Ignore:
Timestamp:
9 Jan 2019, 21:17:08 (6 years ago)
Author:
Henrik Bettermann
Message:

Stored insecure passwords are no longer accepted.
Officers with an insecure password can't login and are
redirected to the ChangePasswordRequestPage to request a
new password.

Location:
main/waeup.kofa/trunk/src/waeup/kofa/browser
Files:
3 edited

Legend:

Unmodified
Added
Removed

  • main/waeup.kofa/trunk/src/waeup/kofa/browser/pages.py

    r15286 r15287  
    430430                    return
    431431            # Display appropriate flash message if credentials are correct
    432             # but officer has been deactivated.
     432            # but the stored password is insecure or officer has been
     433            # deactivated.
    433434            login = self.request.form['form.login']
    434435            if login in grok.getSite()['users']:
    … …  
    438439                if user.password is not None and \
    439440                    passwordmanager.checkPassword(user.password, password):
     441                    # Check first if the stored password might have
     442                    # been the reason
     443                    validator = getUtility(IPasswordValidator)
     444                    errors = validator.validate_secure_password(
     445                        password, password)
     446                    if errors:
     447                        msg1 = translate(_(
     448                                 'Your user name and password are correct '
     449                                 'but your password is not considered '
     450                                 'secure. '))
     451                        msg2 = translate(_(
     452                                 ' Your account has been temporarily '
     453                                 'deactivated. '
     454                                 'Please request a new password.'))
     455                        self.flash( msg1 + ' '.join(errors) + msg2, type="danger")
     456                        self.redirect(self.application_url() + '/changepw')
     457                        return
    440458                    self.flash(_('Your user name and password are correct '
    441                                  'but yor account has been temporarily '
     459                                 'but your account has been temporarily '
    442460                                 'deactivated.'),
    443461                               type='warning')
    … …  
    859877        if password:
    860878            validator = getUtility(IPasswordValidator)
    861             errors = validator.validate_secured_password(password, password_ctl)
     879            errors = validator.validate_secure_password(password, password_ctl)
    862880            if errors:
    863881                self.flash( ' '.join(errors), type='danger')
    … …  
    903921        if password:
    904922            validator = getUtility(IPasswordValidator)
    905             errors = validator.validate_secured_password(password, password_ctl)
     923            errors = validator.validate_secure_password(password, password_ctl)
    906924            if errors:
    907925                self.flash( ' '.join(errors), type='danger')

