Changed the code to use django's own authentication, instead of http basic auth. This will let people log out, and will also use stronger password hashing than basic auth. Added a login page, and logout links, and links from the logged in username (in the upper right corner) to the user's profile page.

 - Legacy-Id: 7580

Author: levkowetz

ietf/doc/tests.py

@@ -349,7 +349,7 @@ def test_add_comment(self):
         self.assertTrue(draft.name in outbox[-1]['Subject'])
 
         # Make sure we can also do it as IANA
-        self.client.login(remote_user="iana")
+        self.client.login(username="iana", password="iana+password")
 
         # normal get
         r = self.client.get(url)

ietf/doc/tests_draft.py

@@ -141,7 +141,7 @@ def test_request_last_call(self):
         draft = make_test_data()
         draft.set_state(State.objects.get(used=True, type="draft-iesg", slug="ad-eval"))
 
-        self.client.login(remote_user="secretary")
+        self.client.login(username="secretary", password="secretary+password")
         url = urlreverse('doc_change_state', kwargs=dict(name=draft.name))
 
         mailbox_before = len(outbox)
@@ -820,7 +820,7 @@ def test_doc_view_shepherd_writeup(self):
         url = urlreverse('doc_shepherd_writeup',kwargs=dict(name=self.docname))
 
         # get as a shepherd
-        self.client.login(remote_user="plain")
+        self.client.login(username="plain", password="plain+password")
 
         r = self.client.get(url)
         self.assertEqual(r.status_code,200)
@@ -874,14 +874,14 @@ def setUp(self):
 class SubmitToIesgTests(TestCase):
     def verify_permissions(self):
 
-        def verify_fail(remote_user):
-            if remote_user:
-                self.client.login(remote_user=remote_user)
+        def verify_fail(username):
+            if username:
+                self.client.login(username=username, password=username+"+password")
             r = self.client.get(url)
             self.assertEqual(r.status_code,404)
 
-        def verify_can_see(remote_user):
-            self.client.login(remote_user=remote_user)
+        def verify_can_see(username):
+            self.client.login(username=username, password=username+"+password")
             r = self.client.get(url)
             self.assertEqual(r.status_code,200)
             q = PyQuery(r.content)
@@ -897,7 +897,7 @@ def verify_can_see(remote_user):
 
     def cancel_submission(self):
         url = urlreverse('doc_to_iesg', kwargs=dict(name=self.docname))
-        self.client.login(remote_user='marschairman')
+        self.client.login(username="marschairman", password="marschairman+password")
 
 	r = self.client.post(url, dict(cancel="1"))
         self.assertEqual(r.status_code, 302)
@@ -907,7 +907,7 @@ def cancel_submission(self):
 
     def confirm_submission(self):
         url = urlreverse('doc_to_iesg', kwargs=dict(name=self.docname))
-        self.client.login(remote_user='marschairman')
+        self.client.login(username="marschairman", password="marschairman+password")
 
         docevent_count_pre = self.doc.docevent_set.count()
         mailbox_before = len(outbox)

ietf/iesg/tests.py

@@ -410,7 +410,7 @@ def test_reschedule(self):
 
         url = urlreverse('ietf.iesg.views.agenda_documents')
 
-        self.client.login(remote_user="secretary")
+        self.client.login(username="secretary", password="secretary+password")
 
         # normal get
         r = self.client.get(url)

ietf/ietfauth/tests.py

@@ -44,25 +44,34 @@ def test_index(self):
     def test_login(self):
         make_test_data()
 
-        # try logging in with a next
-        r = self.client.get('/accounts/login/?next=/foobar', REMOTE_USER="plain")
+        # try logging in without a next
+        r = self.client.get('/accounts/login/')
+        self.assertEqual(r.status_code, 200)
+
+        r = self.client.post('/accounts/login/', {"username":"plain", "password":"plain+password"})
         self.assertEqual(r.status_code, 302)
-        self.assertEqual(urlsplit(r["Location"])[2], "/accounts/loggedin/")
+        self.assertEqual(urlsplit(r["Location"])[2], "/accounts/profile/")
 
