Mercurial > kallithea
changeset 7804:09100b3b8f42
helpers: change CSRF protection POST parameter name to "_session_csrf_secret_token" and fix up tests to use new names
line wrap: on
line diff
--- a/kallithea/config/routing.py Mon Jul 22 02:02:11 2019 +0200 +++ b/kallithea/config/routing.py Tue Aug 06 22:42:37 2019 +0200 @@ -447,7 +447,7 @@ ) # LOGIN/LOGOUT/REGISTER/SIGN IN - rmap.connect('authentication_token', '%s/authentication_token' % ADMIN_PREFIX, controller='login', action='authentication_token') + rmap.connect('session_csrf_secret_token', '%s/session_csrf_secret_token' % ADMIN_PREFIX, controller='login', action='session_csrf_secret_token') rmap.connect('login_home', '%s/login' % ADMIN_PREFIX, controller='login') rmap.connect('logout_home', '%s/logout' % ADMIN_PREFIX, controller='login', action='logout')
--- a/kallithea/controllers/login.py Mon Jul 22 02:02:11 2019 +0200 +++ b/kallithea/controllers/login.py Tue Aug 06 22:42:37 2019 +0200 @@ -249,7 +249,7 @@ log.info('Logging out and deleting session for user') raise HTTPFound(location=url('home')) - def authentication_token(self): + def session_csrf_secret_token(self): """Return the CSRF protection token for the session - just like it could have been screen scraped from a page with a form. Only intended for testing but might also be useful for other kinds
--- a/kallithea/lib/helpers.py Mon Jul 22 02:02:11 2019 +0200 +++ b/kallithea/lib/helpers.py Tue Aug 06 22:42:37 2019 +0200 @@ -1273,7 +1273,7 @@ return '%s - %s' % (s, e) -session_csrf_secret_name = "_authentication_token" +session_csrf_secret_name = "_session_csrf_secret_token" def session_csrf_secret_token(): """Return (and create) the current session's CSRF protection token."""
--- a/kallithea/public/js/base.js Mon Jul 22 02:02:11 2019 +0200 +++ b/kallithea/public/js/base.js Tue Aug 06 22:42:37 2019 +0200 @@ -408,7 +408,7 @@ }; var ajaxPOST = function(url, postData, success, failure) { - postData['_authentication_token'] = _session_csrf_secret_token; + postData['_session_csrf_secret_token'] = _session_csrf_secret_token; var postData = _toQueryString(postData); if(failure === undefined) { failure = function(jqXHR, textStatus, errorThrown) { @@ -458,7 +458,7 @@ var toggleFollowingRepo = function(target, follows_repository_id){ var args = 'follows_repository_id=' + follows_repository_id; - args += '&_authentication_token=' + _session_csrf_secret_token; + args += '&_session_csrf_secret_token=' + _session_csrf_secret_token; $.post(TOGGLE_FOLLOW_URL, args, function(data){ _onSuccessFollow(target); }); @@ -466,7 +466,7 @@ }; var showRepoSize = function(target, repo_name){ - var args = '_authentication_token=' + _session_csrf_secret_token; + var args = '_session_csrf_secret_token=' + _session_csrf_secret_token; if(!$("#" + target).hasClass('loaded')){ $("#" + target).html(_TM['Loading ...']);
--- a/kallithea/templates/admin/gists/edit.html Mon Jul 22 02:02:11 2019 +0200 +++ b/kallithea/templates/admin/gists/edit.html Tue Aug 06 22:42:37 2019 +0200 @@ -153,7 +153,7 @@ // check for newer version. $.ajax({ url: ${h.js(h.url('edit_gist_check_revision', gist_id=c.gist.gist_access_id))}, - data: {'revision': ${h.js(c.file_changeset.raw_id)}, '_authentication_token': _session_csrf_secret_token}, + data: {'revision': ${h.js(c.file_changeset.raw_id)}, '_session_csrf_secret_token': _session_csrf_secret_token}, dataType: 'json', type: 'POST', success: function(data) {
--- a/kallithea/tests/base.py Mon Jul 22 02:02:11 2019 +0200 +++ b/kallithea/tests/base.py Tue Aug 06 22:42:37 2019 +0200 @@ -157,7 +157,7 @@ response = self.app.post(url(controller='login', action='index'), {'username': username, 'password': password, - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) if 'Invalid username or password' in response.body: pytest.fail('could not login using %s %s' % (username, password)) @@ -178,8 +178,8 @@ user = user and user.username assert user == expected_username - def authentication_token(self): - return self.app.get(url('authentication_token')).body + def session_csrf_secret_token(self): + return self.app.get(url('session_csrf_secret_token')).body def checkSessionFlash(self, response, msg=None, skip=0, _matcher=lambda msg, m: msg in m): if 'flash' not in response.session:
--- a/kallithea/tests/functional/test_admin_auth_settings.py Mon Jul 22 02:02:11 2019 +0200 +++ b/kallithea/tests/functional/test_admin_auth_settings.py Tue Aug 06 22:42:37 2019 +0200 @@ -6,7 +6,7 @@ def _enable_plugins(self, plugins_list): test_url = url(controller='admin/auth_settings', action='auth_settings') - params={'auth_plugins': plugins_list, '_authentication_token': self.authentication_token()} + params={'auth_plugins': plugins_list, '_session_csrf_secret_token': self.session_csrf_secret_token()} for plugin in plugins_list.split(','): enable = plugin.partition('kallithea.lib.auth_modules.')[-1]
--- a/kallithea/tests/functional/test_admin_defaults.py Mon Jul 22 02:02:11 2019 +0200 +++ b/kallithea/tests/functional/test_admin_defaults.py Tue Aug 06 22:42:37 2019 +0200 @@ -18,12 +18,12 @@ 'default_repo_enable_statistics': True, 'default_repo_private': True, 'default_repo_type': 'hg', - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), } response = self.app.post(url('defaults_update', id='default'), params=params) self.checkSessionFlash(response, 'Default settings updated successfully') - params.pop('_authentication_token') + params.pop('_session_csrf_secret_token') defs = Setting.get_default_repo_settings() assert params == defs @@ -34,11 +34,11 @@ 'default_repo_enable_statistics': False, 'default_repo_private': False, 'default_repo_type': 'git', - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), } response = self.app.post(url('defaults_update', id='default'), params=params) self.checkSessionFlash(response, 'Default settings updated successfully') - params.pop('_authentication_token') + params.pop('_session_csrf_secret_token') defs = Setting.get_default_repo_settings() assert params == defs
--- a/kallithea/tests/functional/test_admin_gists.py Mon Jul 22 02:02:11 2019 +0200 +++ b/kallithea/tests/functional/test_admin_gists.py Tue Aug 06 22:42:37 2019 +0200 @@ -56,7 +56,7 @@ def test_create_missing_description(self): self.log_user() response = self.app.post(url('gists'), - params={'lifetime': -1, '_authentication_token': self.authentication_token()}, + params={'lifetime': -1, '_session_csrf_secret_token': self.session_csrf_secret_token()}, status=200) response.mustcontain('Missing value') @@ -68,7 +68,7 @@ 'content': 'gist test', 'filename': 'foo', 'public': 'public', - '_authentication_token': self.authentication_token()}, + '_session_csrf_secret_token': self.session_csrf_secret_token()}, status=302) response = response.follow() response.mustcontain('added file: foo') @@ -82,7 +82,7 @@ 'content': 'gist test', 'filename': '/home/foo', 'public': 'public', - '_authentication_token': self.authentication_token()}, + '_session_csrf_secret_token': self.session_csrf_secret_token()}, status=200) response.mustcontain('Filename cannot be inside a directory') @@ -101,7 +101,7 @@ 'content': 'private gist test', 'filename': 'private-foo', 'private': 'private', - '_authentication_token': self.authentication_token()}, + '_session_csrf_secret_token': self.session_csrf_secret_token()}, status=302) response = response.follow() response.mustcontain('added file: private-foo<') @@ -116,7 +116,7 @@ 'filename': 'foo-desc', 'description': 'gist-desc', 'public': 'public', - '_authentication_token': self.authentication_token()}, + '_session_csrf_secret_token': self.session_csrf_secret_token()}, status=302) response = response.follow() response.mustcontain('added file: foo-desc') @@ -132,19 +132,19 @@ self.log_user() gist = _create_gist('delete-me') response = self.app.post(url('gist_delete', gist_id=gist.gist_id), - params={'_authentication_token': self.authentication_token()}) + params={'_session_csrf_secret_token': self.session_csrf_secret_token()}) def test_delete_normal_user_his_gist(self): self.log_user(TEST_USER_REGULAR_LOGIN, TEST_USER_REGULAR_PASS) gist = _create_gist('delete-me', owner=TEST_USER_REGULAR_LOGIN) response = self.app.post(url('gist_delete', gist_id=gist.gist_id), - params={'_authentication_token': self.authentication_token()}) + params={'_session_csrf_secret_token': self.session_csrf_secret_token()}) def test_delete_normal_user_not_his_own_gist(self): self.log_user(TEST_USER_REGULAR_LOGIN, TEST_USER_REGULAR_PASS) gist = _create_gist('delete-me') response = self.app.post(url('gist_delete', gist_id=gist.gist_id), status=403, - params={'_authentication_token': self.authentication_token()}) + params={'_session_csrf_secret_token': self.session_csrf_secret_token()}) def test_show(self): gist = _create_gist('gist-show-me')
--- a/kallithea/tests/functional/test_admin_permissions.py Mon Jul 22 02:02:11 2019 +0200 +++ b/kallithea/tests/functional/test_admin_permissions.py Tue Aug 06 22:42:37 2019 +0200 @@ -29,7 +29,7 @@ response = self.app.post(url('edit_user_ips_update', id=default_user_id), params=dict(new_ip='0.0.0.0/24', - _authentication_token=self.authentication_token())) + _session_csrf_secret_token=self.session_csrf_secret_token())) invalidate_all_caches() response = self.app.get(url('admin_permissions_ips'), extra_environ={'REMOTE_ADDR': '0.0.0.1'}) @@ -43,7 +43,7 @@ response = self.app.post(url('edit_user_ips_update', id=default_user_id), params=dict(new_ip='0.0.1.0/24', - _authentication_token=self.authentication_token())) + _session_csrf_secret_token=self.session_csrf_secret_token())) invalidate_all_caches() response = self.app.get(url('admin_permissions_ips'), @@ -54,7 +54,7 @@ x = UserIpMap.query().filter_by(ip_addr='0.0.1.0/24').first() response = self.app.post(url('edit_user_ips_delete', id=default_user_id), params=dict(del_ip_id=x.ip_id, - _authentication_token=self.authentication_token())) + _session_csrf_secret_token=self.session_csrf_secret_token())) invalidate_all_caches() response = self.app.get(url('admin_permissions_ips'), @@ -65,7 +65,7 @@ x = UserIpMap.query().filter_by(ip_addr='0.0.0.0/24').first() response = self.app.post(url('edit_user_ips_delete', id=default_user_id), params=dict(del_ip_id=x.ip_id, - _authentication_token=self.authentication_token())) + _session_csrf_secret_token=self.session_csrf_secret_token())) invalidate_all_caches() response = self.app.get(url('admin_permissions_ips'), @@ -86,7 +86,7 @@ perm_new_member_1='repository.read', perm_new_member_name_1=user.username, perm_new_member_type_1='user', - _authentication_token=self.authentication_token()), + _session_csrf_secret_token=self.session_csrf_secret_token()), status=302) assert not response.location.endswith(url('edit_repo_perms_update', repo_name=HG_REPO)) @@ -97,7 +97,7 @@ params=dict( obj_type='user', user_id=user.user_id, - _authentication_token=self.authentication_token()), + _session_csrf_secret_token=self.session_csrf_secret_token()), status=302) assert response.location.endswith(url('login_home', came_from=url('edit_repo_perms_revoke', repo_name=HG_REPO))) @@ -111,7 +111,7 @@ perm_new_member_1='repository.read', perm_new_member_name_1=user.username, perm_new_member_type_1='user', - _authentication_token=self.authentication_token()), + _session_csrf_secret_token=self.session_csrf_secret_token()), status=302) assert response.location.endswith(url('edit_repo_perms_update', repo_name=HG_REPO)) @@ -121,6 +121,6 @@ params=dict( obj_type='user', user_id=user.user_id, - _authentication_token=self.authentication_token()), + _session_csrf_secret_token=self.session_csrf_secret_token()), status=200) assert not response.body
--- a/kallithea/tests/functional/test_admin_repo_groups.py Mon Jul 22 02:02:11 2019 +0200 +++ b/kallithea/tests/functional/test_admin_repo_groups.py Tue Aug 06 22:42:37 2019 +0200 @@ -15,12 +15,12 @@ group_name = u'newgroup' response = self.app.post(url('repos_groups'), fixture._get_repo_group_create_params(group_name=group_name, - _authentication_token=self.authentication_token())) + _session_csrf_secret_token=self.session_csrf_secret_token())) # try to create repo group with swapped case swapped_group_name = group_name.swapcase() response = self.app.post(url('repos_groups'), fixture._get_repo_group_create_params(group_name=swapped_group_name, - _authentication_token=self.authentication_token())) + _session_csrf_secret_token=self.session_csrf_secret_token())) response.mustcontain('already exists') RepoGroupModel().delete(group_name)
--- a/kallithea/tests/functional/test_admin_repos.py Mon Jul 22 02:02:11 2019 +0200 +++ b/kallithea/tests/functional/test_admin_repos.py Tue Aug 06 22:42:37 2019 +0200 @@ -53,7 +53,7 @@ repo_name=repo_name, repo_type=self.REPO_TYPE, repo_description=description, - _authentication_token=self.authentication_token())) + _session_csrf_secret_token=self.session_csrf_secret_token())) ## run the check page that triggers the flash message response = self.app.get(url('repo_check_home', repo_name=repo_name)) assert response.json == {u'result': True} @@ -91,7 +91,7 @@ repo_name=repo_name, repo_type=self.REPO_TYPE, repo_description=description, - _authentication_token=self.authentication_token())) + _session_csrf_secret_token=self.session_csrf_secret_token())) # try to create repo with swapped case swapped_repo_name = repo_name.swapcase() response = self.app.post(url('repos'), @@ -99,7 +99,7 @@ repo_name=swapped_repo_name, repo_type=self.REPO_TYPE, repo_description=description, - _authentication_token=self.authentication_token())) + _session_csrf_secret_token=self.session_csrf_secret_token())) response.mustcontain('already exists') RepoModel().delete(repo_name) @@ -124,7 +124,7 @@ repo_type=self.REPO_TYPE, repo_description=description, repo_group=gr.group_id, - _authentication_token=self.authentication_token())) + _session_csrf_secret_token=self.session_csrf_secret_token())) ## run the check page that triggers the flash message response = self.app.get(url('repo_check_home', repo_name=repo_name_full)) assert response.json == {u'result': True} @@ -163,7 +163,7 @@ def test_create_in_group_without_needed_permissions(self): usr = self.log_user(TEST_USER_REGULAR_LOGIN, TEST_USER_REGULAR_PASS) # avoid spurious RepoGroup DetachedInstanceError ... - authentication_token = self.authentication_token() + session_csrf_secret_token = self.session_csrf_secret_token() # revoke user_model = UserModel() # disable fork and create on default user @@ -201,7 +201,7 @@ repo_type=self.REPO_TYPE, repo_description=description, repo_group=gr.group_id, - _authentication_token=authentication_token)) + _session_csrf_secret_token=session_csrf_secret_token)) response.mustcontain('Invalid value') @@ -215,7 +215,7 @@ repo_type=self.REPO_TYPE, repo_description=description, repo_group=gr_allowed.group_id, - _authentication_token=authentication_token)) + _session_csrf_secret_token=session_csrf_secret_token)) ## run the check page that triggers the flash message response = self.app.get(url('repo_check_home', repo_name=repo_name_full)) @@ -277,7 +277,7 @@ repo_description=description, repo_group=gr.group_id, repo_copy_permissions=True, - _authentication_token=self.authentication_token())) + _session_csrf_secret_token=self.session_csrf_secret_token())) ## run the check page that triggers the flash message response = self.app.get(url('repo_check_home', repo_name=repo_name_full)) @@ -329,7 +329,7 @@ repo_type=self.REPO_TYPE, repo_description=description, clone_uri='http://127.0.0.1/repo', - _authentication_token=self.authentication_token())) + _session_csrf_secret_token=self.session_csrf_secret_token())) response.mustcontain('Invalid repository URL') def test_create_remote_repo_wrong_clone_uri_hg_svn(self): @@ -342,7 +342,7 @@ repo_type=self.REPO_TYPE, repo_description=description, clone_uri='svn+http://127.0.0.1/repo', - _authentication_token=self.authentication_token())) + _session_csrf_secret_token=self.session_csrf_secret_token())) response.mustcontain('Invalid repository URL') def test_delete(self): @@ -354,7 +354,7 @@ repo_type=self.REPO_TYPE, repo_name=repo_name, repo_description=description, - _authentication_token=self.authentication_token())) + _session_csrf_secret_token=self.session_csrf_secret_token())) ## run the check page that triggers the flash message response = self.app.get(url('repo_check_home', repo_name=repo_name)) self.checkSessionFlash(response, @@ -379,7 +379,7 @@ pytest.fail('no repo %s in filesystem' % repo_name) response = self.app.post(url('delete_repo', repo_name=repo_name), - params={'_authentication_token': self.authentication_token()}) + params={'_session_csrf_secret_token': self.session_csrf_secret_token()}) self.checkSessionFlash(response, 'Deleted repository %s' % (repo_name)) @@ -405,7 +405,7 @@ repo_name=repo_name, repo_type=self.REPO_TYPE, repo_description=description, - _authentication_token=self.authentication_token())) + _session_csrf_secret_token=self.session_csrf_secret_token())) ## run the check page that triggers the flash message response = self.app.get(url('repo_check_home', repo_name=repo_name)) assert response.json == {u'result': True} @@ -431,7 +431,7 @@ pytest.fail('no repo %s in filesystem' % repo_name) response = self.app.post(url('delete_repo', repo_name=repo_name), - params={'_authentication_token': self.authentication_token()}) + params={'_session_csrf_secret_token': self.session_csrf_secret_token()}) self.checkSessionFlash(response, 'Deleted repository %s' % (repo_name_unicode)) response.follow() @@ -449,7 +449,7 @@ def test_delete_browser_fakeout(self): response = self.app.post(url('delete_repo', repo_name=self.REPO), - params=dict(_authentication_token=self.authentication_token())) + params=dict(_session_csrf_secret_token=self.session_csrf_secret_token())) def test_show(self): self.log_user() @@ -471,7 +471,7 @@ repo_name=self.REPO, repo_type=self.REPO_TYPE, owner=TEST_USER_ADMIN_LOGIN, - _authentication_token=self.authentication_token())) + _session_csrf_secret_token=self.session_csrf_secret_token())) self.checkSessionFlash(response, msg='Repository %s updated successfully' % (self.REPO)) assert Repository.get_by_repo_name(self.REPO).private == True @@ -486,7 +486,7 @@ repo_name=self.REPO, repo_type=self.REPO_TYPE, owner=TEST_USER_ADMIN_LOGIN, - _authentication_token=self.authentication_token())) + _session_csrf_secret_token=self.session_csrf_secret_token())) self.checkSessionFlash(response, msg='Repository %s updated successfully' % (self.REPO)) assert