  • main/waeup.kofa/trunk/src/waeup/kofa/browser/tests/test_browser.py

    r15163 r15287  
    3737from waeup.kofa.university.faculty import Faculty
    3838from waeup.kofa.university.department import Department
     39from waeup.kofa.tests.test_authentication import SECRET
    3940
    4041SAMPLE_FILE = os.path.join(os.path.dirname(__file__), 'test_file.csv')
    … …  
    359360    def test_export_accesscodes(self):
    360361        # Create portal manager and an ExportManager
    361         self.app['users'].addUser('mrportal', 'mrportalsecret')
     362        self.app['users'].addUser('mrportal', SECRET)
    362363        self.app['users']['mrportal'].email = 'mrportal@foo.ng'
    363364        self.app['users']['mrportal'].title = 'Carlo Pitter'
    … …  
    365366        prmlocal = IPrincipalRoleManager(self.app)
    366367        prmlocal.assignRoleToPrincipal('waeup.PortalManager', 'mrportal')
    367         self.app['users'].addUser('mrexporter', 'mrexportersecret')
     368        self.app['users'].addUser('mrexporter', SECRET)
    368369        self.app['users']['mrexporter'].email = 'mrexporter@foo.ng'
    369370        self.app['users']['mrexporter'].title = 'Carlos Potter'
    … …  
    374375        self.browser.open('http://localhost/app/login')
    375376        self.browser.getControl(name="form.login").value = 'mrportal'
    376         self.browser.getControl(name="form.password").value = 'mrportalsecret'
     377        self.browser.getControl(name="form.password").value = SECRET
    377378        self.browser.getControl("Login").click()
    378379
    … …  
    401402        self.browser.open('http://localhost/app/login')
    402403        self.browser.getControl(name="form.login").value = 'mrexporter'
    403         self.browser.getControl(name="form.password").value = 'mrexportersecret'
     404        self.browser.getControl(name="form.password").value = SECRET
    404405        self.browser.getControl("Login").click()
    405406
    … …  
    501502        login_path = 'http://localhost/app/login'
    502503        # Create  officer
    503         self.app['users'].addUser('officer', 'officersecret')
     504        self.app['users'].addUser('officer', SECRET)
    504505        self.app['users']['officer'].email = 'mrofficer@foo.ng'
    505506        self.app['users']['officer'].title = 'Carlo Pitter'
    … …  
    510511        self.browser.open(login_path)
    511512        self.browser.getControl(name="form.login").value = 'officer'
    512         self.browser.getControl(name="form.password").value = 'officersecret'
     513        self.browser.getControl(name="form.password").value = SECRET
    513514        self.browser.getControl("Login").click()
    514515        self.browser.open(upload_path)
    … …  
    562563    def test_suspended_officer(self):
    563564        self.app['users'].addUser(
    564             'officer', 'secret', title='Bob Officer', email='bob@abcd.ng')
     565            'officer', SECRET, title='Bob Officer', email='bob@abcd.ng')
    565566        # Officer can't login if their password is not set.
    566567        self.app['users']['officer'].password = None
    567568        self.browser.open('http://localhost/app/login')
    568569        self.browser.getControl(name="form.login").value = 'officer'
    569         self.browser.getControl(name="form.password").value = 'secret'
     570        self.browser.getControl(name="form.password").value = SECRET
    570571        self.browser.getControl("Login").click()
    571572        self.assertTrue(
    … …  
    573574        # We set the password again.
    574575        IUserAccount(
    575             self.app['users']['officer']).setPassword('secret')
     576            self.app['users']['officer']).setPassword(SECRET)
    576577        # Officers can't login if their account is suspended/deactivated.
    577578        self.app['users']['officer'].suspended = True
    578579        self.browser.open('http://localhost/app/login')
    579580        self.browser.getControl(name="form.login").value = 'officer'
    580         self.browser.getControl(name="form.password").value = 'secret'
     581        self.browser.getControl(name="form.password").value = SECRET
    581582        self.browser.getControl("Login").click()
    582583        self.assertMatches(
    583             '...but yor account has been temporarily deactivated...',
     584            '...but your account has been temporarily deactivated...',
    584585            self.browser.contents)
    585586        # Officer is really not logged in.
    … …  
    588589        self.browser.open('http://localhost/app/login')
    589590        self.browser.getControl(name="form.login").value = 'officer'
    590         self.browser.getControl(name="form.password").value = 'secret'
     591        self.browser.getControl(name="form.password").value = SECRET
    591592        self.browser.getControl("Login").click()
    592593        # Yeah, officer logged in.
    … …  
    618619        config = grok.getSite()['configuration']
    619620        self.app['users'].addUser(
    620             'officer', 'secret', title='Bob Officer', email='bob@abcd.ng')
     621            'officer', SECRET, title='Bob Officer', email='bob@abcd.ng')
    621622        self.browser.open('http://localhost/app/login')
    622623        self.browser.getControl(name="form.login").value = 'officer'
    623         self.browser.getControl(name="form.password").value = 'secret'
     624        self.browser.getControl(name="form.password").value = SECRET
    624625        self.browser.getControl("Login").click()
    625626        # Officer logged in.
    … …  
    636637        # Officers really can't login if maintenance mode is enabled.
    637638        self.browser.getControl(name="form.login").value = 'officer'
    638         self.browser.getControl(name="form.password").value = 'secret'
     639        self.browser.getControl(name="form.password").value = SECRET
    639640        self.browser.getControl("Login").click()
    640641        # A second warning is raised.
    … …  
    645646        config.maintmode_enabled_by = u'officer'
    646647        self.browser.getControl(name="form.login").value = 'officer'
    647         self.browser.getControl(name="form.password").value = 'secret'
     648        self.browser.getControl(name="form.password").value = SECRET
    648649        self.browser.getControl("Login").click()
    649650        self.assertTrue('You logged in' in self.browser.contents)

  • main/waeup.kofa/trunk/src/waeup/kofa/browser/tests/test_permissions.py

    r14526 r15287  
    3737    remove_logger)
    3838from waeup.kofa.tests.test_async import FunctionalAsyncTestCase
    39 
     39from waeup.kofa.tests.test_authentication import SECRET
    4040
    4141
    … …  
    157157    def testReportsPermissions(self):
    158158        # Create reports officer
    159         self.app['users'].addUser('mrofficer', 'mrofficer')
     159        self.app['users'].addUser('mrofficer', SECRET)
    160160        self.app['users']['mrofficer'].email = 'mrofficer@foo.ng'
    161161        self.app['users']['mrofficer'].title = 'Otto Report'
    … …  
    163163        prmglobal.assignRoleToPrincipal('waeup.ReportsOfficer', 'mrofficer')
    164164        # Create reports manager
    165         self.app['users'].addUser('mrmanager', 'mrmanager')
     165        self.app['users'].addUser('mrmanager', SECRET)
    166166        self.app['users']['mrmanager'].email = 'mrmanager@foo.ng'
    167167        self.app['users']['mrmanager'].title = 'Manfred Report'
    … …  
    171171        self.browser.open('http://localhost/app/login')
    172172        self.browser.getControl(name="form.login").value = 'mrofficer'
    173         self.browser.getControl(name="form.password").value = 'mrofficer'
     173        self.browser.getControl(name="form.password").value = SECRET
    174174        self.browser.getControl("Login").click()
    175175        self.trigger_report_creation('2004')
    … …  
    184184        self.browser.open('http://localhost/app/login')
    185185        self.browser.getControl(name="form.login").value = 'mrmanager'
    186         self.browser.getControl(name="form.password").value = 'mrmanager'
     186        self.browser.getControl(name="form.password").value = SECRET
    187187        self.browser.getControl("Login").click()
    188188        self.trigger_report_creation('2005')
    … …  
    199199        self.browser.open('http://localhost/app/login')
    200200        self.browser.getControl(name="form.login").value = 'mrofficer'
    201         self.browser.getControl(name="form.password").value = 'mrofficer'
     201        self.browser.getControl(name="form.password").value = SECRET
    202202        self.browser.getControl("Login").click()
    203203        self.browser.open('http://localhost/app/reports')
Note: See TracChangeset for help on using the changeset viewer.