def test_login_attempt(self):
get_redis_client().clear()
with override_settings(OBFUSCATE_PASSWORD_FOR_NIC_COMPLIANCE=True):
obfuscated_password = "******"
client = Client(enforce_csrf_checks=False)
form_data = {
'auth-username': self.username,
'auth-password': obfuscated_password,
'hq_login_view-current_step': 'auth'
}
# ensure that login attempt gets stored
login_attempts = get_obfuscated_passwords(self.username)
self.assertEqual(login_attempts, [])
response = client.post(reverse('login'), form_data, follow=True)
self.assertRedirects(response, '/a/delhi/dashboard/project/')
login_attempts = get_obfuscated_passwords(self.username)
self.assertTrue(
verify_password(obfuscated_password, login_attempts[0]))
client.get(reverse('logout'))
# test replay attack
response = client.post(reverse('login'), form_data, follow=True)
self.assertContains(response, "Please enter a password")
self.assertEqual(response.status_code, 200)
self.assertEqual(response.request['PATH_INFO'], '/accounts/login/')
def validate(self, password, user):
used_passwords = self.get_used_passwords(
user.username) + [user.password]
for used_password in used_passwords:
if verify_password(password, used_password):
raise ValidationError(
_("Your password can not be same as last {restricted} passwords."
).format(restricted=RESTRICT_USED_PASSWORDS_NUM),
code='password_already_used',
)
def validate(self, password, user):
used_passwords = self.get_used_passwords(user.username) + [user.password]
for used_password in used_passwords:
if verify_password(password, used_password):
raise ValidationError(
_("Your password can not be same as last {restricted} passwords.").format(
restricted=RESTRICT_USED_PASSWORDS_NUM
),
code='password_already_used',
)
def get(self, request, *args, **kwargs):
self.identifier = kwargs.get('identifier')
try:
hosted_ccz_link = self.hosted_ccz_link
except HostedCCZLink.DoesNotExist:
return HttpResponse(status=404)
username, password = get_username_and_password_from_request(request)
if username and password:
if username == hosted_ccz_link.username and verify_password(password, hosted_ccz_link.password):
return super(HostedCCZView, self).get(request, *args, **kwargs)
# User did not provide an authorization header or gave incorrect credentials.
response = HttpResponse(status=401)
response['WWW-Authenticate'] = 'Basic realm="%s"' % ''
return response
def test_encrypted_password(self):
self.link.save()
self.assertNotEqual(self.link.password, self.raw_password)
self.assertTrue(verify_password(self.raw_password, self.link.password),
"encrypted password does not match")