Andal.LND/edx-platform
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

added another test case.

Browse Source
This commit is contained in:
Waheed Ahmed
2020-05-05 15:59:39 +05:00
parent 05d18effde
commit c603111895
2 changed files with 31 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
common/djangoapps/util/request_rate_limiter.py
View File

@@ -80,7 +80,7 @@ class PasswordResetEmailRateLimiter(RequestRateLimiter):
def keys_to_check(self, request):
"""
Retun list of IP and email based keys.
Return list of IP and email based keys.
"""
keys = super(PasswordResetEmailRateLimiter, self).keys_to_check(request)
@@ -97,7 +97,7 @@ class PasswordResetEmailRateLimiter(RequestRateLimiter):
def tick_request_counter(self, request):
"""
Ticks any counters used to compute when rate limt has been reached
Ticks any counters used to compute when rate limit has been reached.
"""
for key in self.keys_to_check(request):
self.cache_incr(key)

34
openedx/core/djangoapps/user_authn/views/tests/test_reset_password.py
View File

@@ -160,13 +160,9 @@ class ResetPasswordTests(EventTestMixin, CacheIsolationTestCase):
cache.clear()
@patch(
'openedx.core.djangoapps.user_authn.views.password_reset.render_to_string',
Mock(side_effect=mock_render_to_string, autospec=True)
)
def test_ratelimitted_from_same_ip_with_different_email(self):
"""
Test that password reset endpoint allow one request per minute per IP.
Test that password reset endpoint allow only one request per minute per IP.
"""
cache.clear()
good_req = self.request_factory.post('/password_reset/', {'email': 'thisdoesnotexist@foo.com'})
@@ -183,6 +179,34 @@ class ResetPasswordTests(EventTestMixin, CacheIsolationTestCase):
cache.clear()
def test_ratelimited_from_different_ips_with_same_email(self):
"""
Test that password reset endpoint allow only one request per minute
per email address.
"""
cache.clear()
good_req = self.request_factory.post('/password_reset/', {'email': 'thisdoesnotexist@foo.com'})
good_req.user = AnonymousUser()
good_resp = password_reset(good_req)
self.assertEqual(good_resp.status_code, 200)
# change the IP and verify that the rate limiter should kick in and
# give a Forbidden response if the request is for same email address.
new_ip = "8.8.8.8"
self.assertNotEqual(good_req.META.get('REMOTE_ADDR'), new_ip)
bad_req = self.request_factory.post(
'/password_reset/',
{'email': 'thisdoesnotexist@foo.com'},
REMOTE_ADDR=new_ip
)
bad_req.user = AnonymousUser()
bad_resp = password_reset(bad_req)
self.assertEqual(bad_resp.status_code, 403)
self.assertEqual(bad_req.META.get('REMOTE_ADDR'), new_ip)
cache.clear()
@unittest.skipUnless(settings.ROOT_URLCONF == 'lms.urls', "Test only valid in LMS")
@ddt.data(('plain_text', "You're receiving this e-mail because you requested a password reset"),
('html', "You're receiving this e-mail because you requested a password reset"))