diff options
author | Aymeric Augustin <aymeric.augustin@m4x.org> | 2015-11-26 21:27:12 +0100 |
---|---|---|
committer | Aymeric Augustin <aymeric.augustin@m4x.org> | 2015-11-26 21:27:12 +0100 |
commit | 11f10b70f3cb21c7a7f859e417adee104758221b (patch) | |
tree | e7f90018003749eb446eb276ebc98ba7dd95b116 /tests | |
parent | cc2ca9c550fbf8fca8684b373a3c8e3618eea08e (diff) | |
download | django-11f10b70f3cb21c7a7f859e417adee104758221b.tar.gz |
Fixed #25302 (again) -- Ignored scheme when checking for bad referers.
The check introduced in 4ce433e was too strict in real life. The poorly
implemented bots this patch attempted to ignore are sloppy when it comes
to http vs. https.
Diffstat (limited to 'tests')
-rw-r--r-- | tests/middleware/tests.py | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/tests/middleware/tests.py b/tests/middleware/tests.py index 328073b8ac..e9ec2b46c5 100644 --- a/tests/middleware/tests.py +++ b/tests/middleware/tests.py @@ -383,11 +383,20 @@ class BrokenLinkEmailsMiddlewareTest(SimpleTestCase): self.req.META['HTTP_REFERER'] = self.req.path BrokenLinkEmailsMiddleware().process_response(self.req, self.resp) self.assertEqual(len(mail.outbox), 0) + # URL with scheme and domain should also be ignored self.req.META['HTTP_REFERER'] = 'http://testserver%s' % self.req.path BrokenLinkEmailsMiddleware().process_response(self.req, self.resp) self.assertEqual(len(mail.outbox), 0) + # URL with a different scheme should be ignored as well because bots + # tend to use http:// in referers even when browsing HTTPS websites. + self.req.META['HTTP_X_PROTO'] = 'https' + self.req.META['SERVER_PORT'] = 443 + with self.settings(SECURE_PROXY_SSL_HEADER=('HTTP_X_PROTO', 'https')): + BrokenLinkEmailsMiddleware().process_response(self.req, self.resp) + self.assertEqual(len(mail.outbox), 0) + def test_referer_equal_to_requested_url_on_another_domain(self): self.req.META['HTTP_REFERER'] = 'http://anotherserver%s' % self.req.path BrokenLinkEmailsMiddleware().process_response(self.req, self.resp) |