[Checkins] SVN: Products.PluggableAuthService/trunk/Products/PluggableAuthService/ Split up large permission tests into individual tests.

Michael Howitz mh at gocept.com
Thu Sep 4 02:51:39 EDT 2008


Log message for revision 90785:
  Split up large permission tests into individual tests.
  

Changed:
  U   Products.PluggableAuthService/trunk/Products/PluggableAuthService/doc/CHANGES.txt
  U   Products.PluggableAuthService/trunk/Products/PluggableAuthService/plugins/tests/test_DynamicGroupsPlugin.py
  U   Products.PluggableAuthService/trunk/Products/PluggableAuthService/plugins/tests/test_ZODBGroupManager.py
  U   Products.PluggableAuthService/trunk/Products/PluggableAuthService/plugins/tests/test_ZODBRoleManager.py
  U   Products.PluggableAuthService/trunk/Products/PluggableAuthService/plugins/tests/test_ZODBUserManager.py

-=-
Modified: Products.PluggableAuthService/trunk/Products/PluggableAuthService/doc/CHANGES.txt
===================================================================
--- Products.PluggableAuthService/trunk/Products/PluggableAuthService/doc/CHANGES.txt	2008-09-04 06:24:24 UTC (rev 90784)
+++ Products.PluggableAuthService/trunk/Products/PluggableAuthService/doc/CHANGES.txt	2008-09-04 06:51:39 UTC (rev 90785)
@@ -25,7 +25,9 @@
 
 - Fixed tests so they run with Zope 2.11.
 
+- Split up large permission tests into individual tests.
 
+
 PluggableAuthService 1.5.2 (2007-11-28)
 ---------------------------------------
 

Modified: Products.PluggableAuthService/trunk/Products/PluggableAuthService/plugins/tests/test_DynamicGroupsPlugin.py
===================================================================
--- Products.PluggableAuthService/trunk/Products/PluggableAuthService/plugins/tests/test_DynamicGroupsPlugin.py	2008-09-04 06:24:24 UTC (rev 90784)
+++ Products.PluggableAuthService/trunk/Products/PluggableAuthService/plugins/tests/test_DynamicGroupsPlugin.py	2008-09-04 06:51:39 UTC (rev 90785)
@@ -1,6 +1,6 @@
 ##############################################################################
 #
-# Copyright (c) 2001 Zope Corporation and Contributors. All Rights
+# Copyright (c) 2001-2008 Zope Corporation and Contributors. All Rights
 # Reserved.
 #
 # This software is subject to the provisions of the Zope Public License,
@@ -478,7 +478,7 @@
         self.assertEqual( len( groups ), 1 )
         self.failUnless( 'ggp_effable' in groups )
 
-    def testPOSTProtections(self):
+    def test_removeGroup_POST_permissions(self):
         from zExceptions import Forbidden
 
         GROUP_ID = 'testgroup'

Modified: Products.PluggableAuthService/trunk/Products/PluggableAuthService/plugins/tests/test_ZODBGroupManager.py
===================================================================
--- Products.PluggableAuthService/trunk/Products/PluggableAuthService/plugins/tests/test_ZODBGroupManager.py	2008-09-04 06:24:24 UTC (rev 90784)
+++ Products.PluggableAuthService/trunk/Products/PluggableAuthService/plugins/tests/test_ZODBGroupManager.py	2008-09-04 06:51:39 UTC (rev 90785)
@@ -1,6 +1,6 @@
 ##############################################################################
 #
-# Copyright (c) 2001 Zope Corporation and Contributors. All Rights
+# Copyright (c) 2001-2008 Zope Corporation and Contributors. All Rights
 # Reserved.
 #
 # This software is subject to the provisions of the Zope Public License,
@@ -14,6 +14,8 @@
 ##############################################################################
 import unittest
 
