diff options
author | Marti Raudsepp <marti@juffo.org> | 2016-10-24 15:22:00 -0400 |
---|---|---|
committer | Tim Graham <timograham@gmail.com> | 2016-11-01 09:30:57 -0400 |
commit | da7910d4834726eca596af0a830762fa5fb2dfd9 (patch) | |
tree | de4ee58ef352c19ee5efe5495ef629e0c1aee5cd /django | |
parent | 9e9c81d3c21074d0761ebe5264bbc35cdf4e50f7 (diff) | |
download | django-da7910d4834726eca596af0a830762fa5fb2dfd9.tar.gz |
Fixed CVE-2016-9013 -- Generated a random database user password when running tests on Oracle.
This is a security fix.
Diffstat (limited to 'django')
-rw-r--r-- | django/db/backends/oracle/creation.py | 16 |
1 files changed, 12 insertions, 4 deletions
diff --git a/django/db/backends/oracle/creation.py b/django/db/backends/oracle/creation.py index 01b4056b4b..18653c39aa 100644 --- a/django/db/backends/oracle/creation.py +++ b/django/db/backends/oracle/creation.py @@ -4,11 +4,11 @@ import time from django.conf import settings from django.db.backends.base.creation import BaseDatabaseCreation from django.db.utils import DatabaseError +from django.utils.crypto import get_random_string from django.utils.functional import cached_property from django.utils.six.moves import input TEST_DATABASE_PREFIX = 'test_' -PASSWORD = 'Im_a_lumberjack' class DatabaseCreation(BaseDatabaseCreation): @@ -223,7 +223,11 @@ class DatabaseCreation(BaseDatabaseCreation): ] # Ignore "user already exists" error when keepdb is on acceptable_ora_err = 'ORA-01920' if keepdb else None - self._execute_allow_fail_statements(cursor, statements, parameters, verbosity, acceptable_ora_err) + success = self._execute_allow_fail_statements(cursor, statements, parameters, verbosity, acceptable_ora_err) + # If the password was randomly generated, change the user accordingly. + if not success and self._test_settings_get('PASSWORD') is None: + set_password = "ALTER USER %(user)s IDENTIFIED BY %(password)s" + self._execute_statements(cursor, [set_password], parameters, verbosity) # Most test-suites can be run without the create-view privilege. But some need it. extra = "GRANT CREATE VIEW TO %(user)s" success = self._execute_allow_fail_statements(cursor, [extra], parameters, verbosity, 'ORA-01031') @@ -298,7 +302,7 @@ class DatabaseCreation(BaseDatabaseCreation): """ settings_dict = self.connection.settings_dict val = settings_dict['TEST'].get(key, default) - if val is None: + if val is None and prefixed: val = TEST_DATABASE_PREFIX + settings_dict[prefixed] return val @@ -315,7 +319,11 @@ class DatabaseCreation(BaseDatabaseCreation): return self._test_settings_get('USER', prefixed='USER') def _test_database_passwd(self): - return self._test_settings_get('PASSWORD', default=PASSWORD) + password = self._test_settings_get('PASSWORD') + if password is None and self._test_user_create(): + # Oracle passwords are limited to 30 chars and can't contain symbols. + password = get_random_string(length=30) + return password def _test_database_tblspace(self): return self._test_settings_get('TBLSPACE', prefixed='USER') |