Changeset 7694

Timestamp:

06/18/08 14:05:16 (5 months ago)

Author:

brosner

Message:

newforms-admin: Fixed #6943 and #7263 -- Handle multiple e-mail addresses when checking if it was mistakenly entered. Also prevent e-mail guessing by checking password before throwing an error. Thanks Michael Newman and Valera Grishin.

Files:

• django/branches/newforms-admin/django/contrib/admin/sites.py (modified) (1 diff)
• django/branches/newforms-admin/tests/regressiontests/admin_views/tests.py (modified) (2 diffs)

django/branches/newforms-admin/django/contrib/admin/sites.py

@@ -227 +227 @@
-                try:
-                    user = User.objects.get(email=username)
-User.DoesNotExist
+(User.DoesNotExist, User.MultipleObjectsReturned)
-                    message = _("Usernames cannot contain the '@' character.")
-                else:
-
+
+
+
+
+
-            return self.display_login_form(request, message)
-

django/branches/newforms-admin/tests/regressiontests/admin_views/tests.py

@@ -50 +50 @@
-                     'username': 'super',
-                     'password': 'secret'}
+        self.super_email_login = {'post_data': _encode_post_data({}),
+                     LOGIN_FORM_KEY: 1,
+                     'username': 'super@example.com',
+                     'password': 'secret'}
+        self.super_email_bad_login = {'post_data': _encode_post_data({}),
+                      LOGIN_FORM_KEY: 1,
+                      'username': 'super@example.com',
+                      'password': 'notsecret'}
-        self.adduser_login = {'post_data': _encode_post_data({}),
-                     LOGIN_FORM_KEY: 1,
@@ -83 +91 @@
-        self.assertFalse(login.context)
-        self.client.get('/test_admin/admin/logout/')
+        
+        # Test if user enters e-mail address
+        request = self.client.get('/test_admin/admin/')
+        self.failUnlessEqual(request.status_code, 200)
+        login = self.client.post('/test_admin/admin/', self.super_email_login)
+        print login
+        self.assertContains(login, "Your e-mail address is not your username")
+        # only correct passwords get a username hint
+        login = self.client.post('/test_admin/admin/', self.super_email_bad_login)
+        self.assertContains(login, "Usernames cannot contain the '@' character")
+        new_user = User(username='jondoe', password='secret', email='super@example.com')
+        new_user.save()
+        # check to ensure if there are multiple e-mail addresses a user doesn't get a 500
+        login = self.client.post('/test_admin/admin/', self.super_email_login)
+        self.assertContains(login, "Usernames cannot contain the '@' character")        
-        
-        # Add User