+from zExceptions import Forbidden
+
 from Products.PluggableAuthService.tests.conformance \
     import IGroupEnumerationPlugin_conformance
 from Products.PluggableAuthService.tests.conformance \
@@ -77,14 +79,12 @@
         self.assertEqual( info[ 'id' ], 'group' )
 
     def test_addGroup_exists( self ):
-
         zgm = self._makeOne()
 
         zgm.addGroup( 'group' )
         self.assertRaises( KeyError, zgm.addGroup, 'group' )
 
     def test_updateGroup_normal( self ):
-
         zgm = self._makeOne()
 
         zgm.addGroup( 'group', 'group_title', 'group_desc' )
@@ -96,7 +96,6 @@
         self.assertEqual( group_info['title'], 'group_title_changed' )
 
     def test_addPrincipalToGroup( self ):
-
         zgm = self._makeOne()
 
         zgm.addGroup( 'group' )
@@ -108,7 +107,6 @@
         self.assertEqual( groups, ( 'group', ) )
 
     def test_addPrincipalToGroupThenRemovePrincipal( self ):
-
         root = FauxSmartPAS()
         root.user_ids['foo'] = 'foo'
 
@@ -134,7 +132,6 @@
         self.assertEqual( assigned[0], '<foo: not found>' )
 
     def test_removePrincipalFromGroup( self ):
-
         zgm = self._makeOne()
 
         zgm.addGroup( 'group' )
@@ -147,7 +144,6 @@
         self.assertEqual( groups, () )
 
     def test_removeGroupOutFromUnderPrincipal( self ):
-
         zgm = self._makeOne()
 
         zgm.addGroup( 'group' )
@@ -162,7 +158,6 @@
         self.assertEqual( groups, () )
 
     def test_multiplePrincipalsPerGroup( self ):
-
         pas = FauxPAS()
         zgm = self._makeOne().__of__( pas )
         
@@ -183,7 +178,6 @@
                                         ( 'userid2', 'userid2' ) ] )
 
     def test_enumerateGroups_exact_nonesuch( self ):
-
         from Products.PluggableAuthService.tests.test_PluggableAuthService \
             import FauxRoot
 
@@ -200,7 +194,6 @@
                         , () )
 
     def test_enumerateGroups_multiple( self ):
-
         from Products.PluggableAuthService.tests.test_PluggableAuthService \
             import FauxRoot
 
@@ -230,7 +223,6 @@
             self.failUnless( info[ 'id' ] in SUBSET )
 
     def test_enumerateGroups_prefixed( self ):
-
         from Products.PluggableAuthService.tests.test_PluggableAuthService \
             import FauxRoot
 
@@ -253,7 +245,6 @@
             self.failUnless( info[ 'id' ] in PRE_LIST )
 
     def test_addPrincipalToGroup( self ):
-
         zgm = self._makeOne()
         zgm.prefix = 'prefixed_'
 
@@ -265,21 +256,16 @@
         groups = zgm.getGroupsForPrincipal( user )
         self.assertEqual( groups, ( 'prefixed_group', ) )
 
-    def testPOSTProtections(self):
-        from zExceptions import Forbidden
-
+    def test_addPrincipalToGroup_POST_permissions(self):
         USER_ID = 'testuser'
         GROUP_ID = 'testgroup'
 
         zgm = self._makeOne()
         zgm.prefix = 'prefixed_'
 
-        zgm.addGroup( GROUP_ID )
-        user = DummyUser( USER_ID )
-
+        zgm.addGroup(GROUP_ID)
         req, res = makeRequestAndResponse()
 
-        # test addPrincipalToGroup
         # Fails with a GET
         req.set('REQUEST_METHOD', 'GET')
         req.set('method', 'GET')
@@ -290,7 +276,16 @@
         req.set('method', 'POST')
         zgm.addPrincipalToGroup(USER_ID, GROUP_ID, REQUEST=req)
 
