Mirror
/
zulip
mirror of https://github.com/zulip/zulip.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
zulip/zerver/tests
History
Vishnu Ks 985768b2fd registration: Check realm against PreregistrationUser realm. 
We would allow a user with a valid invitation for one realm to use it
on a different realm instead.  On a server with multiple realms, an
authorized user of one realm could use this (by sending invites to
other email addresses they control) to create accounts on other
realms. (CVE-2017-0910)

With this commit, when sending an invitation, we record the inviting
user's realm on the PreregistrationUser row; and when registering a
user, we check that the PregistrationUser realm matches the realm the
user is trying to register on.  This resolves CVE-2017-0910 for
newly-sent invitations; the next commit completes the fix.

[greg: rewrote commit message]
 		2017-11-27 14:58:26 -08:00
..
images Update types of images accepted as avatars. 2016-07-26 16:36:47 +05:30
__init__.py Fix missing zerver/tests/__init__.py. 2016-04-11 22:34:22 -07:00
test_alert_words.py zerver/tests: Use python 3 syntax for typing in most files. 2017-11-16 21:52:01 -08:00
test_attachments.py zerver/tests: Use python 3 syntax for typing in most files. 2017-11-16 21:52:01 -08:00
test_audit_log.py zerver/tests: Use python 3 syntax for typing in most files. 2017-11-16 21:52:01 -08:00
test_auth_backends.py zerver/tests: Use python 3 syntax for typing (final). 2017-11-21 22:01:19 -08:00
test_bots.py zerver/tests: Use python 3 syntax for typing in most files. 2017-11-16 21:52:01 -08:00
test_bugdown.py markdown: Hide URL if message is only an image. 2017-11-27 13:30:18 -08:00
test_compatibility.py zerver/tests: Use python 3 syntax for typing in most files. 2017-11-16 21:52:01 -08:00
test_custom_profile_data.py zerver/tests: Use python 3 syntax for typing in most files. 2017-11-16 21:52:01 -08:00
test_decorators.py zerver/tests: Use python 3 syntax for typing (part 4). 2017-11-21 22:01:19 -08:00
test_docs.py register: Make /register redirect to find accounts in root domain without realm. 2017-11-26 15:32:17 -08:00
test_email_change.py zerver/tests: Use python 3 syntax for typing in most files. 2017-11-16 21:52:01 -08:00
test_email_log.py zerver/tests: Use python 3 syntax for typing. 2017-11-18 15:35:57 -08:00
test_email_mirror.py queue processor tests: Call consume by default. 2017-11-26 11:45:34 -08:00
test_embedded_bot_system.py zerver/tests: Use python 3 syntax for typing in most files. 2017-11-16 21:52:01 -08:00
test_event_queue.py zerver/tests: Use python 3 syntax for typing in most files. 2017-11-16 21:52:01 -08:00
test_events.py zerver/tests: Use python 3 syntax for typing (final). 2017-11-21 22:01:19 -08:00
test_export.py zerver/tests: Use python 3 syntax for typing in most files. 2017-11-16 21:52:01 -08:00
test_external.py zerver/tests: Use python 3 syntax for typing. 2017-11-18 15:35:57 -08:00
test_home.py zerver/tests: Use python 3 syntax for typing (part 3). 2017-11-21 22:01:19 -08:00
test_hotspots.py zerver/tests: Use python 3 syntax for typing in most files. 2017-11-16 21:52:01 -08:00
test_i18n.py zerver/tests: Use python 3 syntax for typing in most files. 2017-11-16 21:52:01 -08:00
test_json_encoder_for_html.py zerver: Remove simplejson dependency. 2017-11-21 21:51:48 -08:00
test_link_embed.py python: Wrap long def lines in test files. 2017-11-16 22:00:53 -08:00
test_logging_handlers.py zerver/tests: Use python 3 syntax for typing (final). 2017-11-21 22:01:19 -08:00
test_management_commands.py zerver/tests: Use python 3 syntax for typing (part 4). 2017-11-21 22:01:19 -08:00
test_message_edit_notifications.py python: Wrap long def lines in test files. 2017-11-16 22:00:53 -08:00
