From 130257c96a2392ada795785a91178e656e27015c Mon Sep 17 00:00:00 2001 From: Antoine Nguyen Date: Fri, 14 Apr 2023 18:44:23 +0200 Subject: [PATCH 01/12] Fixed security issue with password update. --- modoboa/core/forms.py | 5 +++++ modoboa/core/tests/test_core.py | 7 +++++++ 2 files changed, 12 insertions(+) diff --git a/modoboa/core/forms.py b/modoboa/core/forms.py index b98e53175..a52bb8610 100644 --- a/modoboa/core/forms.py +++ b/modoboa/core/forms.py @@ -92,6 +92,11 @@ class ProfileForm(forms.ModelForm): confirmation, self.instance) else: self.add_error("oldpassword", _("This field is required.")) + elif newpassword or confirmation: + if not confirmation: + self.add_error("confirmation", _("This field is required.")) + else: + self.add_error("newpassword", _("This field is required.")) return self.cleaned_data def save(self, commit=True): diff --git a/modoboa/core/tests/test_core.py b/modoboa/core/tests/test_core.py index ef7b99688..a0c6a36bf 100644 --- a/modoboa/core/tests/test_core.py +++ b/modoboa/core/tests/test_core.py @@ -146,6 +146,13 @@ class ProfileTestCase(ModoTestCase): self.client.login(username="user@test.com", password="toto"), True ) + self.ajax_post( + reverse("core:user_profile"), + {"oldpassword": "toto", + "confirmation": "tutu"}, + status=400 + ) + self.ajax_post( reverse("core:user_profile"), {"oldpassword": "toto", From 30aaa420270bc469312699e3991038de3de1f64c Mon Sep 17 00:00:00 2001 From: Antoine Nguyen Date: Mon, 17 Apr 2023 09:49:30 +0200 Subject: [PATCH 02/12] Updated workflow to fix codecov step --- .github/workflows/modoboa.yml | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/.github/workflows/modoboa.yml b/.github/workflows/modoboa.yml index ec33e053e..ae6d350ab 100644 --- a/.github/workflows/modoboa.yml +++ b/.github/workflows/modoboa.yml @@ -144,17 +144,12 @@ jobs: uses: actions/setup-python@v2 with: python-version: '3.8' - - name: Install dependencies - run: | - pip install codecov - name: Download coverage results uses: actions/download-artifact@v2 with: name: coverage-results - - name: Report coverage - run: | - coverage report - codecov + - name: Upload coverage to Codecov + uses: codecov/codecov-action@v3 release: if: github.event_name != 'pull_request' From eb51a3085bca558f7a0cad57f2e8fc06dbbe5e2e Mon Sep 17 00:00:00 2001 From: Antoine Nguyen Date: Mon, 17 Apr 2023 10:08:40 +0200 Subject: [PATCH 03/12] Create coverage report. --- .github/workflows/modoboa.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/modoboa.yml b/.github/workflows/modoboa.yml index ae6d350ab..0408b2d84 100644 --- a/.github/workflows/modoboa.yml +++ b/.github/workflows/modoboa.yml @@ -148,6 +148,8 @@ jobs: uses: actions/download-artifact@v2 with: name: coverage-results + - name: Report coverage + run: coverage report - name: Upload coverage to Codecov uses: codecov/codecov-action@v3 From c896d19c29514f038d852fa6b8595640e9e113f9 Mon Sep 17 00:00:00 2001 From: Antoine Nguyen Date: Mon, 17 Apr 2023 10:29:11 +0200 Subject: [PATCH 04/12] Updated workflow --- .github/workflows/modoboa.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/modoboa.yml b/.github/workflows/modoboa.yml index 0408b2d84..3febdf77c 100644 --- a/.github/workflows/modoboa.yml +++ b/.github/workflows/modoboa.yml @@ -152,6 +152,8 @@ jobs: run: coverage report - name: Upload coverage to Codecov uses: codecov/codecov-action@v3 + with: + files: test_project/.coverage release: if: github.event_name != 'pull_request' From 191cb99fec2fdbf8d35c7c16e372ef301e1947db Mon Sep 17 00:00:00 2001 From: Antoine Nguyen Date: Mon, 17 Apr 2023 10:42:08 +0200 Subject: [PATCH 05/12] Removed wrong line --- .github/workflows/modoboa.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/.github/workflows/modoboa.yml b/.github/workflows/modoboa.yml index 3febdf77c..0f53a612d 100644 --- a/.github/workflows/modoboa.yml +++ b/.github/workflows/modoboa.yml @@ -148,8 +148,6 @@ jobs: uses: actions/download-artifact@v2 with: name: coverage-results - - name: Report coverage - run: coverage report - name: Upload coverage to Codecov uses: codecov/codecov-action@v3 with: From 350027a47bb1c58eff264708bc3f642480f64fdb Mon Sep 17 00:00:00 2001 From: Antoine Nguyen Date: Mon, 17 Apr 2023 15:17:27 +0200 Subject: [PATCH 06/12] Updated workflow --- .github/workflows/modoboa.yml | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/.github/workflows/modoboa.yml b/.github/workflows/modoboa.yml index 0f53a612d..db0224a5a 100644 --- a/.github/workflows/modoboa.yml +++ b/.github/workflows/modoboa.yml @@ -113,12 +113,13 @@ jobs: LDAP_SERVER_PORT: ${{ job.services.openldap.ports[389] }} - name: Test with pytest and coverage - if: ${{ matrix.python-version == '3.8' && matrix.database == 'postgres' }} + if: ${{ matrix.python-version == '3.10' && matrix.database == 'postgres' }} run: | python ./tests.py cd test_project coverage run manage.py test modoboa coverage combine + coverage report env: # use localhost for the host here because we are running the job on the VM. # If we were running the job on in a container this would be postgres @@ -129,7 +130,7 @@ jobs: REDIS_PORT: ${{ job.services.redis.ports[6379] }} LDAP_SERVER_PORT: ${{ job.services.openldap.ports[389] }} - name: Upload coverage result - if: ${{ matrix.python-version == '3.8' }} + if: ${{ matrix.python-version == '3.10' && matrix.database == 'postgres' }} uses: actions/upload-artifact@v2 with: name: coverage-results @@ -140,10 +141,6 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 - - name: Set up Python 3.8 - uses: actions/setup-python@v2 - with: - python-version: '3.8' - name: Download coverage results uses: actions/download-artifact@v2 with: From ec4a228fcc90968f848639af4716523fc2893817 Mon Sep 17 00:00:00 2001 From: Antoine Nguyen Date: Mon, 17 Apr 2023 15:43:17 +0200 Subject: [PATCH 07/12] Added debug --- .github/workflows/modoboa.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/modoboa.yml b/.github/workflows/modoboa.yml index db0224a5a..7468a1e52 100644 --- a/.github/workflows/modoboa.yml +++ b/.github/workflows/modoboa.yml @@ -120,6 +120,7 @@ jobs: coverage run manage.py test modoboa coverage combine coverage report + ls -la .coverage env: # use localhost for the host here because we are running the job on the VM. # If we were running the job on in a container this would be postgres From 77cb1495c842fe9dd739737af1e5bd9906601c0c Mon Sep 17 00:00:00 2001 From: Antoine Nguyen Date: Tue, 18 Apr 2023 09:27:46 +0200 Subject: [PATCH 08/12] Try with XML outptu --- .github/workflows/modoboa.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/modoboa.yml b/.github/workflows/modoboa.yml index 7468a1e52..036ab09bf 100644 --- a/.github/workflows/modoboa.yml +++ b/.github/workflows/modoboa.yml @@ -119,6 +119,7 @@ jobs: cd test_project coverage run manage.py test modoboa coverage combine + coverage xml coverage report ls -la .coverage env: @@ -148,8 +149,6 @@ jobs: name: coverage-results - name: Upload coverage to Codecov uses: codecov/codecov-action@v3 - with: - files: test_project/.coverage release: if: github.event_name != 'pull_request' From ec280c4f3f210c6b311d375f8c3a028b4f52892a Mon Sep 17 00:00:00 2001 From: Antoine Nguyen Date: Tue, 18 Apr 2023 09:43:52 +0200 Subject: [PATCH 09/12] Force XML file path --- .github/workflows/modoboa.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/modoboa.yml b/.github/workflows/modoboa.yml index 036ab09bf..2278b5898 100644 --- a/.github/workflows/modoboa.yml +++ b/.github/workflows/modoboa.yml @@ -121,7 +121,6 @@ jobs: coverage combine coverage xml coverage report - ls -la .coverage env: # use localhost for the host here because we are running the job on the VM. # If we were running the job on in a container this would be postgres @@ -149,6 +148,8 @@ jobs: name: coverage-results - name: Upload coverage to Codecov uses: codecov/codecov-action@v3 + with: + files: ./test_project/coverage.xml release: if: github.event_name != 'pull_request' From 34c473f0569f5d596400ef2af471a4408b18f3cf Mon Sep 17 00:00:00 2001 From: Antoine Nguyen Date: Tue, 18 Apr 2023 09:45:27 +0200 Subject: [PATCH 10/12] Updated artifact --- .github/workflows/modoboa.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/modoboa.yml b/.github/workflows/modoboa.yml index 2278b5898..d8db99cf8 100644 --- a/.github/workflows/modoboa.yml +++ b/.github/workflows/modoboa.yml @@ -135,7 +135,7 @@ jobs: uses: actions/upload-artifact@v2 with: name: coverage-results - path: test_project/.coverage + path: test_project/coverage.xml coverage: needs: test From 1a2bf048f400f9475bf1eea336c2364751481d33 Mon Sep 17 00:00:00 2001 From: Antoine Nguyen Date: Tue, 18 Apr 2023 10:01:09 +0200 Subject: [PATCH 11/12] Updated XML path --- .github/workflows/modoboa.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/modoboa.yml b/.github/workflows/modoboa.yml index d8db99cf8..7412140be 100644 --- a/.github/workflows/modoboa.yml +++ b/.github/workflows/modoboa.yml @@ -149,7 +149,7 @@ jobs: - name: Upload coverage to Codecov uses: codecov/codecov-action@v3 with: - files: ./test_project/coverage.xml + files: ./coverage.xml release: if: github.event_name != 'pull_request' From 55db7b2ceb27d64ea7db89f8033a887cd3869afc Mon Sep 17 00:00:00 2001 From: Antoine Nguyen Date: Tue, 18 Apr 2023 15:31:48 +0200 Subject: [PATCH 12/12] Updated unit test --- modoboa/core/forms.py | 2 +- modoboa/core/tests/test_core.py | 17 ++++++++++++++--- 2 files changed, 15 insertions(+), 4 deletions(-) diff --git a/modoboa/core/forms.py b/modoboa/core/forms.py index a52bb8610..3c1d8e0de 100644 --- a/modoboa/core/forms.py +++ b/modoboa/core/forms.py @@ -49,7 +49,7 @@ class ProfileForm(forms.ModelForm): widget=forms.PasswordInput(attrs={"class": "form-control"}) ) - class Meta(object): + class Meta: model = User fields = ("first_name", "last_name", "language", "phone_number", "secondary_email") diff --git a/modoboa/core/tests/test_core.py b/modoboa/core/tests/test_core.py index a0c6a36bf..c722432da 100644 --- a/modoboa/core/tests/test_core.py +++ b/modoboa/core/tests/test_core.py @@ -148,15 +148,26 @@ class ProfileTestCase(ModoTestCase): self.ajax_post( reverse("core:user_profile"), - {"oldpassword": "toto", + {"language": "en", + "oldpassword": "toto", "confirmation": "tutu"}, status=400 ) self.ajax_post( reverse("core:user_profile"), - {"oldpassword": "toto", - "newpassword": "tutu", "confirmation": "tutu"}, + {"language": "en", + "oldpassword": "toto", + "newpassword": "tutu"}, + status=400 + ) + + self.ajax_post( + reverse("core:user_profile"), + {"language": "en", + "oldpassword": "toto", + "newpassword": "tutu", + "confirmation": "tutu"}, status=400 )