-        # test removePrincipalFromGroup
+    def test_removePrincipalFromGroup_POST_permissions(self):
+        USER_ID = 'testuser'
+        GROUP_ID = 'testgroup'
+
+        zgm = self._makeOne()
+        zgm.prefix = 'prefixed_'
+
+        zgm.addGroup(GROUP_ID)
+        req, res = makeRequestAndResponse()
+
         req.set('REQUEST_METHOD', 'GET')
         req.set('method', 'GET')
         self.assertRaises(Forbidden, zgm.removePrincipalFromGroup,
@@ -300,29 +295,59 @@
         req.set('method', 'POST')
         zgm.removePrincipalFromGroup(USER_ID, GROUP_ID, REQUEST=req)
 
-        # test manage_addPrincipalsToGroup
+    def test_manage_addPrincipalsToGroup_POST_permissions(self):
+        USER_ID = 'testuser'
+        GROUP_ID = 'testgroup'
+
+        zgm = self._makeOne()
+        zgm.prefix = 'prefixed_'
+
+        zgm.addGroup(GROUP_ID)
+        req, res = makeRequestAndResponse()
+
         req.set('REQUEST_METHOD', 'GET')
         req.set('method', 'GET')
         self.assertRaises(Forbidden, zgm.manage_addPrincipalsToGroup,
                           GROUP_ID, [USER_ID], REQUEST=req)
+
+        # Works with a POST
         req.set('REQUEST_METHOD', 'POST')
         req.set('method', 'POST')
         zgm.manage_addPrincipalsToGroup(GROUP_ID, [USER_ID], REQUEST=req)
 
-        # test manage_removePrincipalsFromGroup
+    def test_manage_removePrincipalsFromGroup_POST_permissions(self):
+        USER_ID = 'testuser'
+        GROUP_ID = 'testgroup'
+
+        zgm = self._makeOne()
+        zgm.prefix = 'prefixed_'
+
+        zgm.addGroup(GROUP_ID)
+        req, res = makeRequestAndResponse()
+
         req.set('REQUEST_METHOD', 'GET')
         req.set('method', 'GET')
         self.assertRaises(Forbidden, zgm.manage_removePrincipalsFromGroup,
                           GROUP_ID, [USER_ID], REQUEST=req)
+
+        # Works with a POST
         req.set('REQUEST_METHOD', 'POST')
         req.set('method', 'POST')
         zgm.manage_removePrincipalsFromGroup(GROUP_ID, [USER_ID], REQUEST=req)
 
-        # test manage_removeGroup
+    def test_manage_removeGroup_POST_permissions(self):
+        GROUP_ID = 'testgroup'
+
+        zgm = self._makeOne()
+        zgm.prefix = 'prefixed_'
+        zgm.addGroup(GROUP_ID)
+        req, res = makeRequestAndResponse()
+
         req.set('REQUEST_METHOD', 'GET')
         req.set('method', 'GET')
         self.assertRaises(Forbidden, zgm.manage_removeGroups,
                           [GROUP_ID], REQUEST=req)
+
         # Works with a POST
         req.set('REQUEST_METHOD', 'POST')
         req.set('method', 'POST')

Modified: Products.PluggableAuthService/trunk/Products/PluggableAuthService/plugins/tests/test_ZODBRoleManager.py
===================================================================
--- Products.PluggableAuthService/trunk/Products/PluggableAuthService/plugins/tests/test_ZODBRoleManager.py	2008-09-04 06:24:24 UTC (rev 90784)
+++ Products.PluggableAuthService/trunk/Products/PluggableAuthService/plugins/tests/test_ZODBRoleManager.py	2008-09-04 06:51:39 UTC (rev 90785)
@@ -1,6 +1,6 @@
 ##############################################################################
 #
-# Copyright (c) 2001 Zope Corporation and Contributors. All Rights
+# Copyright (c) 2001-2008 Zope Corporation and Contributors. All Rights
 # Reserved.
 #
 # This software is subject to the provisions of the Zope Public License,
@@ -14,6 +14,8 @@
 ##############################################################################
 import unittest
 
