officers(self):
    41124113        # Create department officer
    4113         self.app['users'].addUser('mrdepartment', 'mrdepartmentsecret')
     4114        self.app['users'].addUser('mrdepartment', SECRET)
    41144115        self.app['users']['mrdepartment'].email = 'mrdepartment@foo.ng'
    41154116        self.app['users']['mrdepartment'].title = 'Carlo Pitter'
    … …  
    41214122        self.browser.open(self.login_path)
    41224123        self.browser.getControl(name="form.login").value = 'mrdepartment'
    4123         self.browser.getControl(name="form.password").value = 'mrdepartmentsecret'
     4124        self.browser.getControl(name="form.password").value = SECRET
    41244125        self.browser.getControl("Login").click()
    41254126        self.assertMatches('...You logged in...', self.browser.contents)
    … …  
    41454146    def test_export_bursary_officers(self):
    41464147        # Create bursary officer
    4147         self.app['users'].addUser('mrbursary', 'mrbursarysecret')
     4148        self.app['users'].addUser('mrbursary', SECRET)
    41484149        self.app['users']['mrbursary'].email = 'mrbursary@foo.ng'
    41494150        self.app['users']['mrbursary'].title = 'Carlo Pitter'
    … …  
    41534154        self.browser.open(self.login_path)
    41544155        self.browser.getControl(name="form.login").value = 'mrbursary'
    4155         self.browser.getControl(name="form.password").value = 'mrbursarysecret'
     4156        self.browser.getControl(name="form.password").value = SECRET
    41564157        self.browser.getControl("Login").click()
    41574158        self.assertMatches('...You logged in...', self.browser.contents)
    … …  
    41834184    def test_export_accommodation_officers(self):
    41844185        # Create bursary officer
    4185         self.app['users'].addUser('mracco', 'mraccosecret')
     4186        self.app['users'].addUser('mracco', SECRET)
    41864187        self.app['users']['mracco'].email = 'mracco@foo.ng'
    41874188        self.app['users']['mracco'].title = 'Carlo Pitter'
    … …  
    41914192        self.browser.open(self.login_path)
    41924193        self.browser.getControl(name="form.login").value = 'mracco'
    4193         self.browser.getControl(name="form.password").value = 'mraccosecret'
     4194        self.browser.getControl(name="form.password").value = SECRET
    41944195        self.browser.getControl("Login").click()
    41954196        self.assertMatches('...You logged in...', self.browser.contents)
    … …  
    42344235
    42354236    def login_as_lecturer(self):
    4236         self.app['users'].addUser('mrslecturer', 'mrslecturersecret')
     4237        self.app['users'].addUser('mrslecturer', SECRET)
    42374238        self.app['users']['mrslecturer'].email = 'mrslecturer@foo.ng'
    42384239        self.app['users']['mrslecturer'].title = u'Mercedes Benz'
    … …  
    42534254        self.browser.getControl(name="form.login").value = 'mrslecturer'
    42544255        self.browser.getControl(
    4255             name="form.password").value = 'mrslecturersecret'
     4256            name="form.password").value = SECRET
    42564257        self.browser.getControl("Login").click()
    42574258        # Store reused urls/paths

  • main/waeup.kofa/trunk/src/waeup/kofa/tests/test_authentication.py

    r14670 r15287  
    4040    IKofaPluggable)
    4141
     42SECRET = 'HgtuZZZ8'
    4243
    4344class FakeSite(grok.Site, grok.Container):
    … …  
    133134        self.getRootFolder()['app'] = FakeSite()
    134135        self.site = self.getRootFolder()['app']
    135         self.site['users'] = {'bob': Account('bob', 'secret')}
     136        self.site['users'] = {'bob': Account('bob', SECRET)}
    136137        setSite(self.site)
    137138        return
    … …  
    155156        plugin = UserAuthenticatorPlugin()
    156157        result1 = plugin.authenticateCredentials(
    157             dict(login='bob', password='secret'))
     158            dict(login='bob', password=SECRET))
    158159        result2 = plugin.authenticateCredentials(
    159160            dict(login='bob', password='nonsense'))
    … …  
    185186        # do `num` failed logins and a valid one afterwards
    186187        del self.site['users']
    187         self.site['users'] = {'bob': Account('bob', 'secret')}
     188        self.site['users'] = {'bob': Account('bob', SECRET)}
    188189        plugin = UserAuthenticatorPlugin()
    189190        resultlist = []
    … …  
    193194                dict(login='bob', password='wrongsecret')))
    194195        resultlist.append(plugin.authenticateCredentials(
    195             dict(login='bob', password='secret')))
     196            dict(login='bob', password=SECRET)))
    196197        return resultlist
    197198

  • main/waeup.kofa/trunk/src/waeup/kofa/utils/utils.py

    r14699 r15287  
    273273            name.replace('-', ' - ')).replace(' - ', '-')
    274274
    275     def genPassword(self, length=8, chars=string.letters + string.digits):
     275    def genPassword(self, length=4, chars=string.letters + string.digits):
    276276        """Generate a random password.
    277277        """
    278         return ''.join([r().choice(chars) for i in range(length)])
     278        return ''.join([
     279            r().choice(string.uppercase) +
     280            r().choice(string.lowercase) +
     281            r().choice(string.digits) for i in range(length)])
    279282
    280283    def sendCredentials(self, user, password=None, url_info=None, msg=None):
Note: See TracChangeset for help on using the changeset viewer.