From 243d0bec1954ad7fab44625f1440a8ce580df26c Mon Sep 17 00:00:00 2001 From: Luke Plant Date: Tue, 15 Mar 2011 20:37:09 +0000 Subject: Fixed #15617 - CSRF referer checking too strict Thanks to adam for the report. git-svn-id: http://code.djangoproject.com/svn/django/trunk@15840 bcc190cf-cafb-0310-a4f2-bffc1f526a37 --- tests/regressiontests/utils/http.py | 23 +++++++++++++++++++++++ tests/regressiontests/utils/tests.py | 1 + 2 files changed, 24 insertions(+) create mode 100644 tests/regressiontests/utils/http.py (limited to 'tests/regressiontests/utils') diff --git a/tests/regressiontests/utils/http.py b/tests/regressiontests/utils/http.py new file mode 100644 index 0000000000..83a4a7f54d --- /dev/null +++ b/tests/regressiontests/utils/http.py @@ -0,0 +1,23 @@ +from django.utils import http +from django.utils import unittest + +class TestUtilsHttp(unittest.TestCase): + + def test_same_origin_true(self): + # Identical + self.assertTrue(http.same_origin('http://foo.com/', 'http://foo.com/')) + # One with trailing slash - see #15617 + self.assertTrue(http.same_origin('http://foo.com', 'http://foo.com/')) + self.assertTrue(http.same_origin('http://foo.com/', 'http://foo.com')) + # With port + self.assertTrue(http.same_origin('https://foo.com:8000', 'https://foo.com:8000/')) + + def test_same_origin_false(self): + # Different scheme + self.assertFalse(http.same_origin('http://foo.com', 'https://foo.com')) + # Different host + self.assertFalse(http.same_origin('http://foo.com', 'http://goo.com')) + # Different host again + self.assertFalse(http.same_origin('http://foo.com', 'http://foo.com.evil.com')) + # Different port + self.assertFalse(http.same_origin('http://foo.com:8000', 'http://foo.com:8001')) diff --git a/tests/regressiontests/utils/tests.py b/tests/regressiontests/utils/tests.py index 6d3bbfa86c..5c4c0602e8 100644 --- a/tests/regressiontests/utils/tests.py +++ b/tests/regressiontests/utils/tests.py @@ -7,6 +7,7 @@ from feedgenerator import * from module_loading import * from termcolors import * from html import * +from http import * from checksums import * from text import * from simplelazyobject import * -- cgit v1.3