def test_encode(self):
self.assertEqual(encode_query({}), "")
self.assertEqual(encode_query({"option": "value"}), "?option=value")
self.assertEqual(encode_query({"option": u"peur ecclésiastique"}), "?option=peur+eccl%C3%A9siastique")
self.assertEqual(
encode_query({"option": [u"témeraire", 42, "test"]}), "?option=t%C3%A9meraire&option=42&option=test"
)
self.assertEqual(
encode_query(
{
"option": "x\xda\xd3`f``(\x01b\x86b\x10\xab\xbc\xb4\xbc\x98\x0bHg\xe6\xa5\x15%\xa6\xc6g\xa6Z\x02\x00R\x0b\x06\xd1"
}
),
"?option=x%DA%D3%60f%60%60%28%01b%86b%10%AB%BC%B4%BC%98%0BHg%E6%A5%15%25%A6%C6g%A6Z%02%00R%0B%06%D1",
)
def unauthorized(self, request, response, message=None):
service = queryUtility(ISecretService)
if service is None:
return False
rewrite_url = None
if IRequest.providedBy(request):
vhm_plugin = request.get_plugin(IVirtualHosting)
if vhm_plugin is not None:
rewrite_url = vhm_plugin.rewrite_url
# 1. find the currently unauthorized URL.
came_from = request.get('__ac.field.origin', None)
if came_from is None:
came_from = request.get('ACTUAL_URL', '')
query = request.form.copy()
if query:
for bad in ['login_status', '-C']:
if bad in query:
del query[bad]
if query:
came_from += encode_query(query)
# 2. do the optional redirect to the wanted backend.
if self.redirect_to_url:
if (not came_from.startswith(self.redirect_to_url) and
rewrite_url is not None):
response.redirect(rewrite_url(self.redirect_to_url, came_from))
return True
# 3. Cleanup, if we already have a auth cookie, delete it.
if response.cookies.has_key(self.cookie_name):
del response.cookies[self.cookie_name]
# 4. Get the login page.
page = self._get_login_page(request)
if page is None:
return False
options = {}
if self.include_session_token:
secret = service.digest(str(IClientId(request)), came_from)
session = self._get_session(request)
session.set('secret', secret)
options['__ac.field.secret'] = secret
if self.redirect_to_path and rewrite_url is not None:
# Only include the path
options['__ac.field.origin'] = rewrite_url(None, came_from)
else:
options['__ac.field.origin'] = came_from
# Set options. The page should not accept to render if action
# is not set.
page.message = message
page.action = absoluteURL(self, request) + '/login'
request.form = options
# It is not very nice but we don't have lot of choice.
response.setStatus(401)
response.write(page())
return True