-        r = self.client.get('/accounts/loggedin/?next=/foobar', REMOTE_USER="plain")
+        # try logging out
+        r = self.client.get('/accounts/logout/')        
+        self.assertEqual(r.status_code, 200)
+
+        r = self.client.get('/accounts/profile/')
         self.assertEqual(r.status_code, 302)
-        self.assertEqual(urlsplit(r["Location"])[2], "/foobar")
+        self.assertEqual(urlsplit(r["Location"])[2], "/accounts/login/")
 
-        # try again without a next
-        r = self.client.get('/accounts/login/', REMOTE_USER="plain")
-        r = self.client.get('/accounts/loggedin/', REMOTE_USER="plain")
+        # try logging in with a next
+        r = self.client.post('/accounts/login/?next=/foobar', {"username":"plain", "password":"plain+password"})
         self.assertEqual(r.status_code, 302)
-        self.assertEqual(urlsplit(r["Location"])[2], "/accounts/profile/")
+        self.assertEqual(urlsplit(r["Location"])[2], "/foobar")
+
 
     def test_profile(self):
+        make_test_data()
+
         url = urlreverse('ietf.ietfauth.views.profile')
         login_testing_unauthorized(self, "plain", url)
-
+        
         # get
         r = self.client.get(url)
         self.assertEqual(r.status_code, 200)

ietf/ietfauth/urls.py

@@ -1,11 +1,15 @@
 # Copyright The IETF Trust 2007, 2009, All Rights Reserved
 
 from django.conf.urls import patterns, url
+from django.contrib.auth.views import login, logout
 
 urlpatterns = patterns('ietf.ietfauth.views',
         url(r'^$', 'index', name='account_index'),
-        url(r'^login/$', 'ietf_login'),
-        url(r'^loggedin/$', 'ietf_loggedin'),
+#        url(r'^login/$', 'ietf_login'),
+        url(r'^login/$', login),
+        url(r'^logout/$', logout),
+#        url(r'^loggedin/$', 'ietf_loggedin'),
+#        url(r'^loggedout/$', 'logged_out'),
         url(r'^profile/$', 'profile'),
 #        (r'^login/(?P<user>[a-z0-9.@]+)/(?P<passwd>.+)$', 'url_login'),
         url(r'^testemail/$', 'test_email'),

ietf/ietfauth/views.py

@@ -63,6 +63,7 @@ def url_login(request, user, passwd):
             return HttpResponseRedirect('/accounts/loggedin/?%s=%s' % (REDIRECT_FIELD_NAME, urlquote(redirect_to)))
     return HttpResponse("Not authenticated?", status=500)
 
+@login_required
 def ietf_login(request):
     if not request.user.is_authenticated():
         return HttpResponse("Not authenticated?", status=500)
@@ -258,4 +259,3 @@ def test_email(request):
         r.set_cookie("testmailcc", cookie)
 
     return r
-

ietf/liaisons/tests.py

@@ -158,7 +158,7 @@ def test_taken_care_of(self):
         self.assertEqual(len(q('form input[name=do_action_taken]')), 0)
 
         # log in and get
-        self.client.login(remote_user="secretary")
+        self.client.login(username="secretary", password="secretary+password")
 
         r = self.client.get(url)
         self.assertEqual(r.status_code, 200)

ietf/meeting/tests_api.py

@@ -44,7 +44,7 @@ def do_post(to):
         self.assertEqual(ScheduledSession.objects.get(pk=mars_scheduled.pk).session, session)
 
         # faulty post - logged in as non-owner
-        self.client.login(remote_user="ad")
+        self.client.login(username="ad", password="ad+password")
         r = do_post(to=ames_scheduled)
         self.assertEqual(r.status_code, 200)
         self.assertTrue("error" in json.loads(r.content))
@@ -58,7 +58,7 @@ def do_post(to):
         test_schedule.save()
 
         # move to ames
-        self.client.login(remote_user="secretary")
+        self.client.login(username="secretary", password="secretary+password")
         r = do_post(to=ames_scheduled)
         self.assertEqual(r.status_code, 200)
         self.assertTrue("error" not in json.loads(r.content))
@@ -67,7 +67,7 @@ def do_post(to):
         self.assertEqual(ScheduledSession.objects.get(pk=ames_scheduled.pk).session, session)
 