+from zExceptions import Forbidden
+
 from Products.PluggableAuthService.tests.conformance \
     import IRolesPlugin_conformance
 from Products.PluggableAuthService.tests.conformance \
@@ -58,7 +60,7 @@
             import FauxRoot
 
         root = FauxRoot()
-        zrm = self._makeOne().__of__( root )
+        zrm = self._makeOne().__of__(root)
 
         zrm.addRole( 'roleid', 'Role', 'This is a role' )
 
@@ -92,7 +94,7 @@
             import FauxRoot
 
         root = FauxRoot()
-        zrm = self._makeOne().__of__( root )
+        zrm = self._makeOne().__of__(root)
 
         zrm.addRole( 'roleid', 'Role', 'This is a role' )
         zrm.addRole( 'doomed', 'Fatal', 'rust never sleeps' )
@@ -110,7 +112,7 @@
             import FauxRoot
 
         root = FauxRoot()
-        zrm = self._makeOne( id='no_crit' ).__of__( root )
+        zrm = self._makeOne( id='no_crit' ).__of__(root)
 
         ID_LIST = ( 'foo', 'bar', 'baz', 'bam' )
 
@@ -141,7 +143,7 @@
             import FauxRoot
 
         root = FauxRoot()
-        zrm = self._makeOne( id='exact' ).__of__( root )
+        zrm = self._makeOne( id='exact' ).__of__(root)
 
         ID_LIST = ( 'foo', 'bar', 'baz', 'bam' )
 
@@ -170,7 +172,7 @@
             import FauxRoot
 
         root = FauxRoot()
-        zrm = self._makeOne( id='partial' ).__of__( root )
+        zrm = self._makeOne( id='partial' ).__of__(root)
 
         ID_LIST = ( 'foo', 'bar', 'baz', 'bam' )
 
@@ -205,7 +207,7 @@
             import FauxRoot
 
         root = FauxRoot()
-        zrm = self._makeOne( id='partial' ).__of__( root )
+        zrm = self._makeOne( id='partial' ).__of__(root)
 
         ID_LIST = ( 'foo', 'bar', 'baz', 'bam' )
 
@@ -235,7 +237,7 @@
             import FauxRoot
 
         root = FauxRoot()
-        zgm = self._makeOne( id='exact_nonesuch' ).__of__( root )
+        zgm = self._makeOne( id='exact_nonesuch' ).__of__(root)
 
         ID_LIST = ( 'foo', 'bar', 'baz', 'bam' )
 
@@ -252,7 +254,7 @@
             import FauxRoot
 
         root = FauxRoot()
-        zrm = self._makeOne( id='assign_nonesuch' ).__of__( root )
+        zrm = self._makeOne( id='assign_nonesuch' ).__of__(root)
 
         self.assertRaises( KeyError, zrm.assignRoleToPrincipal, 'test', 'foo' )
 
@@ -262,7 +264,7 @@
             import FauxRoot
 
         root = FauxRoot()
-        zrm = self._makeOne( id='assign_user' ).__of__( root )
+        zrm = self._makeOne( id='assign_user' ).__of__(root)
         zrm.addRole( 'test1' )
         zrm.addRole( 'test2' )
         user = DummyUser( 'foo' )
@@ -289,7 +291,7 @@
             import FauxRoot
 
         root = FauxRoot()
-        zrm = self._makeOne( id='assign_user' ).__of__( root )
+        zrm = self._makeOne( id='assign_user' ).__of__(root)
         zrm.addRole( 'test1' )
         zrm.addRole( 'test2' )
         user = DummyUser( 'foo', ( 'qux', ) )
@@ -306,7 +308,7 @@
     def test_assignRoleToPrincipal_new( self ):
 
         root = FauxPAS()
-        zrm = self._makeOne( id='assign_new' ).__of__( root )
+        zrm = self._makeOne( id='assign_new' ).__of__(root)
 
         zrm.addRole( 'test' )
         self.assertEqual( len( zrm.listAssignedPrincipals( 'test' ) ), 0 )
@@ -323,7 +325,7 @@
     def test_assignRoleToPrincipal_already( self ):
 
         root = FauxPAS()
-        zrm = self._makeOne( id='assign_already' ).__of__( root )
+        zrm = self._makeOne( id='assign_already' ).__of__(root)
 
         zrm.addRole( 'test' )
 
