Skip to content
Snippets Groups Projects
Commit ffb7ae8c62e3 authored by Georges Racinet's avatar Georges Racinet
Browse files

wsgi: testing heptapod headers

For now this is testing of current behaviour, keeping note of
a potential security tightening (not a hole because HgServe is
always invoked from localhost with the Heptapod headers, but it would
be better to stay secure if it accidentally were to respond on
public interfaces)
parent 2c3799f7f350
No related branches found
No related tags found
No related merge requests found
......@@ -39,3 +39,22 @@
assert hgs.repos_root == str(tmpdir)
def test_apply_heptapod_headers(tmpdir):
hgs = make_hgserve(tmpdir)
env = {'HTTP_X_HEPTAPOD_PERMISSION_USER': 'permuser',
'REMOTE_ADDR': '::1'}
hgs.apply_heptapod_headers(env)
assert env.get('REMOTE_USER') == 'permuser'
env = {'HTTP_X_HEPTAPOD_PERMISSION_USER': 'permuser',
'REMOTE_ADDR': '10.1.2.3'}
hgs.apply_heptapod_headers(env)
# TODO we might want to revise this and put an explicit denying user
# in there, since at least in check_publish, absence of REMOTE_USER
# is interpreted as running from the command line
assert 'REMOTE_USER' not in env
env = {'HTTP_X_HEPTAPOD_PROJECT_ID': '18'}
hgs.apply_heptapod_headers(env)
assert env.get('HEPTAPOD_PROJECT_ID') == '18'
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment