Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def tearDown(self):
close_all_sessions()
engine = create_engine(DATABASE_URI)
database.Base.metadata.drop_all(bind=engine)
response = self.post('/register', dict(login='User',
password1='hackme',
password2='hackme',
email='test@example.com'))
self.assertEqual(response.code, 302)
self.assertEqual(response.headers['Location'], '/')
# User exists in database
db = self.application.DBSession()
self.assertEqual(
[
(
user.login,
bool(user.hashed_password), bool(user.password_set_date),
)
for user in db.query(database.User).all()
],
[
('admin', True, True),
('user', True, True),
],
)
# Log out
response = self.get('/logout')
self.assertEqual(response.code, 302)
self.assertEqual(response.headers['Location'], '/')
# Wait so that reset link is more recent than password
time.sleep(1)
# Send reset link
def __init__(self, handlers,
config, **kwargs):
self.config = config
# Don't reuse the secret
cookie_secret = config['SECRET_KEY']
super(Application, self).__init__(handlers,
cookie_secret=cookie_secret,
**kwargs)
d = pkg_resources.resource_filename('taguette', 'l10n')
tornado.locale.load_gettext_translations(d, 'taguette_main')
tornado.locale.set_default_locale(self.config['DEFAULT_LANGUAGE'])
self.DBSession = database.connect(config['DATABASE'])
self.event_waiters = {}
db = self.DBSession()
admin = (
db.query(database.User)
.filter(database.User.login == 'admin')
.one_or_none()
)
if admin is None:
logger.warning("Creating user 'admin'")
admin = database.User(login='admin')
if config['MULTIUSER']:
self._set_password(admin)
db.add(admin)
db.commit()
elif config['MULTIUSER'] and not admin.hashed_password:
def post(self):
if not self.application.config['MULTIUSER']:
raise HTTPError(404)
login = self.get_json()['login']
try:
login = validate.user_login(login)
except validate.InvalidFormat:
pass
else:
user = self.db.query(database.User).get(login)
if user is not None:
return self.send_json({'exists': True})
return self.send_json({'exists': False})
def get(self, project_id):
project, privileges = self.get_project(project_id)
if not privileges.can_delete_project():
self.set_status(403)
return self.finish(self.gettext(
"You don't have permission to delete this project",
))
doc = aliased(database.Document)
highlights = (
self.db.query(database.Highlight)
.join(doc, database.Highlight.document_id == doc.id)
.filter(doc.project_id == project.id)
).count()
return self.render('project_delete.html', project=project,
documents=len(project.documents),
tags=len(project.tags),
highlights=highlights)
def get(self, project_id):
project, privileges = self.get_project(project_id)
if not privileges.can_delete_project():
self.set_status(403)
return self.finish(self.gettext(
"You don't have permission to delete this project",
))
doc = aliased(database.Document)
highlights = (
self.db.query(database.Highlight)
.join(doc, database.Highlight.document_id == doc.id)
.filter(doc.project_id == project.id)
).count()
return self.render('project_delete.html', project=project,
documents=len(project.documents),
tags=len(project.tags),
highlights=highlights)