Commit 15bf143b by Xavier Antoviaque

Add validation of configuration model to enforce absolute URLs

Meant to avoid infinite redirect when matching the redirected URL with
the current URL.
parent 43b07968
...@@ -47,3 +47,8 @@ class SplashConfig(ConfigurationModel): ...@@ -47,3 +47,8 @@ class SplashConfig(ConfigurationModel):
return [] return []
return [name.strip() for name in self.unaffected_usernames.split(',')] # pylint: disable=no-member return [name.strip() for name in self.unaffected_usernames.split(',')] # pylint: disable=no-member
def save(self, *args, **kwargs):
"""Call `full_clean` before saving to ensure proper validation of configuration values"""
self.full_clean()
super(SplashConfig, self).save(*args, **kwargs)
...@@ -3,6 +3,7 @@ Splash - Tests ...@@ -3,6 +3,7 @@ Splash - Tests
""" """
from django.contrib.auth.models import AnonymousUser, User from django.contrib.auth.models import AnonymousUser, User
from django.core.exceptions import ValidationError
from django.test import TestCase from django.test import TestCase
from django.test.client import RequestFactory from django.test.client import RequestFactory
...@@ -22,7 +23,7 @@ class SplashMiddlewareTestCase(TestCase): ...@@ -22,7 +23,7 @@ class SplashMiddlewareTestCase(TestCase):
Init Init
""" """
self.splash_middleware = SplashMiddleware() self.splash_middleware = SplashMiddleware()
self.request_factory = RequestFactory() self.request_factory = RequestFactory(SERVER_NAME='example.org')
SplashConfig().save() SplashConfig().save()
def build_request(self, username=None, cookies=None): def build_request(self, username=None, cookies=None):
...@@ -159,9 +160,18 @@ class SplashMiddlewareTestCase(TestCase): ...@@ -159,9 +160,18 @@ class SplashMiddlewareTestCase(TestCase):
""" """
SplashConfig( SplashConfig(
enabled=True, enabled=True,
redirect_url='http://testserver/somewhere' redirect_url='http://example.org/somewhere'
).save() ).save()
request = self.build_request() request = self.build_request()
response = self.splash_middleware.process_request(request) response = self.splash_middleware.process_request(request)
self.assertEquals(response, None) self.assertEquals(response, None)
def test_set_non_absolute_url(self):
"""
Make sure the URL is absolute, to make sure we can compare it
to the current URL
Should not validate with a non-absolute URL
"""
config = SplashConfig(redirect_url='/somewhere')
self.assertRaises(ValidationError, config.save)
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment