1. from datetime import datetime, timedelta

  2. 

  3. from django.conf import settings

  4. from django.contrib.auth.models import User

  5. from django.contrib.auth.tokens import PasswordResetTokenGenerator

  6. from django.core.exceptions import ImproperlyConfigured

  7. from django.test import TestCase

  8. from django.test.utils import override_settings

  9. 

  10. from .models import CustomEmailField

  11. 

  12. 

  13. class MockedPasswordResetTokenGenerator(PasswordResetTokenGenerator):

  14.     def __init__(self, now):

  15.         self._now_val = now

  16.         super().__init__()

  17. 

  18.     def _now(self):

  19.         return self._now_val

  20. 

  21. 

  22. class TokenGeneratorTest(TestCase):

  23.     def test_make_token(self):

  24.         user = User.objects.create_user("tokentestuser", "[email protected]", "testpw")

  25.         p0 = PasswordResetTokenGenerator()

  26.         tk1 = p0.make_token(user)

  27.         self.assertIs(p0.check_token(user, tk1), True)

  28. 

  29.     def test_10265(self):

  30.         """

  31.         The token generated for a user created in the same request

  32.         will work correctly.

  33.         """

  34.         user = User.objects.create_user("comebackkid", "[email protected]", "testpw")

  35.         user_reload = User.objects.get(username="comebackkid")

  36.         p0 = MockedPasswordResetTokenGenerator(datetime.now())

  37.         tk1 = p0.make_token(user)

  38.         tk2 = p0.make_token(user_reload)

  39.         self.assertEqual(tk1, tk2)

  40. 

  41.     def test_token_with_different_email(self):

  42.         """Updating the user email address invalidates the token."""

  43.         tests = [

  44.             (CustomEmailField, None),

  45.             (CustomEmailField, "[email protected]"),

  46.             (User, "[email protected]"),

  47.         ]

  48.         for model, email in tests:

  49.             with self.subTest(model=model.__qualname__, email=email):

  50.                 user = model.objects.create_user(

  51.                     "changeemailuser",

  52.                     email=email,

  53.                     password="testpw",

  54.                 )

  55.                 p0 = PasswordResetTokenGenerator()

  56.                 tk1 = p0.make_token(user)

  57.                 self.assertIs(p0.check_token(user, tk1), True)

  58.                 setattr(user, user.get_email_field_name(), "[email protected]")

  59.                 user.save()

  60.                 self.assertIs(p0.check_token(user, tk1), False)

  61. 

  62.     def test_timeout(self):

  63.         """The token is valid after n seconds, but no greater."""

  64.         # Uses a mocked version of PasswordResetTokenGenerator so we can change

  65.         # the value of 'now'.

  66.         user = User.objects.create_user("tokentestuser", "[email protected]", "testpw")

  67.         now = datetime.now()

  68.         p0 = MockedPasswordResetTokenGenerator(now)

  69.         tk1 = p0.make_token(user)

  70.         p1 = MockedPasswordResetTokenGenerator(

  71.             now + timedelta(seconds=settings.PASSWORD_RESET_TIMEOUT)

  72.         )

  73.         self.assertIs(p1.check_token(user, tk1), True)

  74.         p2 = MockedPasswordResetTokenGenerator(

  75.             now + timedelta(seconds=(settings.PASSWORD_RESET_TIMEOUT + 1))

  76.         )

  77.         self.assertIs(p2.check_token(user, tk1), False)

  78.         with self.settings(PASSWORD_RESET_TIMEOUT=60 * 60):

  79.             p3 = MockedPasswordResetTokenGenerator(

  80.                 now + timedelta(seconds=settings.PASSWORD_RESET_TIMEOUT)

  81.             )

  82.             self.assertIs(p3.check_token(user, tk1), True)

  83.             p4 = MockedPasswordResetTokenGenerator(

  84.                 now + timedelta(seconds=(settings.PASSWORD_RESET_TIMEOUT + 1))

  85.             )

  86.             self.assertIs(p4.check_token(user, tk1), False)

  87. 

  88.     def test_check_token_with_nonexistent_token_and_user(self):

  89.         user = User.objects.create_user("tokentestuser", "[email protected]", "testpw")

  90.         p0 = PasswordResetTokenGenerator()

  91.         tk1 = p0.make_token(user)

  92.         self.assertIs(p0.check_token(None, tk1), False)

  93.         self.assertIs(p0.check_token(user, None), False)

  94. 

  95.     def test_token_with_different_secret(self):

  96.         """

  97.         A valid token can be created with a secret other than SECRET_KEY by

  98.         using the PasswordResetTokenGenerator.secret attribute.

  99.         """

  100.         user = User.objects.create_user("tokentestuser", "[email protected]", "testpw")

  101.         new_secret = "abcdefghijkl"

  102.         # Create and check a token with a different secret.

  103.         p0 = PasswordResetTokenGenerator()

  104.         p0.secret = new_secret

  105.         tk0 = p0.make_token(user)

  106.         self.assertIs(p0.check_token(user, tk0), True)

  107.         # Create and check a token with the default secret.

  108.         p1 = PasswordResetTokenGenerator()

  109.         self.assertEqual(p1.secret, settings.SECRET_KEY)

  110.         self.assertNotEqual(p1.secret, new_secret)

  111.         tk1 = p1.make_token(user)

  112.         # Tokens created with a different secret don't validate.

  113.         self.assertIs(p0.check_token(user, tk1), False)

  114.         self.assertIs(p1.check_token(user, tk0), False)

  115. 

  116.     def test_token_with_different_secret_subclass(self):

  117.         class CustomPasswordResetTokenGenerator(PasswordResetTokenGenerator):

  118.             secret = "test-secret"

  119. 

  120.         user = User.objects.create_user("tokentestuser", "[email protected]", "testpw")

  121.         custom_password_generator = CustomPasswordResetTokenGenerator()

  122.         tk_custom = custom_password_generator.make_token(user)

  123.         self.assertIs(custom_password_generator.check_token(user, tk_custom), True)

  124. 

  125.         default_password_generator = PasswordResetTokenGenerator()

  126.         self.assertNotEqual(

  127.             custom_password_generator.secret,

  128.             default_password_generator.secret,

  129.         )

  130.         self.assertEqual(default_password_generator.secret, settings.SECRET_KEY)

  131.         # Tokens created with a different secret don't validate.

  132.         tk_default = default_password_generator.make_token(user)

  133.         self.assertIs(custom_password_generator.check_token(user, tk_default), False)

  134.         self.assertIs(default_password_generator.check_token(user, tk_custom), False)

  135. 

  136.     @override_settings(SECRET_KEY="")

  137.     def test_secret_lazy_validation(self):

  138.         default_token_generator = PasswordResetTokenGenerator()

  139.         msg = "The SECRET_KEY setting must not be empty."

  140.         with self.assertRaisesMessage(ImproperlyConfigured, msg):

  141.             default_token_generator.secret

  142. 

  143.     def test_check_token_secret_fallbacks(self):

  144.         user = User.objects.create_user("tokentestuser", "[email protected]", "testpw")

  145.         p1 = PasswordResetTokenGenerator()

  146.         p1.secret = "secret"

  147.         tk = p1.make_token(user)

  148.         p2 = PasswordResetTokenGenerator()

  149.         p2.secret = "newsecret"

  150.         p2.secret_fallbacks = ["secret"]

  151.         self.assertIs(p1.check_token(user, tk), True)

  152.         self.assertIs(p2.check_token(user, tk), True)

  153. 

  154.     @override_settings(

  155.         SECRET_KEY="secret",

  156.         SECRET_KEY_FALLBACKS=["oldsecret"],

  157.     )

  158.     def test_check_token_secret_key_fallbacks(self):

  159.         user = User.objects.create_user("tokentestuser", "[email protected]", "testpw")

  160.         p1 = PasswordResetTokenGenerator()

  161.         p1.secret = "oldsecret"

  162.         tk = p1.make_token(user)

  163.         p2 = PasswordResetTokenGenerator()

  164.         self.assertIs(p2.check_token(user, tk), True)

  165. 

  166.     @override_settings(

  167.         SECRET_KEY="secret",

  168.         SECRET_KEY_FALLBACKS=["oldsecret"],

  169.     )

  170.     def test_check_token_secret_key_fallbacks_override(self):

  171.         user = User.objects.create_user("tokentestuser", "[email protected]", "testpw")

  172.         p1 = PasswordResetTokenGenerator()

  173.         p1.secret = "oldsecret"

  174.         tk = p1.make_token(user)

  175.         p2 = PasswordResetTokenGenerator()

  176.         p2.secret_fallbacks = []

  177.         self.assertIs(p2.check_token(user, tk), False)
About Sign Up Leave Feedback Contact