This function checks login functionality.
(self)
| 103 | app_config.PGADMIN_EXTERNAL_AUTH_SOURCE = INTERNAL |
| 104 | |
| 105 | def runTest(self): |
| 106 | """This function checks login functionality.""" |
| 107 | res = self.tester.login(self.email, self.password, True) |
| 108 | if self.is_gravtar_image_check: |
| 109 | # Post-React-rewrite, the "Gravatar image for X" HTML this |
| 110 | # test was written against is no longer server-rendered (it |
| 111 | # is built client-side by React). Verify successful login by |
| 112 | # checking the server-side session has the user's id. |
| 113 | # |
| 114 | # NOTE: This does NOT prove the session was rotated to defeat |
| 115 | # fixation. Flask-Paranoid does not rotate the session id on |
| 116 | # login — it binds a `_paranoid_token` to UA+IP and validates |
| 117 | # it per-request — so a strict sid-rotation assertion would |
| 118 | # give false confidence. Stronger fixation testing is owed as |
| 119 | # follow-up. |
| 120 | if app_config.SHOW_GRAVATAR_IMAGE: |
| 121 | with self.tester.session_transaction() as sess: |
| 122 | self.assertIsNotNone( |
| 123 | sess.get('_user_id'), |
| 124 | 'Post-login session should have _user_id') |
| 125 | else: |
| 126 | self.assertTrue(self.respdata in res.data.decode('utf8')) |
| 127 | |
| 128 | @classmethod |
| 129 | def tearDownClass(cls): |