Repository.get_by_repo_name(self.REPO).private == False @@ -514,7 +514,7 @@ repo = Repository.get_by_repo_name(self.REPO) repo2 = Repository.get_by_repo_name(other_repo) response = self.app.post(url('edit_repo_advanced_fork', repo_name=self.REPO), - params=dict(id_fork_of=repo2.repo_id, _authentication_token=self.authentication_token())) + params=dict(id_fork_of=repo2.repo_id, _session_csrf_secret_token=self.session_csrf_secret_token())) repo = Repository.get_by_repo_name(self.REPO) repo2 = Repository.get_by_repo_name(other_repo) self.checkSessionFlash(response, @@ -535,7 +535,7 @@ repo = Repository.get_by_repo_name(self.REPO) repo2 = Repository.get_by_repo_name(self.OTHER_TYPE_REPO) response = self.app.post(url('edit_repo_advanced_fork', repo_name=self.REPO), - params=dict(id_fork_of=repo2.repo_id, _authentication_token=self.authentication_token())) + params=dict(id_fork_of=repo2.repo_id, _session_csrf_secret_token=self.session_csrf_secret_token())) repo = Repository.get_by_repo_name(self.REPO) repo2 = Repository.get_by_repo_name(self.OTHER_TYPE_REPO) self.checkSessionFlash(response, @@ -545,7 +545,7 @@ self.log_user() ## mark it as None response = self.app.post(url('edit_repo_advanced_fork', repo_name=self.REPO), - params=dict(id_fork_of=None, _authentication_token=self.authentication_token())) + params=dict(id_fork_of=None, _session_csrf_secret_token=self.session_csrf_secret_token())) repo = Repository.get_by_repo_name(self.REPO) repo2 = Repository.get_by_repo_name(self.OTHER_TYPE_REPO) self.checkSessionFlash(response, @@ -557,7 +557,7 @@ self.log_user() repo = Repository.get_by_repo_name(self.REPO) response = self.app.post(url('edit_repo_advanced_fork', repo_name=self.REPO), - params=dict(id_fork_of=repo.repo_id, _authentication_token=self.authentication_token())) + params=dict(id_fork_of=repo.repo_id, _session_csrf_secret_token=self.session_csrf_secret_token())) self.checkSessionFlash(response, 'An error occurred during this operation') @@ -588,7 +588,7 @@ repo_name=repo_name, repo_type=self.REPO_TYPE, repo_description=description, - _authentication_token=self.authentication_token())) + _session_csrf_secret_token=self.session_csrf_secret_token())) response.mustcontain('<span class="error-message">Invalid value</span>') @@ -606,7 +606,7 @@ repo_name=repo_name, repo_type=self.REPO_TYPE, repo_description=description, - _authentication_token=self.authentication_token())) + _session_csrf_secret_token=self.session_csrf_secret_token())) self.checkSessionFlash(response, 'Error creating repository %s' % repo_name)
--- a/kallithea/tests/functional/test_admin_settings.py Mon Jul 22 02:02:11 2019 +0200 +++ b/kallithea/tests/functional/test_admin_settings.py Tue Aug 06 22:42:37 2019 +0200 @@ -38,7 +38,7 @@ response = self.app.post(url('admin_settings_hooks'), params=dict(new_hook_ui_key='test_hooks_1', new_hook_ui_value='cd %s' % TESTS_TMP_PATH, - _authentication_token=self.authentication_token())) + _session_csrf_secret_token=self.session_csrf_secret_token())) self.checkSessionFlash(response, 'Added new hook') response = response.follow() @@ -51,7 +51,7 @@ params=dict(hook_ui_key='test_hooks_1', hook_ui_value='old_value_of_hook_1', hook_ui_value_new='new_value_of_hook_1', - _authentication_token=self.authentication_token())) + _session_csrf_secret_token=self.session_csrf_secret_token())) response = response.follow() response.mustcontain('test_hooks_1') @@ -62,7 +62,7 @@ response = self.app.post(url('admin_settings_hooks'), params=dict(new_hook_ui_key='test_hooks_1', new_hook_ui_value='attempted_new_value', - _authentication_token=self.authentication_token())) + _session_csrf_secret_token=self.session_csrf_secret_token())) self.checkSessionFlash(response, 'Hook already exists') response = response.follow() @@ -74,7 +74,7 @@ response = self.app.post(url('admin_settings_hooks'), params=dict(new_hook_ui_key='test_hooks_2', new_hook_ui_value='cd %s2' % TESTS_TMP_PATH, - _authentication_token=self.authentication_token())) + _session_csrf_secret_token=self.session_csrf_secret_token())) self.checkSessionFlash(response, 'Added new hook') response = response.follow() @@ -84,7 +84,7 @@ hook_id = Ui.get_by_key('hooks', 'test_hooks_2').ui_id ## delete self.app.post(url('admin_settings_hooks'), - params=dict(hook_id=hook_id, _authentication_token=self.authentication_token())) + params=dict(hook_id=hook_id, _session_csrf_secret_token=self.session_csrf_secret_token())) response = self.app.get(url('admin_settings_hooks')) response.mustcontain(no=['test_hooks_2']) response.mustcontain(no=['cd %s2' % TESTS_TMP_PATH]) @@ -94,7 +94,7 @@ response = self.app.post(url('admin_settings_hooks'), params=dict(new_hook_ui_key='changegroup.update', new_hook_ui_value='attempted_new_value', - _authentication_token=self.authentication_token())) + _session_csrf_secret_token=self.session_csrf_secret_token())) self.checkSessionFlash(response, 'Builtin hooks are read-only') response = response.follow() @@ -120,7 +120,7 @@ ga_code=new_ga_code, captcha_private_key='', captcha_public_key='', - _authentication_token=self.authentication_token(), + _session_csrf_secret_token=self.session_csrf_secret_token(), )) self.checkSessionFlash(response, 'Updated application settings') @@ -141,7 +141,7 @@ ga_code=new_ga_code, captcha_private_key='', captcha_public_key='', - _authentication_token=self.authentication_token(), + _session_csrf_secret_token=self.session_csrf_secret_token(), )) self.checkSessionFlash(response, 'Updated application settings') @@ -161,7 +161,7 @@ ga_code=new_ga_code, captcha_private_key='1234567890', captcha_public_key='1234567890', - _authentication_token=self.authentication_token(), + _session_csrf_secret_token=self.session_csrf_secret_token(), )) self.checkSessionFlash(response, 'Updated application settings') @@ -181,7 +181,7 @@ ga_code=new_ga_code, captcha_private_key='', captcha_public_key='1234567890', - _authentication_token=self.authentication_token(), + _session_csrf_secret_token=self.session_csrf_secret_token(), )) self.checkSessionFlash(response, 'Updated application settings') @@ -203,7 +203,7 @@ ga_code='', captcha_private_key='', captcha_public_key='', - _authentication_token=self.authentication_token(), + _session_csrf_secret_token=self.session_csrf_secret_token(), )) self.checkSessionFlash(response, 'Updated application settings')
--- a/kallithea/tests/functional/test_admin_user_groups.py Mon Jul 22 02:02:11 2019 +0200 +++ b/kallithea/tests/functional/test_admin_user_groups.py Tue Aug 06 22:42:37 2019 +0200 @@ -20,7 +20,7 @@ {'users_group_name': users_group_name, 'user_group_description': u'DESC', 'active': True, - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) response.follow() self.checkSessionFlash(response, @@ -36,7 +36,7 @@ def test_update_browser_fakeout(self): response = self.app.post(url('update_users_group', id=1), - params=dict(_authentication_token=self.authentication_token())) + params=dict(_session_csrf_secret_token=self.session_csrf_secret_token())) def test_delete(self): self.log_user() @@ -45,7 +45,7 @@ {'users_group_name': users_group_name, 'user_group_description': u'DESC', 'active': True, - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) response.follow() self.checkSessionFlash(response, @@ -55,7 +55,7 @@ .filter(UserGroup.users_group_name == users_group_name).one() response = self.app.post(url('delete_users_group', id=gr.users_group_id), - params={'_authentication_token': self.authentication_token()}) + params={'_session_csrf_secret_token': self.session_csrf_secret_token()}) gr = Session().query(UserGroup) \ .filter(UserGroup.users_group_name == users_group_name).scalar() @@ -69,7 +69,7 @@ {'users_group_name': users_group_name, 'user_group_description': u'DESC', 'active': True, - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) response.follow() ug = UserGroup.get_by_group_name(users_group_name) @@ -79,7 +79,7 @@ response = self.app.post(url('edit_user_group_default_perms_update', id=ug.users_group_id), {'create_repo_perm': True, - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) response.follow() ug = UserGroup.get_by_group_name(users_group_name) p = Permission.get_by_key('hg.create.repository') @@ -97,7 +97,7 @@ ## DISABLE REPO CREATE ON A GROUP response = self.app.post( url('edit_user_group_default_perms_update', id=ug.users_group_id), - params={'_authentication_token': self.authentication_token()}) + params={'_session_csrf_secret_token': self.session_csrf_secret_token()}) response.follow() ug = UserGroup.get_by_group_name(users_group_name) @@ -118,7 +118,7 @@ ug = UserGroup.get_by_group_name(users_group_name) ugid = ug.users_group_id response = self.app.post(url('delete_users_group', id=ug.users_group_id), - params={'_authentication_token': self.authentication_token()}) + params={'_session_csrf_secret_token': self.session_csrf_secret_token()}) response = response.follow() gr = Session().query(UserGroup) \ .filter(UserGroup.users_group_name == users_group_name).scalar() @@ -138,7 +138,7 @@ {'users_group_name': users_group_name, 'user_group_description': u'DESC', 'active': True, - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) response.follow() ug = UserGroup.get_by_group_name(users_group_name) @@ -147,7 +147,7 @@ ## ENABLE REPO CREATE ON A GROUP response = self.app.post(url('edit_user_group_default_perms_update', id=ug.users_group_id), - {'fork_repo_perm': True, '_authentication_token': self.authentication_token()}) + {'fork_repo_perm': True, '_session_csrf_secret_token': self.session_csrf_secret_token()}) response.follow() ug = UserGroup.get_by_group_name(users_group_name) @@ -165,7 +165,7 @@ ## DISABLE REPO CREATE ON A GROUP response = self.app.post(url('edit_user_group_default_perms_update', id=ug.users_group_id), - params={'_authentication_token': self.authentication_token()}) + params={'_session_csrf_secret_token': self.session_csrf_secret_token()}) response.follow() ug = UserGroup.get_by_group_name(users_group_name) @@ -185,7 +185,7 @@ ug = UserGroup.get_by_group_name(users_group_name) ugid = ug.users_group_id response = self.app.post(url('delete_users_group', id=ug.users_group_id), - params={'_authentication_token': self.authentication_token()}) + params={'_session_csrf_secret_token': self.session_csrf_secret_token()}) response = response.follow() gr = Session().query(UserGroup) \ .filter(UserGroup.users_group_name == @@ -201,4 +201,4 @@ def test_delete_browser_fakeout(self): response = self.app.post(url('delete_users_group', id=1), - params=dict(_authentication_token=self.authentication_token())) + params=dict(_session_csrf_secret_token=self.session_csrf_secret_token()))
--- a/kallithea/tests/functional/test_admin_users.py Mon Jul 22 02:02:11 2019 +0200 +++ b/kallithea/tests/functional/test_admin_users.py Tue Aug 06 22:42:37 2019 +0200 @@ -76,7 +76,7 @@ 'extern_name': 'internal', 'extern_type': 'internal', 'email': email, - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) # 302 Found # The resource was found at http://localhost/_admin/users/5/edit; you should be redirected automatically. @@ -109,7 +109,7 @@ 'active': False, 'lastname': lastname, 'email': email, - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) with test_context(self.app): msg = validators.ValidUsername(False, {})._messages['system_invalid_username'] @@ -166,10 +166,10 @@ # special case since this user is not logged in yet his data is # not filled so we use creation data - params.update({'_authentication_token': self.authentication_token()}) + params.update({'_session_csrf_secret_token': self.session_csrf_secret_token()}) response = self.app.post(url('update_user', id=usr.user_id), params) self.checkSessionFlash(response, 'User updated successfully') - params.pop('_authentication_token') + params.pop('_session_csrf_secret_token') updated_user = User.get_by_username(self.test_user_1) updated_params = updated_user.get_api_data(True) @@ -187,7 +187,7 @@ new_user = Session().query(User) \ .filter(User.username == username).one() response = self.app.post(url('delete_user', id=new_user.user_id), - params={'_authentication_token': self.authentication_token()}) + params={'_session_csrf_secret_token': self.session_csrf_secret_token()}) self.checkSessionFlash(response, 'Successfully deleted user') @@ -202,18 +202,18 @@ new_user = Session().query(User) \ .filter(User.username == username).one() response = self.app.post(url('delete_user', id=new_user.user_id), - params={'_authentication_token': self.authentication_token()}) + params={'_session_csrf_secret_token': self.session_csrf_secret_token()}) self.checkSessionFlash(response, 'User "%s" still ' 'owns 1 repositories and cannot be removed. ' 'Switch owners or remove those repositories: ' '%s' % (username, reponame)) response = self.app.post(url('delete_repo', repo_name=reponame), - params={'_authentication_token': self.authentication_token()}) + params={'_session_csrf_secret_token': self.session_csrf_secret_token()}) self.checkSessionFlash(response, 'Deleted repository %s' % reponame) response = self.app.post(url('delete_user', id=new_user.user_id), - params={'_authentication_token': self.authentication_token()}) + params={'_session_csrf_secret_token': self.session_csrf_secret_token()}) self.checkSessionFlash(response, 'Successfully deleted user') def test_delete_repo_group_err(self, user_and_repo_group_fail): @@ -224,7 +224,7 @@ self.log_user() response = self.app.post(url('delete_user', id=new_user.user_id), - params={'_authentication_token': self.authentication_token()}) + params={'_session_csrf_secret_token': self.session_csrf_secret_token()}) self.checkSessionFlash(response, 'User "%s" still ' 'owns 1 repository groups and cannot be removed. ' 'Switch owners or remove those repository groups: ' @@ -235,11 +235,11 @@ # response = self.app.get(url('repos_groups', id=rg.group_id)) response = self.app.post(url('delete_repo_group', group_name=groupname), - params={'_authentication_token': self.authentication_token()}) + params={'_session_csrf_secret_token': self.session_csrf_secret_token()}) self.checkSessionFlash(response, 'Removed repository group %s' % groupname) response = self.app.post(url('delete_user', id=new_user.user_id), - params={'_authentication_token': self.authentication_token()}) + params={'_session_csrf_secret_token': self.session_csrf_secret_token()}) self.checkSessionFlash(response, 'Successfully deleted user') def test_delete_user_group_err(self): @@ -253,7 +253,7 @@ new_user = Session().query(User) \ .filter(User.username == username).one() response = self.app.post(url('delete_user', id=new_user.user_id), - params={'_authentication_token': self.authentication_token()}) + params={'_session_csrf_secret_token': self.session_csrf_secret_token()}) self.checkSessionFlash(response, 'User "%s" still ' 'owns 1 user groups and cannot be removed. ' 'Switch owners or remove those user groups: ' @@ -266,7 +266,7 @@ fixture.destroy_user_group(ug.users_group_id) response = self.app.post(url('delete_user', id=new_user.user_id), - params={'_authentication_token': self.authentication_token()}) + params={'_session_csrf_secret_token': self.session_csrf_secret_token()}) self.checkSessionFlash(response, 'Successfully deleted user') def test_edit(self): @@ -292,7 +292,7 @@ response = self.app.post(url('edit_user_perms_update', id=uid), params=dict(create_repo_perm=True, - _authentication_token=self.authentication_token())) + _session_csrf_secret_token=self.session_csrf_secret_token())) perm_none = Permission.get_by_key('hg.create.none') perm_create = Permission.get_by_key('hg.create.repository') @@ -321,7 +321,7 @@ assert UserModel().has_perm(user, perm_create) == False response = self.app.post(url('edit_user_perms_update', id=uid), - params=dict(_authentication_token=self.authentication_token())) + params=dict(_session_csrf_secret_token=self.session_csrf_secret_token())) perm_none = Permission.get_by_key('hg.create.none') perm_create = Permission.get_by_key('hg.create.repository') @@ -351,7 +351,7 @@ response = self.app.post(url('edit_user_perms_update', id=uid), params=dict(create_repo_perm=True, - _authentication_token=self.authentication_token())) + _session_csrf_secret_token=self.session_csrf_secret_token())) perm_none = Permission.get_by_key('hg.create.none') perm_create = Permission.get_by_key('hg.create.repository') @@ -380,7 +380,7 @@ assert UserModel().has_perm(user, perm_fork) == False response = self.app.post(url('edit_user_perms_update', id=uid), - params=dict(_authentication_token=self.authentication_token())) + params=dict(_session_csrf_secret_token=self.session_csrf_secret_token())) perm_none = Permission.get_by_key('hg.create.none') perm_create = Permission.get_by_key('hg.create.repository') @@ -412,7 +412,7 @@ user_id = user.user_id response = self.app.post(url('edit_user_ips_update', id=user_id), - params=dict(new_ip=ip, _authentication_token=self.authentication_token())) + params=dict(new_ip=ip, _session_csrf_secret_token=self.session_csrf_secret_token())) if failure: self.checkSessionFlash(response, 'Please enter a valid IPv4 or IPv6 address') @@ -441,7 +441,7 @@ response.mustcontain(ip_range) self.app.post(url('edit_user_ips_delete', id=user_id), - params=dict(del_ip_id=new_ip_id, _authentication_token=self.authentication_token())) + params=dict(del_ip_id=new_ip_id, _session_csrf_secret_token=self.session_csrf_secret_token())) response = self.app.get(url('edit_user_ips', id=user_id)) response.mustcontain('All IP addresses are allowed') @@ -467,7 +467,7 @@ user_id = user.user_id response = self.app.post(url('edit_user_api_keys_update', id=user_id), - {'description': desc, 'lifetime': lifetime, '_authentication_token': self.authentication_token()}) + {'description': desc, 'lifetime': lifetime, '_session_csrf_secret_token': self.session_csrf_secret_token()}) self.checkSessionFlash(response, 'API key successfully created') try: response = response.follow() @@ -485,7 +485,7 @@ user_id = user.user_id response = self.app.post(url('edit_user_api_keys_update', id=user_id), - {'description': 'desc', 'lifetime': -1, '_authentication_token': self.authentication_token()}) + {'description': 'desc', 'lifetime': -1, '_session_csrf_secret_token': self.session_csrf_secret_token()}) self.checkSessionFlash(response, 'API key successfully created') response = response.follow() @@ -494,7 +494,7 @@ assert 1 == len(keys) response = self.app.post(url('edit_user_api_keys_delete', id=user_id), - {'del_api_key': keys[0].api_key, '_authentication_token': self.authentication_token()}) + {'del_api_key': keys[0].api_key, '_session_csrf_secret_token': self.session_csrf_secret_token()}) self.checkSessionFlash(response, 'API key successfully deleted') keys = UserApiKeys.query().filter(UserApiKeys.user_id == user_id).all() assert 0 == len(keys) @@ -509,7 +509,7 @@ response.mustcontain('Expires: Never') response = self.app.post(url('edit_user_api_keys_delete', id=user_id), - {'del_api_key_builtin': api_key, '_authentication_token': self.authentication_token()}) + {'del_api_key_builtin': api_key, '_session_csrf_secret_token': self.session_csrf_secret_token()}) self.checkSessionFlash(response, 'API key successfully reset') response = response.follow() response.mustcontain(no=[api_key]) @@ -526,7 +526,7 @@ response = self.app.post(url('edit_user_ssh_keys', id=user_id), {'description': description, 'public_key': public_key, - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) self.checkSessionFlash(response, 'SSH key %s successfully added' % fingerprint) response = response.follow() @@ -549,7 +549,7 @@ response = self.app.post(url('edit_user_ssh_keys', id=user_id), {'description': description, 'public_key': public_key, - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) self.checkSessionFlash(response, 'SSH key %s successfully added' % fingerprint) response.follow() ssh_key = UserSshKeys.query().filter(UserSshKeys.user_id == user_id).one() @@ -557,7 +557,7 @@ response = self.app.post(url('edit_user_ssh_keys_delete', id=user_id), {'del_public_key': ssh_key.public_key, - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) self.checkSessionFlash(response, 'SSH key successfully deleted') keys = UserSshKeys.query().all() assert 0 == len(keys) @@ -606,13 +606,13 @@ self.log_user() user = User.get_default_user() response = self.app.post(url('edit_user_api_keys_update', id=user.user_id), - {'_authentication_token': self.authentication_token()}, status=404) + {'_session_csrf_secret_token': self.session_csrf_secret_token()}, status=404) def test_delete_api_keys_default_user(self): self.log_user() user = User.get_default_user() response = self.app.post(url('edit_user_api_keys_delete', id=user.user_id), - {'_authentication_token': self.authentication_token()}, status=404) + {'_session_csrf_secret_token': self.session_csrf_secret_token()}, status=404) # Permissions def test_edit_perms_default_user(self): @@ -624,7 +624,7 @@ self.log_user() user = User.get_default_user() response = self.app.post(url('edit_user_perms_update', id=user.user_id), - {'_authentication_token': self.authentication_token()}, status=404) + {'_session_csrf_secret_token': self.session_csrf_secret_token()}, status=404) # Emails def test_edit_emails_default_user(self): @@ -636,13 +636,13 @@ self.log_user() user = User.get_default_user() response = self.app.post(url('edit_user_emails_update', id=user.user_id), - {'_authentication_token': self.authentication_token()}, status=404) + {'_session_csrf_secret_token': self.session_csrf_secret_token()}, status=404) def test_delete_emails_default_user(self): self.log_user() user = User.get_default_user() response = self.app.post(url('edit_user_emails_delete', id=user.user_id), - {'_authentication_token': self.authentication_token()}, status=404) + {'_session_csrf_secret_token': self.session_csrf_secret_token()}, status=404) # IP addresses # Add/delete of IP addresses for the default user is used to maintain
--- a/kallithea/tests/functional/test_changeset_pullrequests_comments.py Mon Jul 22 02:02:11 2019 +0200 +++ b/kallithea/tests/functional/test_changeset_pullrequests_comments.py Tue Aug 06 22:42:37 2019 +0200 @@ -18,7 +18,7 @@ rev = '27cd5cce30c96924232dffcd24178a07ffeb5dfc' text = u'general comment on changeset' - params = {'text': text, '_authentication_token': self.authentication_token()} + params = {'text': text, '_session_csrf_secret_token': self.session_csrf_secret_token()} response = self.app.post(url(controller='changeset', action='comment', repo_name=HG_REPO, revision=rev), params=params, extra_environ={'HTTP_X_PARTIAL_XHR': '1'}) @@ -43,7 +43,7 @@ f_path = 'vcs/web/simplevcs/views/repository.py' line = 'n1' - params = {'text': text, 'f_path': f_path, 'line': line, '_authentication_token': self.authentication_token()} + params = {'text': text, 'f_path': f_path, 'line': line, '_session_csrf_secret_token': self.session_csrf_secret_token()} response = self.app.post(url(controller='changeset', action='comment', repo_name=HG_REPO, revision=rev), params=params, extra_environ={'HTTP_X_PARTIAL_XHR': '1'}) @@ -72,7 +72,7 @@ rev = '27cd5cce30c96924232dffcd24178a07ffeb5dfc' text = u'@%s check CommentOnRevision' % TEST_USER_REGULAR_LOGIN - params = {'text': text, '_authentication_token': self.authentication_token()} + params = {'text': text, '_session_csrf_secret_token': self.session_csrf_secret_token()} response = self.app.post(url(controller='changeset', action='comment', repo_name=HG_REPO, revision=rev), params=params, extra_environ={'HTTP_X_PARTIAL_XHR': '1'}) @@ -96,7 +96,7 @@ text = u'general comment on changeset' params = {'text': text, 'changeset_status': 'rejected', - '_authentication_token': self.authentication_token()} + '_session_csrf_secret_token': self.session_csrf_secret_token()} response = self.app.post(url(controller='changeset', action='comment', repo_name=HG_REPO, revision=rev), params=params, extra_environ={'HTTP_X_PARTIAL_XHR': '1'}) @@ -123,7 +123,7 @@ rev = '27cd5cce30c96924232dffcd24178a07ffeb5dfc' text = u'general comment on changeset to be deleted' - params = {'text': text, '_authentication_token': self.authentication_token()} + params = {'text': text, '_session_csrf_secret_token': self.session_csrf_secret_token()} response = self.app.post(url(controller='changeset', action='comment', repo_name=HG_REPO, revision=rev), params=params, extra_environ={'HTTP_X_PARTIAL_XHR': '1'}) @@ -135,7 +135,7 @@ self.app.post(url("changeset_comment_delete", repo_name=HG_REPO, comment_id=comment_id), - params={'_authentication_token': self.authentication_token()}) + params={'_session_csrf_secret_token': self.session_csrf_secret_token()}) comments = ChangesetComment.query().all() assert len(comments) == 0 @@ -165,7 +165,7 @@ 'other_ref': 'branch:default:96507bd11ecc815ebc6270fdf6db110928c09c1e', 'pullrequest_title': 'title', 'pullrequest_desc': 'description', - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), }, status=302) pr_id = int(re.search('/pull-request/(\d+)/', response.location).group(1)) @@ -176,7 +176,7 @@ pr_id = self._create_pr() text = u'general comment on pullrequest' - params = {'text': text, '_authentication_token': self.authentication_token()} + params = {'text': text, '_session_csrf_secret_token': self.session_csrf_secret_token()} response = self.app.post(url(controller='pullrequests', action='comment', repo_name=HG_REPO, pull_request_id=pr_id), params=params, extra_environ={'HTTP_X_PARTIAL_XHR': '1'}) @@ -204,7 +204,7 @@ text = u'inline comment on changeset' f_path = 'vcs/web/simplevcs/views/repository.py' line = 'n1' - params = {'text': text, 'f_path': f_path, 'line': line, '_authentication_token': self.authentication_token()} + params = {'text': text, 'f_path': f_path, 'line': line, '_session_csrf_secret_token': self.session_csrf_secret_token()} response = self.app.post(url(controller='pullrequests', action='comment', repo_name=HG_REPO, pull_request_id=pr_id), params=params, extra_environ={'HTTP_X_PARTIAL_XHR': '1'}) @@ -232,7 +232,7 @@ pr_id = self._create_pr() text = u'@%s check CommentOnRevision' % TEST_USER_REGULAR_LOGIN - params = {'text': text, '_authentication_token': self.authentication_token()} + params = {'text': text, '_session_csrf_secret_token': self.session_csrf_secret_token()} response = self.app.post(url(controller='pullrequests', action='comment', repo_name=HG_REPO, pull_request_id=pr_id), params=params, extra_environ={'HTTP_X_PARTIAL_XHR': '1'}) @@ -256,7 +256,7 @@ text = u'general comment on pullrequest' params = {'text': text, 'changeset_status': 'rejected', - '_authentication_token': self.authentication_token()} + '_session_csrf_secret_token': self.session_csrf_secret_token()} response = self.app.post(url(controller='pullrequests', action='comment', repo_name=HG_REPO, pull_request_id=pr_id), params=params, extra_environ={'HTTP_X_PARTIAL_XHR': '1'}) @@ -286,7 +286,7 @@ pr_id = self._create_pr() text = u'general comment on changeset to be deleted' - params = {'text': text, '_authentication_token': self.authentication_token()} + params = {'text': text, '_session_csrf_secret_token': self.session_csrf_secret_token()} response = self.app.post(url(controller='pullrequests', action='comment', repo_name=HG_REPO, pull_request_id=pr_id), params=params, extra_environ={'HTTP_X_PARTIAL_XHR': '1'}) @@ -298,7 +298,7 @@ self.app.post(url("pullrequest_comment_delete", repo_name=HG_REPO, comment_id=comment_id), - params={'_authentication_token': self.authentication_token()}) + params={'_session_csrf_secret_token': self.session_csrf_secret_token()}) comments = ChangesetComment.query().all() assert len(comments) == 1 @@ -317,7 +317,7 @@ text = u'general comment on pullrequest' params = {'text': text, 'save_close': 'close', - '_authentication_token': self.authentication_token()} + '_session_csrf_secret_token': self.session_csrf_secret_token()} response = self.app.post(url(controller='pullrequests', action='comment', repo_name=HG_REPO, pull_request_id=pr_id), params=params, extra_environ={'HTTP_X_PARTIAL_XHR': '1'}) @@ -340,7 +340,7 @@ text = u'general comment on pullrequest' params = {'text': text, 'save_delete': 'delete', - '_authentication_token': self.authentication_token()} + '_session_csrf_secret_token': self.session_csrf_secret_token()} response = self.app.post(url(controller='pullrequests', action='comment', repo_name=HG_REPO, pull_request_id=pr_id), params=params, extra_environ={'HTTP_X_PARTIAL_XHR': '1'}) @@ -360,7 +360,7 @@ # first close text = u'general comment on pullrequest' params = {'text': text, 'save_close': 'close', - '_authentication_token': self.authentication_token()} + '_session_csrf_secret_token': self.session_csrf_secret_token()} response = self.app.post(url(controller='pullrequests', action='comment', repo_name=HG_REPO, pull_request_id=pr_id), params=params, extra_environ={'HTTP_X_PARTIAL_XHR': '1'}) @@ -368,7 +368,7 @@ # attempt delete, should fail params = {'text': text, 'save_delete': 'delete', - '_authentication_token': self.authentication_token()} + '_session_csrf_secret_token': self.session_csrf_secret_token()} response = self.app.post(url(controller='pullrequests', action='comment', repo_name=HG_REPO, pull_request_id=pr_id), params=params, extra_environ={'HTTP_X_PARTIAL_XHR': '1'}, status=403)
--- a/kallithea/tests/functional/test_files.py Mon Jul 22 02:02:11 2019 +0200 +++ b/kallithea/tests/functional/test_files.py Tue Aug 06 22:42:37 2019 +0200 @@ -333,7 +333,7 @@ revision='tip', f_path='/'), params={ 'content': '', - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), }, status=302) @@ -346,7 +346,7 @@ revision='tip', f_path='/'), params={ 'content': "foo", - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), }, status=302) @@ -366,7 +366,7 @@ 'content': "foo", 'filename': filename, 'location': location, - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), }, status=302) @@ -387,7 +387,7 @@ 'content': "foo", 'filename': filename, 'location': location, - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), }, status=302) try: @@ -410,7 +410,7 @@ revision='tip', f_path='/'), params={ 'content': '', - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), }, status=302) self.checkSessionFlash(response, 'No content') @@ -422,7 +422,7 @@ revision='tip', f_path='/'), params={ 'content': "foo", - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), }, status=302) @@ -442,7 +442,7 @@ 'content': "foo", 'filename': filename, 'location': location, - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), }, status=302) @@ -463,7 +463,7 @@ 'content': "foo", 'filename': filename, 'location': location, - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), }, status=302) try: @@ -493,7 +493,7 @@ 'content': "def py():\n print 'hello'\n", 'filename': filename, 'location': location, - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), }, status=302) response.follow() @@ -524,7 +524,7 @@ 'content': "def py():\n print 'hello'\n", 'filename': filename, 'location': location, - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), }, status=302) response.follow() @@ -538,7 +538,7 @@ params={ 'content': "def py():\n print 'hello world'\n", 'message': 'i committed', - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), }, status=302) self.checkSessionFlash(response, 'Successfully committed to %s' @@ -567,7 +567,7 @@ 'content': "def py():\n print 'hello'\n", 'filename': filename, 'location': location, - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), }, status=302) response.follow() @@ -598,7 +598,7 @@ 'content': "def py():\n print 'hello'\n", 'filename': filename, 'location': location, - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), }, status=302) response.follow() @@ -612,7 +612,7 @@ params={ 'content': "def py():\n print 'hello world'\n", 'message': 'i committed', - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), }, status=302) self.checkSessionFlash(response, 'Successfully committed to %s' @@ -641,7 +641,7 @@ 'content': "def py():\n print 'hello'\n", 'filename': filename, 'location': location, - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), }, status=302) response.follow() @@ -672,7 +672,7 @@ 'content': "def py():\n print 'hello'\n", 'filename': filename, 'location': location, - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), }, status=302) response.follow() @@ -685,7 +685,7 @@ f_path=posixpath.join(location, filename)), params={ 'message': 'i committed', - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), }, status=302) self.checkSessionFlash(response, @@ -714,7 +714,7 @@ 'content': "def py():\n print 'hello'\n", 'filename': filename, 'location': location, - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), }, status=302) response.follow() @@ -745,7 +745,7 @@ 'content': "def py():\n print 'hello'\n", 'filename': filename, 'location': location, - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), }, status=302) response.follow() @@ -758,7 +758,7 @@ f_path=posixpath.join(location, filename)), params={ 'message': 'i committed', - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), }, status=302) self.checkSessionFlash(response,
--- a/kallithea/tests/functional/test_forks.py Mon Jul 22 02:02:11 2019 +0200 +++ b/kallithea/tests/functional/test_forks.py Tue Aug 06 22:42:37 2019 +0200 @@ -54,7 +54,7 @@ # try create a fork repo_name = self.REPO self.app.post(url(controller='forks', action='fork_create', - repo_name=repo_name), {'_authentication_token': self.authentication_token()}, status=403) + repo_name=repo_name), {'_session_csrf_secret_token': self.session_csrf_secret_token()}, status=403) finally: usr = User.get_default_user() user_model.revoke_perm(usr, 'hg.fork.none') @@ -77,7 +77,7 @@ 'description': description, 'private': 'False', 'landing_rev': 'rev:tip', - '_authentication_token': self.authentication_token()} + '_session_csrf_secret_token': self.session_csrf_secret_token()} self.app.post(url(controller='forks', action='fork_create', repo_name=repo_name), creation_args) @@ -91,7 +91,7 @@ # remove this fork response = self.app.post(url('delete_repo', repo_name=fork_name), - params={'_authentication_token': self.authentication_token()}) + params={'_session_csrf_secret_token': self.session_csrf_secret_token()}) def test_fork_create_into_group(self): self.log_user() @@ -110,7 +110,7 @@ 'description': description, 'private': 'False', 'landing_rev': 'rev:tip', - '_authentication_token': self.authentication_token()} + '_session_csrf_secret_token': self.session_csrf_secret_token()} self.app.post(url(controller='forks', action='fork_create', repo_name=repo_name), creation_args) repo = Repository.get_by_repo_name(fork_name_full) @@ -154,7 +154,7 @@ 'description': 'unicode repo 1', 'private': 'False', 'landing_rev': 'rev:tip', - '_authentication_token': self.authentication_token()} + '_session_csrf_secret_token': self.session_csrf_secret_token()} self.app.post(url(controller='forks', action='fork_create', repo_name=repo_name), creation_args) response = self.app.get(url(controller='forks', action='forks', @@ -175,7 +175,7 @@ 'description': 'unicode repo 2', 'private': 'False', 'landing_rev': 'rev:tip', - '_authentication_token': self.authentication_token()} + '_session_csrf_secret_token': self.session_csrf_secret_token()} self.app.post(url(controller='forks', action='fork_create', repo_name=fork_name), creation_args) response = self.app.get(url(controller='forks', action='forks', @@ -186,9 +186,9 @@ # remove these forks response = self.app.post(url('delete_repo', repo_name=fork_name_2), - params={'_authentication_token': self.authentication_token()}) + params={'_session_csrf_secret_token': self.session_csrf_secret_token()}) response = self.app.post(url('delete_repo', repo_name=fork_name), - params={'_authentication_token': self.authentication_token()}) + params={'_session_csrf_secret_token': self.session_csrf_secret_token()}) def test_fork_create_and_permissions(self): self.log_user() @@ -204,7 +204,7 @@ 'description': description, 'private': 'False', 'landing_rev': 'rev:tip', - '_authentication_token': self.authentication_token()} + '_session_csrf_secret_token': self.session_csrf_secret_token()} self.app.post(url(controller='forks', action='fork_create', repo_name=repo_name), creation_args) repo = Repository.get_by_repo_name(self.REPO_FORK)