         # unschedule
-        self.client.login(remote_user="secretary")
+        self.client.login(username="secretary", password="secretary+password")
         r = do_post(to=None)
         self.assertEqual(r.status_code, 200)
         self.assertTrue("error" not in json.loads(r.content))
@@ -121,7 +121,7 @@ def test_create_new_room(self):
         self.assertTrue(not meeting.room_set.filter(name="new room"))
 
         # create room
-        self.client.login(remote_user="secretary")
+        self.client.login(username="secretary", password="secretary+password")
         r = self.client.post(url, post_data)
         self.assertTrue(meeting.room_set.filter(name="new room"))
 
@@ -141,7 +141,7 @@ def test_delete_room(self):
         self.assertTrue(meeting.room_set.filter(pk=room.pk))
 
         # delete
-        self.client.login(remote_user="secretary")
+        self.client.login(username="secretary", password="secretary+password")
         r = self.client.delete(url)
         self.assertTrue(not meeting.room_set.filter(pk=room.pk))
         self.assertTrue(not TimeSlot.objects.filter(pk__in=timeslots_before))
@@ -189,12 +189,12 @@ def test_create_new_slot(self):
         }
 
         # unauthorized post
-        self.client.login(remote_user="ad")
+        self.client.login(username="ad", password="ad+password")
         r = self.client.post(url, post_data)
         self.assertEqual(r.status_code, 403)
 
         # create room
-        self.client.login(remote_user="secretary")
+        self.client.login(username="secretary", password="secretary+password")
         r = self.client.post(url, post_data)
         self.assertEqual(r.status_code, 302)
         self.assertTrue(meeting.timeslot_set.filter(time=slot_time))
@@ -207,12 +207,12 @@ def test_delete_slot(self):
                          kwargs=dict(num=meeting.number, slotid=slot.pk))
 
         # unauthorized delete
-        self.client.login(remote_user="ad")
+        self.client.login(username="ad", password="ad+password")
         r = self.client.delete(url)
         self.assertEqual(r.status_code, 403)
 
         # delete
-        self.client.login(remote_user="secretary")
+        self.client.login(username="secretary", password="secretary+password")
         self.client.delete(url)
         self.assertTrue(not meeting.timeslot_set.filter(pk=slot.pk))
 
@@ -236,13 +236,13 @@ def test_create_new_schedule(self):
         }
 
         # unauthorized post
-        self.client.login(remote_user="plain")
+        self.client.login(username="plain", password="plain+password")
         r = self.client.post(url, post_data)
         self.assertEqual(r.status_code, 403)
         self.assertTrue(not meeting.schedule_set.filter(name='new-agenda'))
 
         # create new agenda
-        self.client.login(remote_user="secretary")
+        self.client.login(username="secretary", password="secretary+password")
         r = self.client.post(url, post_data)
         self.assertEqual(r.status_code, 302)
         self.assertTrue(meeting.schedule_set.filter(name='new-agenda'))
@@ -262,12 +262,12 @@ def test_update_schedule(self):
         }
 
         # unauthorized post
-        self.client.login(remote_user="plain")
+        self.client.login(username="plain", password="plain+password")
         r = self.client.post(url, post_data)
         self.assertEqual(r.status_code, 403)
 
         # change agenda
-        self.client.login(remote_user="ad")
+        self.client.login(username="ad", password="ad+password")
         r = self.client.post(url, post_data)
         self.assertEqual(r.status_code, 302)
         changed_schedule = Schedule.objects.get(pk=meeting.agenda.pk)
@@ -281,12 +281,12 @@ def test_delete_schedule(self):
                          kwargs=dict(num=meeting.number,
                                      schedule_name=meeting.agenda.name))
         # unauthorized delete
-        self.client.login(remote_user="plain")
+        self.client.login(username="plain", password="plain+password")
         r = self.client.delete(url)
         self.assertEqual(r.status_code, 403)
 
         # delete
-        self.client.login(remote_user="secretary")
+        self.client.login(username="secretary", password="secretary+password")
         r = self.client.delete(url)
         self.assertEqual(r.status_code, 200)
         self.assertTrue(not Schedule.objects.filter(pk=meeting.agenda.pk))
@@ -301,12 +301,12 @@ def test_set_meeting_agenda(self):
             "agenda": "",
             }
         # unauthorized post
-        self.client.login(remote_user="ad")
+        self.client.login(username="ad", password="ad+password")
         r = self.client.post(url, post_data)
         self.assertEqual(r.status_code, 403)
 
         # clear
-        self.client.login(remote_user="secretary")
+        self.client.login(username="secretary", password="secretary+password")
         r = self.client.post(url, post_data)
         self.assertEqual(r.status_code, 200)
         self.assertTrue(not Meeting.objects.get(pk=meeting.pk).agenda)
@@ -340,7 +340,7 @@ def test_read_only(self):
             })}
 
         # Secretariat
-        self.client.login(remote_user="secretary")
+        self.client.login(username="secretary", password="secretary+password")
         r = self.client.post('/dajaxice/ietf.meeting.readonly/', data)
         self.assertEqual(r.status_code, 200)
 
@@ -351,7 +351,8 @@ def test_read_only(self):
         self.assertEqual(info['write_perm'], True)
 
         # owner
-        self.client.login(remote_user=meeting.agenda.owner.user.username)
+        self.client.login(username=meeting.agenda.owner.user.username,
+                          password=meeting.agenda.owner.user.username+"+password")
         r = self.client.post('/dajaxice/ietf.meeting.readonly/', data)
         self.assertEqual(r.status_code, 200)
 
@@ -383,7 +384,7 @@ def test_update_timeslot_pinned(self):
         # set pinned
         meeting.agenda.owner = Person.objects.get(user__username="secretary")
         meeting.agenda.save()
-        self.client.login(remote_user="secretary")
+        self.client.login(username="secretary", password="secretary+password")
         r = self.client.post(url, post_data)
         self.assertEqual(r.status_code, 200)
         self.assertTrue(ScheduledSession.objects.get(pk=scheduled.pk).pinned)

ietf/meeting/tests_views.py

@@ -154,7 +154,7 @@ def setUp(self):
     def test_edit_agenda(self):
         meeting = make_meeting_test_data()
 
-        self.client.login(remote_user="secretary")
+        self.client.login(username="secretary", password="secretary+password")
         r = self.client.get(urlreverse("ietf.meeting.views.edit_agenda", kwargs=dict(num=meeting.number)))
         self.assertEqual(r.status_code, 200)
         self.assertTrue("session_obj" in r.content)
@@ -164,7 +164,7 @@ def test_save_agenda_as_and_read_permissions(self):
         url = urlreverse("ietf.meeting.views.edit_agenda", kwargs=dict(num=meeting.number))
 
         # save as
-        self.client.login(remote_user="ad")
+        self.client.login(username="ad", password="ad+password")
         r = self.client.post(url, {
             'savename': "foo",
             'saveas': "saveas",
@@ -196,14 +196,14 @@ def test_save_agenda_as_and_read_permissions(self):
         schedule.visible = False
         schedule.public = False
         schedule.save()
-        self.client.login(remote_user="secretary")
+        self.client.login(username="secretary", password="secretary+password")
         r = self.client.get(url)
         self.assertEqual(r.status_code, 200)
 
     def test_edit_timeslots(self):
         meeting = make_meeting_test_data()
 
-        self.client.login(remote_user="secretary")
+        self.client.login(username="secretary", password="secretary+password")
         r = self.client.get(urlreverse("ietf.meeting.views.edit_timeslots", kwargs=dict(num=meeting.number)))
         self.assertEqual(r.status_code, 200)
         self.assertTrue(meeting.room_set.all().first().name in r.content)

ietf/nomcom/test_data.py

@@ -113,7 +113,10 @@ def nomcom_test_data():
     create_person(group, "member", username=MEMBER_USER)
 
     # nominee
-    u, _ = User.objects.get_or_create(username=COMMUNITY_USER)
+    u, created = User.objects.get_or_create(username=COMMUNITY_USER)
+    if created:
+        u.set_password(COMMUNITY_USER+"+password")
+        u.save()
     plainman, _ = Person.objects.get_or_create(name="Plain Man", ascii="Plain Man", user=u)
     email, _ = Email.objects.get_or_create(address="plain@example.com", person=plainman)
     nominee, _ = Nominee.objects.get_or_create(email=email, nomcom=nomcom)