@@ -342,7 +344,7 @@
         root = FauxSmartPAS()
         root.user_ids['foo'] = 'foo'
 
-        zrm = self._makeOne( id='assign_before_remove' ).__of__( root )
+        zrm = self._makeOne( id='assign_before_remove' ).__of__(root)
 
         zrm.addRole( 'test' )
         self.assertEqual( len( zrm.listAssignedPrincipals( 'test' ) ), 0 )
@@ -369,7 +371,7 @@
             import FauxRoot
 
         root = FauxRoot()
-        zrm = self._makeOne( id='remove_nonesuch' ).__of__( root )
+        zrm = self._makeOne( id='remove_nonesuch' ).__of__(root)
 
         self.assertRaises( KeyError, zrm.removeRoleFromPrincipal
                          , 'test', 'foo' )
@@ -377,7 +379,7 @@
     def test_removeRoleFromPrincipal_existing( self ):
 
         root = FauxPAS()
-        zrm = self._makeOne( id='remove_existing' ).__of__( root )
+        zrm = self._makeOne(id='remove_existing').__of__(root)
 
         zrm.addRole( 'test' )
 
@@ -404,7 +406,7 @@
     def test_removeRoleFromPrincipal_noop( self ):
 
         root = FauxPAS()
-        zrm = self._makeOne( id='remove_noop' ).__of__( root )
+        zrm = self._makeOne( id='remove_noop' ).__of__(root)
 
         zrm.addRole( 'test' )
 
@@ -426,7 +428,7 @@
             import FauxRoot
 
         root = FauxRoot()
-        zrm = self._makeOne( id='update_nonesuch' ).__of__( root )
+        zrm = self._makeOne( id='update_nonesuch' ).__of__(root)
 
         self.assertRaises( KeyError, zrm.updateRole
                          , 'nonesuch', 'title', 'description' )
@@ -437,7 +439,7 @@
             import FauxRoot
 
         root = FauxRoot()
-        zrm = self._makeOne( id='update_normal' ).__of__( root )
+        zrm = self._makeOne( id='update_normal' ).__of__(root)
 
         zrm.addRole( 'role', 'Original Title', 'Original description' )
 
@@ -459,7 +461,7 @@
             import FauxRoot
 
         root = FauxRoot()
-        zrm = self._makeOne( id='remove_then_add' ).__of__( root )
+        zrm = self._makeOne( id='remove_then_add' ).__of__(root)
         user = DummyUser( 'foo' )
 
         zrm.addRole( 'test' )
@@ -471,23 +473,18 @@
 
         self.failIf( 'test' in zrm.getRolesForPrincipal( user ) )
 
-    def testPOSTProtections(self):
-        from zExceptions import Forbidden
-
+    def test_assignRoleToPrincipal_POST_permissions(self):
         USER_ID = 'testuser'
         ROLE_ID = 'myrole'
 
         root = FauxPAS()
-        zrm = self._makeOne( id='remove_existing' ).__of__( root )
+        zrm = self._makeOne(id='remove_existing').__of__(root)
         zrm = self._makeOne()
         zrm.addRole(ROLE_ID)
 
-        user = DummyUser( USER_ID )
-
         req, res = makeRequestAndResponse()
 
         # Fails with a GET
-        # test assignRoleToPrincipal
         req.set('REQUEST_METHOD', 'GET')
         req.set('method', 'GET')
         self.assertRaises(Forbidden, zrm.assignRoleToPrincipal,
@@ -497,28 +494,56 @@
         req.set('method', 'POST')
         zrm.assignRoleToPrincipal(ROLE_ID, USER_ID, REQUEST=req)
 
-        # test removeRoleFromPricipal
+    def test_removeRoleFromPricipal_POST_permission(self):
+        USER_ID = 'testuser'
+        ROLE_ID = 'myrole'
+
+        root = FauxPAS()
+        zrm = self._makeOne(id='remove_existing').__of__(root)
+        zrm = self._makeOne()
+        zrm.addRole(ROLE_ID)
+
+        req, res = makeRequestAndResponse()
+
         req.set('REQUEST_METHOD', 'GET')
         req.set('method', 'GET')
         self.assertRaises(Forbidden, zrm.removeRoleFromPrincipal,
                           ROLE_ID, USER_ID, REQUEST=req)
+        # Works with a POST
         req.set('REQUEST_METHOD', 'POST')
         req.set('method', 'POST')
         zrm.removeRoleFromPrincipal(ROLE_ID, USER_ID, REQUEST=req)
 
-        # test removeRole
+    def test_removeRole_POST_permissions(self):
+        ROLE_ID = 'myrole'
+
+        root = FauxPAS()
+        zrm = self._makeOne(id='remove_existing').__of__(root)
+        zrm = self._makeOne()
+        zrm.addRole(ROLE_ID)
+
+        req, res = makeRequestAndResponse()
+
         req.set('REQUEST_METHOD', 'GET')
         req.set('method', 'GET')
         self.assertRaises(Forbidden, zrm.removeRole,
                           ROLE_ID, REQUEST=req)
+        # Works with a POST
         req.set('REQUEST_METHOD', 'POST')
         req.set('method', 'POST')
         zrm.removeRole(ROLE_ID, REQUEST=req)
 
-        # Readd the role for the manage_* methods
+    def test_manage_assignRoleToPrincipal_POST_permissions(self):
+        USER_ID = 'testuser'
+        ROLE_ID = 'myrole'
+
+        root = FauxPAS()
+        zrm = self._makeOne(id='remove_existing').__of__(root)
+        zrm = self._makeOne()
         zrm.addRole(ROLE_ID)
 
-        # test manage_assignRoleToPrincipal
+        req, res = makeRequestAndResponse()
+
         req.set('REQUEST_METHOD', 'GET')
         req.set('method', 'GET')
         self.assertRaises(Forbidden, zrm.manage_assignRoleToPrincipals,
@@ -528,7 +553,17 @@
         zrm.manage_assignRoleToPrincipals(ROLE_ID, [USER_ID], RESPONSE=res,
                                           REQUEST=req)
 
-        # test manage_removeRoleFromPricipal
+    def test_manage_removeRoleFromPricipal_POS_permissionsT(self):
+        USER_ID = 'testuser'
+        ROLE_ID = 'myrole'
+
+        root = FauxPAS()
+        zrm = self._makeOne(id='remove_existing').__of__(root)
+        zrm = self._makeOne()
+        zrm.addRole(ROLE_ID)
+
+        req, res = makeRequestAndResponse()
+
         req.set('REQUEST_METHOD', 'GET')
         req.set('method', 'GET')
         self.assertRaises(Forbidden, zrm.manage_removeRoleFromPrincipals,
@@ -538,7 +573,15 @@
         zrm.manage_removeRoleFromPrincipals(ROLE_ID, [USER_ID], RESPONSE=res,
                                             REQUEST=req)
 
-        # test manage_removeRoles
+    def test_manage_removeRoles_POST_permissions(self):
+        ROLE_ID = 'myrole'
+
+        root = FauxPAS()
+        zrm = self._makeOne(id='remove_existing').__of__(root)
+        zrm = self._makeOne()
+        zrm.addRole(ROLE_ID)
+
+        req, res = makeRequestAndResponse()
         req.set('REQUEST_METHOD', 'GET')
         req.set('method', 'GET')
         self.assertRaises(Forbidden, zrm.manage_removeRoles,
@@ -548,12 +591,10 @@
         zrm.manage_removeRoles([ROLE_ID], RESPONSE=res, REQUEST=req)
 
 
-
 if __name__ == "__main__":
     unittest.main()
 
 def test_suite():
     return unittest.TestSuite((
         unittest.makeSuite( ZODBRoleManagerTests ),
-        ))               
-    
+        ))

Modified: Products.PluggableAuthService/trunk/Products/PluggableAuthService/plugins/tests/test_ZODBUserManager.py
===================================================================
--- Products.PluggableAuthService/trunk/Products/PluggableAuthService/plugins/tests/test_ZODBUserManager.py	2008-09-04 06:24:24 UTC (rev 90784)
+++ Products.PluggableAuthService/trunk/Products/PluggableAuthService/plugins/tests/test_ZODBUserManager.py	2008-09-04 06:51:39 UTC (rev 90785)
@@ -1,6 +1,6 @@
 ##############################################################################
 #
-# Copyright (c) 2001 Zope Corporation and Contributors. All Rights
+# Copyright (c) 2001-2008 Zope Corporation and Contributors. All Rights
 # Reserved.
 #
 # This software is subject to the provisions of the Zope Public License,
@@ -14,6 +14,9 @@
 ##############################################################################
 import unittest
 
+from AccessControl.AuthEncoding import pw_encrypt
+from zExceptions import Forbidden
+
 from Products.PluggableAuthService.tests.conformance \
     import IAuthenticationPlugin_conformance
 from Products.PluggableAuthService.tests.conformance \
@@ -581,19 +584,15 @@
         self.assertEqual(user_id, 'user1')
         self.assertEqual(login, 'user2 at example.com')
 
-    def testPOSTProtections(self):
-        from AccessControl.AuthEncoding import pw_encrypt
-        from zExceptions import Forbidden
+    def test_manage_updateUserPassword_POST_permissions(self):
         USER_ID = 'testuser'
         PASSWORD = 'password'
-
         ENCRYPTED = pw_encrypt(PASSWORD)
 
         zum = self._makeOne()
         zum.addUser(USER_ID, USER_ID, '')
 
         req, res = makeRequestAndResponse()
-        # test manage_updateUserPassword
         # Fails with a GET
         req.set('REQUEST_METHOD', 'GET')
         req.set('method', 'GET')
@@ -604,14 +603,30 @@
         req.set('method', 'POST')
         zum.manage_updateUserPassword(USER_ID, PASSWORD, PASSWORD, REQUEST=req)
 
-        # test manage_updatePassword
+    def test_manage_updatePassword_POST_permissions(self):
+        USER_ID = 'testuser'
+        PASSWORD = 'password'
+        ENCRYPTED = pw_encrypt(PASSWORD)
+
+        zum = self._makeOne()
+        zum.addUser(USER_ID, USER_ID, '')
+
+        req, res = makeRequestAndResponse()
         req.set('REQUEST_METHOD', 'GET')
         req.set('method', 'GET')
         self.assertRaises(Forbidden, zum.manage_updatePassword,
                           USER_ID, PASSWORD, PASSWORD, REQUEST=req)
         # XXX: This method is broken
 
-        # test manage_removeUsers
+    def test_manage_removeUsers_POST_permissions(self):
+        USER_ID = 'testuser'
+        PASSWORD = 'password'
+        ENCRYPTED = pw_encrypt(PASSWORD)
+
+        zum = self._makeOne()
+        zum.addUser(USER_ID, USER_ID, '')
+
+        req, res = makeRequestAndResponse()
         req.set('REQUEST_METHOD', 'GET')
         req.set('method', 'GET')
         self.assertRaises(Forbidden, zum.manage_removeUsers,



More information about the Checkins mailing list