--- a/kallithea/tests/functional/test_login.py Mon Jul 22 02:02:11 2019 +0200 +++ b/kallithea/tests/functional/test_login.py Tue Aug 06 22:42:37 2019 +0200 @@ -32,7 +32,7 @@ response = self.app.post(url(controller='login', action='index'), {'username': TEST_USER_ADMIN_LOGIN, 'password': TEST_USER_ADMIN_PASS, - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) assert response.status == '302 Found' self.assert_authenticated_user(response, TEST_USER_ADMIN_LOGIN) @@ -43,7 +43,7 @@ response = self.app.post(url(controller='login', action='index'), {'username': TEST_USER_REGULAR_LOGIN, 'password': TEST_USER_REGULAR_PASS, - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) assert response.status == '302 Found' self.assert_authenticated_user(response, TEST_USER_REGULAR_LOGIN) @@ -55,7 +55,7 @@ response = self.app.post(url(controller='login', action='index'), {'username': TEST_USER_REGULAR_EMAIL, 'password': TEST_USER_REGULAR_PASS, - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) assert response.status == '302 Found' self.assert_authenticated_user(response, TEST_USER_REGULAR_LOGIN) @@ -69,7 +69,7 @@ came_from=test_came_from), {'username': TEST_USER_ADMIN_LOGIN, 'password': TEST_USER_ADMIN_PASS, - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) assert response.status == '302 Found' response = response.follow() @@ -81,7 +81,7 @@ {'username': TEST_USER_REGULAR_LOGIN, 'password': TEST_USER_REGULAR_PASS, 'remember': False, - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) assert 'Set-Cookie' in response.headers for cookie in response.headers.getall('Set-Cookie'): @@ -92,7 +92,7 @@ {'username': TEST_USER_REGULAR_LOGIN, 'password': TEST_USER_REGULAR_PASS, 'remember': True, - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) assert 'Set-Cookie' in response.headers for cookie in response.headers.getall('Set-Cookie'): @@ -102,7 +102,7 @@ response = self.app.post(url(controller='login', action='index'), {'username': TEST_USER_REGULAR_LOGIN, 'password': TEST_USER_REGULAR_PASS, - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) # Verify that a login session has been established. response = self.app.get(url(controller='login', action='index')) @@ -131,14 +131,14 @@ came_from=url_came_from), {'username': TEST_USER_ADMIN_LOGIN, 'password': TEST_USER_ADMIN_PASS, - '_authentication_token': self.authentication_token()}, + '_session_csrf_secret_token': self.session_csrf_secret_token()}, status=400) def test_login_short_password(self): response = self.app.post(url(controller='login', action='index'), {'username': TEST_USER_ADMIN_LOGIN, 'password': 'as', - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) assert response.status == '200 OK' response.mustcontain('Enter 3 characters or more') @@ -147,7 +147,7 @@ response = self.app.post(url(controller='login', action='index'), {'username': 'error', 'password': 'test12', - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) response.mustcontain('Invalid username or password') @@ -155,7 +155,7 @@ response = self.app.post(url(controller='login', action='index'), {'username': TEST_USER_REGULAR_LOGIN, 'password': 'blåbærgrød', - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) response.mustcontain('>Invalid username or password<') @@ -199,7 +199,7 @@ came_from=url('/_admin/users', **args)), {'username': TEST_USER_ADMIN_LOGIN, 'password': TEST_USER_ADMIN_PASS, - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) assert response.status == '302 Found' for encoded in args_encoded: assert encoded in response.location @@ -214,7 +214,7 @@ came_from=url('/_admin/users', **args)), {'username': 'error', 'password': 'test12', - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) response.mustcontain('Invalid username or password') came_from = urlparse.parse_qs(urlparse.urlparse(response.form.action).query)['came_from'][0] @@ -237,7 +237,7 @@ 'email': 'goodmail@example.com', 'firstname': 'test', 'lastname': 'test', - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) with test_context(self.app): msg = validators.ValidUsername()._messages['username_exists'] @@ -252,7 +252,7 @@ 'email': TEST_USER_ADMIN_EMAIL, 'firstname': 'test', 'lastname': 'test', - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) with test_context(self.app): msg = validators.UniqSystemEmail()()._messages['email_taken'] @@ -266,7 +266,7 @@ 'email': TEST_USER_ADMIN_EMAIL.title(), 'firstname': 'test', 'lastname': 'test', - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) with test_context(self.app): msg = validators.UniqSystemEmail()()._messages['email_taken'] response.mustcontain(msg) @@ -279,7 +279,7 @@ 'email': 'goodmailm', 'firstname': 'test', 'lastname': 'test', - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) assert response.status == '200 OK' response.mustcontain('An email address must contain a single @') response.mustcontain('Enter a value 6 characters long or more') @@ -292,7 +292,7 @@ 'email': 'goodmailm', 'firstname': 'test', 'lastname': 'test', - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) response.mustcontain('An email address must contain a single @') response.mustcontain('Username may only contain ' @@ -309,7 +309,7 @@ 'email': 'goodmailm', 'firstname': 'test', 'lastname': 'test', - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) response.mustcontain('An email address must contain a single @') with test_context(self.app): @@ -325,7 +325,7 @@ 'email': 'goodmailm@test.plx', 'firstname': 'test', 'lastname': 'test', - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) with test_context(self.app): msg = validators.ValidPassword()._messages['invalid_password'] @@ -339,7 +339,7 @@ 'email': 'goodmailm@test.plxa', 'firstname': 'test', 'lastname': 'test', - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) with test_context(self.app): msg = validators.ValidPasswordsMatch('password', 'password_confirmation')._messages['password_mismatch'] response.mustcontain(msg) @@ -359,7 +359,7 @@ 'firstname': name, 'lastname': lastname, 'admin': True, - '_authentication_token': self.authentication_token()}) # This should be overridden + '_session_csrf_secret_token': self.session_csrf_secret_token()}) # This should be overridden assert response.status == '302 Found' self.checkSessionFlash(response, 'You have successfully registered with Kallithea') @@ -381,7 +381,7 @@ response = self.app.post( url(controller='login', action='password_reset'), {'email': bad_email, - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) response.mustcontain('An email address must contain a single @') @@ -410,7 +410,7 @@ response = self.app.post(url(controller='login', action='password_reset'), {'email': email, - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) self.checkSessionFlash(response, 'A password reset confirmation code has been sent') @@ -427,7 +427,7 @@ 'password': "p@ssw0rd", 'password_confirm': "p@ssw0rd", 'token': token, - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), }) assert response.status == '200 OK' response.mustcontain('Invalid password reset token') @@ -438,7 +438,7 @@ # above, instead of being recalculated. token = UserModel().get_reset_password_token( - User.get_by_username(username), timestamp, self.authentication_token()) + User.get_by_username(username), timestamp, self.session_csrf_secret_token()) response = self.app.get(url(controller='login', action='password_reset_confirmation', @@ -455,7 +455,7 @@ 'password': "p@ssw0rd", 'password_confirm': "p@ssw0rd", 'token': token, - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), }) assert response.status == '302 Found' self.checkSessionFlash(response, 'Successfully updated password')
--- a/kallithea/tests/functional/test_my_account.py Mon Jul 22 02:02:11 2019 +0200 +++ b/kallithea/tests/functional/test_my_account.py Tue Aug 06 22:42:37 2019 +0200 @@ -54,7 +54,7 @@ response = self.app.get(url('my_account_emails')) response.mustcontain('No additional emails specified') response = self.app.post(url('my_account_emails'), - {'new_email': TEST_USER_REGULAR_EMAIL, '_authentication_token': self.authentication_token()}) + {'new_email': TEST_USER_REGULAR_EMAIL, '_session_csrf_secret_token': self.session_csrf_secret_token()}) self.checkSessionFlash(response, 'This email address is already in use') def test_my_account_my_emails_add_missing_email_in_form(self): @@ -62,7 +62,7 @@ response = self.app.get(url('my_account_emails')) response.mustcontain('No additional emails specified') response = self.app.post(url('my_account_emails'), - {'_authentication_token': self.authentication_token()}) + {'_session_csrf_secret_token': self.session_csrf_secret_token()}) self.checkSessionFlash(response, 'Please enter an email address') def test_my_account_my_emails_add_remove(self): @@ -71,7 +71,7 @@ response.mustcontain('No additional emails specified') response = self.app.post(url('my_account_emails'), - {'new_email': 'barz@example.com', '_authentication_token': self.authentication_token()}) + {'new_email': 'barz@example.com', '_session_csrf_secret_token': self.session_csrf_secret_token()}) response = self.app.get(url('my_account_emails')) @@ -84,7 +84,7 @@ response.mustcontain('<input id="del_email_id" name="del_email_id" type="hidden" value="%s" />' % email_id) response = self.app.post(url('my_account_emails_delete'), - {'del_email_id': email_id, '_authentication_token': self.authentication_token()}) + {'del_email_id': email_id, '_session_csrf_secret_token': self.session_csrf_secret_token()}) self.checkSessionFlash(response, 'Removed email from user') response = self.app.get(url('my_account_emails')) response.mustcontain('No additional emails specified') @@ -119,7 +119,7 @@ params.update({'new_password': ''}) params.update({'extern_type': 'internal'}) params.update({'extern_name': self.test_user_1}) - params.update({'_authentication_token': self.authentication_token()}) + params.update({'_session_csrf_secret_token': self.session_csrf_secret_token()}) params.update(attrs) response = self.app.post(url('my_account'), params) @@ -148,7 +148,7 @@ # my account cannot make you an admin ! params['admin'] = False - params.pop('_authentication_token') + params.pop('_session_csrf_secret_token') assert params == updated_params def test_my_account_update_err_email_exists(self): @@ -163,7 +163,7 @@ firstname=u'NewName', lastname=u'NewLastname', email=new_email, - _authentication_token=self.authentication_token()) + _session_csrf_secret_token=self.session_csrf_secret_token()) ) response.mustcontain('This email address is already in use') @@ -180,7 +180,7 @@ firstname=u'NewName', lastname=u'NewLastname', email=new_email, - _authentication_token=self.authentication_token())) + _session_csrf_secret_token=self.session_csrf_secret_token())) response.mustcontain('An email address must contain a single @') from kallithea.model import validators @@ -206,7 +206,7 @@ usr = self.log_user(TEST_USER_REGULAR2_LOGIN, TEST_USER_REGULAR2_PASS) user = User.get(usr['user_id']) response = self.app.post(url('my_account_api_keys'), - {'description': desc, 'lifetime': lifetime, '_authentication_token': self.authentication_token()}) + {'description': desc, 'lifetime': lifetime, '_session_csrf_secret_token': self.session_csrf_secret_token()}) self.checkSessionFlash(response, 'API key successfully created') try: response = response.follow() @@ -222,7 +222,7 @@ usr = self.log_user(TEST_USER_REGULAR2_LOGIN, TEST_USER_REGULAR2_PASS) user = User.get(usr['user_id']) response = self.app.post(url('my_account_api_keys'), - {'description': 'desc', 'lifetime': -1, '_authentication_token': self.authentication_token()}) + {'description': 'desc', 'lifetime': -1, '_session_csrf_secret_token': self.session_csrf_secret_token()}) self.checkSessionFlash(response, 'API key successfully created') response = response.follow() @@ -231,7 +231,7 @@ assert 1 == len(keys) response = self.app.post(url('my_account_api_keys_delete'), - {'del_api_key': keys[0].api_key, '_authentication_token': self.authentication_token()}) + {'del_api_key': keys[0].api_key, '_session_csrf_secret_token': self.session_csrf_secret_token()}) self.checkSessionFlash(response, 'API key successfully deleted') keys = UserApiKeys.query().all() assert 0 == len(keys) @@ -245,7 +245,7 @@ response.mustcontain('Expires: Never') response = self.app.post(url('my_account_api_keys_delete'), - {'del_api_key_builtin': api_key, '_authentication_token': self.authentication_token()}) + {'del_api_key_builtin': api_key, '_session_csrf_secret_token': self.session_csrf_secret_token()}) self.checkSessionFlash(response, 'API key successfully reset') response = response.follow() response.mustcontain(no=[api_key]) @@ -259,7 +259,7 @@ response = self.app.post(url('my_account_ssh_keys'), {'description': description, 'public_key': public_key, - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) self.checkSessionFlash(response, 'SSH key %s successfully added' % fingerprint) response = response.follow() @@ -280,7 +280,7 @@ response = self.app.post(url('my_account_ssh_keys'), {'description': description, 'public_key': public_key, - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) self.checkSessionFlash(response, 'SSH key %s successfully added' % fingerprint) response.follow() user_id = response.session['authuser']['user_id'] @@ -289,7 +289,7 @@ response = self.app.post(url('my_account_ssh_keys_delete'), {'del_public_key': ssh_key.public_key, - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) self.checkSessionFlash(response, 'SSH key successfully deleted') keys = UserSshKeys.query().all() assert 0 == len(keys)
--- a/kallithea/tests/functional/test_pullrequests.py Mon Jul 22 02:02:11 2019 +0200 +++ b/kallithea/tests/functional/test_pullrequests.py Tue Aug 06 22:42:37 2019 +0200 @@ -30,7 +30,7 @@ 'other_ref': 'branch:default:96507bd11ecc815ebc6270fdf6db110928c09c1e', 'pullrequest_title': 'title', 'pullrequest_desc': 'description', - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), }, status=302) response = response.follow() @@ -49,7 +49,7 @@ 'other_ref': 'branch:default:96507bd11ecc815ebc6270fdf6db110928c09c1e', 'pullrequest_title': 'title', 'pullrequest_desc': 'description', - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), }, status=302) response = response.follow() @@ -69,7 +69,7 @@ 'other_ref': 'rev:94f45ed825a1:94f45ed825a113e61af7e141f44ca578374abef0', 'pullrequest_title': 'title', 'pullrequest_desc': 'description', - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), }, status=302) response = response.follow() @@ -92,7 +92,7 @@ 'other_ref': 'branch:default:96507bd11ecc815ebc6270fdf6db110928c09c1e', 'pullrequest_title': 'title', 'pullrequest_desc': 'description', - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), }, status=302) pull_request1_id = re.search('/pull-request/(\d+)/', response.location).group(1) @@ -106,7 +106,7 @@ 'pullrequest_title': 'title', 'pullrequest_desc': 'description', 'owner': TEST_USER_ADMIN_LOGIN, - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), 'review_members': [regular_user.user_id], }, status=302) @@ -124,7 +124,7 @@ 'pullrequest_title': 'Title', 'pullrequest_desc': 'description', 'owner': TEST_USER_ADMIN_LOGIN, - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), 'org_review_members': [admin_user.user_id], # fake - just to get some 'meanwhile' warning ... but it is also added ... 'review_members': [regular_user2.user_id, admin_user.user_id], }, @@ -151,7 +151,7 @@ 'other_ref': 'branch:default:96507bd11ecc815ebc6270fdf6db110928c09c1e', 'pullrequest_title': 'title', 'pullrequest_desc': 'description', - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), }, status=302) # location is of the form: @@ -168,7 +168,7 @@ 'pullrequest_title': 'title', 'pullrequest_desc': 'description', 'owner': TEST_USER_ADMIN_LOGIN, - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), 'review_members': [str(invalid_user_id)], }, status=400) @@ -187,7 +187,7 @@ 'other_ref': 'branch:default:96507bd11ecc815ebc6270fdf6db110928c09c1e', 'pullrequest_title': 'title', 'pullrequest_desc': 'description', - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), }, status=302) # location is of the form: @@ -203,7 +203,7 @@ 'pullrequest_title': 'title', 'pullrequest_desc': 'description', 'owner': TEST_USER_ADMIN_LOGIN, - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), 'review_members': [str(invalid_user_id)], }, status=400) @@ -235,7 +235,7 @@ 'other_ref': 'branch:default:3d1091ee5a533b1f4577ec7d8a226bb315fb1336', 'pullrequest_title': 'title', 'pullrequest_desc': 'description', - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), }, status=302) pr1_id = int(re.search('/pull-request/(\d+)/', response.location).group(1)) @@ -254,7 +254,7 @@ 'pullrequest_title': 'title', 'pullrequest_desc': 'description', 'owner': TEST_USER_REGULAR_LOGIN, - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), }, status=302) pr2_id = int(re.search('/pull-request/(\d+)/', response.location).group(1)) @@ -276,7 +276,7 @@ 'pullrequest_title': 'title', 'pullrequest_desc': 'description', 'owner': TEST_USER_REGULAR_LOGIN, - '_authentication_token': self.authentication_token(), + '_session_csrf_secret_token': self.session_csrf_secret_token(), }, status=302) pr3_id = int(re.search('/pull-request/(\d+)/', response.location).group(1))
--- a/kallithea/tests/functional/test_repo_groups.py Mon Jul 22 02:02:11 2019 +0200 +++ b/kallithea/tests/functional/test_repo_groups.py Tue Aug 06 22:42:37 2019 +0200 @@ -20,7 +20,7 @@ # creation with form error response = self.app.post(url('repos_groups'), {'group_name': group_name, - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) response.mustcontain('name="group_name" type="text" value="%s"' % group_name) response.mustcontain('<!-- for: group_description -->') @@ -30,7 +30,7 @@ 'group_description': 'lala', 'parent_group_id': '-1', 'group_copy_permissions': 'True', - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) self.checkSessionFlash(response, 'Created repository group %s' % group_name) # edit form @@ -40,7 +40,7 @@ # edit with form error response = self.app.post(url('update_repos_group', group_name=group_name), {'group_name': group_name, - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) response.mustcontain('name="group_name" type="text" value="%s"' % group_name) response.mustcontain('<!-- for: group_description -->') @@ -48,7 +48,7 @@ response = self.app.post(url('update_repos_group', group_name=group_name), {'group_name': group_name, 'group_description': 'lolo', - '_authentication_token': self.authentication_token()}) + '_session_csrf_secret_token': self.session_csrf_secret_token()}) self.checkSessionFlash(response, 'Updated repository group %s' % group_name) response = response.follow() response.mustcontain('name="group_name" type="text" value="%s"' % group_name) @@ -69,7 +69,7 @@ # delete response = self.app.post(url('delete_repo_group', group_name=group_name), - {'_authentication_token': self.authentication_token()}) + {'_session_csrf_secret_token': self.session_csrf_secret_token()}) self.checkSessionFlash(response, 'Removed repository group %s' % group_name) def test_new_by_regular_user(self):