def test_next_url_invalid():
app = Flask('test')
app.add_url_rule('/success', 'success')
app.config['SECRET_KEY'] = 'testing'
app.config['MULTIPASS_SUCCESS_ENDPOINT'] = 'success'
multipass = Multipass(app)
with app.test_request_context():
request.args = {'next': '//evil.com'}
multipass.set_next_url()
assert multipass._get_next_url() == '/success'
def test_next_url():
app = Flask("test")
app.add_url_rule("/success", "success")
app.config["SECRET_KEY"] = "testing"
app.config["MULTIPASS_SUCCESS_ENDPOINT"] = "success"
multipass = Multipass(app)
with app.test_request_context():
# default url - not in session
assert multipass._get_next_url() == "/success"
multipass.set_next_url()
# default url - in session
assert multipass._get_next_url() == "/success"
request.args = {"next": "/private"}
# next url specified, but not in session yet
assert multipass._get_next_url() == "/success"
multipass.set_next_url()
# removed from session after retrieving it once
assert multipass._get_next_url() == "/private"
assert multipass._get_next_url() == "/success"
def test_next_url():
app = Flask('test')
app.add_url_rule('/success', 'success')
app.config['SECRET_KEY'] = 'testing'
app.config['MULTIPASS_SUCCESS_ENDPOINT'] = 'success'
multipass = Multipass(app)
with app.test_request_context():
# default url - not in session
assert multipass._get_next_url() == '/success'
multipass.set_next_url()
# default url - in session
assert multipass._get_next_url() == '/success'
request.args = {'next': '/private'}
# next url specified, but not in session yet
assert multipass._get_next_url() == '/success'
multipass.set_next_url()
# removed from session after retrieving it once
assert multipass._get_next_url() == '/private'
assert multipass._get_next_url() == '/success'
def test_next_url():
app = Flask('test')
app.add_url_rule('/success', 'success')
app.config['SECRET_KEY'] = 'testing'
app.config['MULTIPASS_SUCCESS_ENDPOINT'] = 'success'
multipass = Multipass(app)
with app.test_request_context():
# default url - not in session
assert multipass._get_next_url() == '/success'
multipass.set_next_url()
# default url - in session
assert multipass._get_next_url() == '/success'
request.args = {'next': '/private'}
# next url specified, but not in session yet
assert multipass._get_next_url() == '/success'
multipass.set_next_url()
# removed from session after retrieving it once
assert multipass._get_next_url() == '/private'
assert multipass._get_next_url() == '/success'