test_messages.py Eliminate get_user_profile_by_email from test_classes. 2017-11-26 15:47:56 -08:00
test_middleware.py zerver/tests: Use python 3 syntax for typing. 2017-11-18 15:35:57 -08:00
test_muting.py zerver/tests: Use python 3 syntax for typing in most files. 2017-11-16 21:52:01 -08:00
test_narrow.py Eliminate get_user_profile_by_email from test_classes. 2017-11-26 15:47:56 -08:00
test_new_users.py models: Replace core team with Realm.INITIAL_PRIVATE_STREAM_NAME. 2017-11-21 17:39:51 -08:00
test_notifications.py python: Wrap long def lines in test files. 2017-11-16 22:00:53 -08:00
test_outgoing_webhook_interfaces.py zerver/tests: Use python 3 syntax for typing in most files. 2017-11-16 21:52:01 -08:00
test_outgoing_webhook_system.py python: Wrap long def lines in test files. 2017-11-16 22:00:53 -08:00
test_presence.py tests: Pass a realm option to login for non-zulip realms. 2017-11-17 15:32:42 -08:00
test_push_notifications.py Eliminate get_user_profile_by_email from test_classes. 2017-11-26 15:47:56 -08:00
test_queue_worker.py Fix MissedMessageWorker. 2017-11-15 10:26:28 -08:00
test_reactions.py emoji: Rework reactions validation to have a single function. 2017-11-20 15:27:21 -08:00
test_realm.py settings: Create UI and backend for setting signups stream. 2017-11-21 17:39:51 -08:00
test_realm_domains.py tests: Pass a realm option to login for non-zulip realms. 2017-11-17 15:32:42 -08:00
test_realm_emoji.py zerver/tests: Use python 3 syntax for typing. 2017-11-08 12:50:27 -08:00
test_realm_filters.py zerver/tests: Use python 3 syntax for typing. 2017-11-08 12:50:27 -08:00
test_report.py zerver/tests: Use python 3 syntax for typing. 2017-11-08 12:50:27 -08:00
test_retention.py Eliminate get_user_profile_by_email from test_classes. 2017-11-26 15:47:56 -08:00
test_service_bot_system.py queue processor tests: Call consume by default. 2017-11-26 11:45:34 -08:00
test_sessions.py tests: Pass a realm option to login for non-zulip realms. 2017-11-17 15:32:42 -08:00
test_settings.py zerver/tests: Use python 3 syntax for typing. 2017-11-08 12:50:27 -08:00
test_signup.py registration: Check realm against PreregistrationUser realm. 2017-11-27 14:58:26 -08:00
test_soft_deactivation.py zerver/tests: Use python 3 syntax for typing. 2017-11-08 12:50:27 -08:00
test_subdomains.py zerver/tests: Use python 3 syntax for typing (part 4). 2017-11-21 22:01:19 -08:00
test_subs.py Eliminate get_user_profile_by_email from test_classes. 2017-11-26 15:47:56 -08:00
test_templates.py password reset: Simplify password reset form logic. 2017-11-20 10:40:33 -08:00
test_timestamp.py zerver/tests: Use python 3 syntax for typing. 2017-11-08 12:50:27 -08:00
test_tornado.py zerver/tests: Use python 3 syntax for typing. 2017-11-18 15:41:16 -08:00
test_tutorial.py zerver/tests: Use python 3 syntax for typing. 2017-11-08 12:50:27 -08:00
test_type_debug.py python: Wrap long def lines in test files. 2017-11-16 22:00:53 -08:00
test_typing.py Remove usage of six.moves.string_types. 2017-11-09 10:00:00 -08:00
test_unread.py zerver/tests: Use python 3 syntax for typing. 2017-11-08 12:50:27 -08:00
test_upload.py tests: Pass a realm option to login for non-zulip realms. 2017-11-17 15:32:42 -08:00
test_urls.py zerver/tests: Use python 3 syntax for typing. 2017-11-08 12:50:27 -08:00
test_user_groups.py zerver/tests: Use python 3 syntax for typing (part 4). 2017-11-21 22:01:19 -08:00
test_users.py cross_realm: Use bulk_get_users to fix handling of missing users. 2017-11-15 21:24:51 -08:00
test_zephyr.py zerver/tests: Use python 3 syntax for typing (part 3). 2017-11-21 22:01:19 -08:00
tests.py retention-period: Add retention period to front-end admin organization settings. 2017-03-25 17:57:18 -07:00