diff --git a/tests/test_session.py b/tests/test_session.py index f99ab1a1941cc59f04eb61702b7104aabcb2d3d7..312a66b42e3585aa6ae7287438c5b83863ac32dd 100644 --- a/tests/test_session.py +++ b/tests/test_session.py @@ -87,6 +87,14 @@ class TestSession(UffdTestCase): self.assertEqual(r.status_code, 200) self.assertLoggedOut() + # Regression test for #100 (uncatched LDAPSASLPrepError) + def test_saslprep_invalid_password(self): + r = self.client.post(path=url_for('session.login'), + data={'loginname': self.test_data.get('user').get('loginname'), 'password': 'wrongpassword\n'}, follow_redirects=True) + dump('login_saslprep_invalid_password', r) + self.assertEqual(r.status_code, 200) + self.assertLoggedOut() + def test_wrong_user(self): r = self.client.post(path=url_for('session.login'), data={'loginname': 'nouser', 'password': self.test_data.get('user').get('password')}, diff --git a/uffd/ldap.py b/uffd/ldap.py index ed31bb01e3372d5e89dbb6a1c89c8eaf84e7a835..832ab50842e248b3280a43c0a4e65898469fc302 100644 --- a/uffd/ldap.py +++ b/uffd/ldap.py @@ -4,7 +4,7 @@ import hashlib from flask import current_app, request, abort, session import ldap3 -from ldap3.core.exceptions import LDAPBindError, LDAPPasswordIsMandatoryError, LDAPInvalidDnError +from ldap3.core.exceptions import LDAPBindError, LDAPPasswordIsMandatoryError, LDAPInvalidDnError, LDAPSASLPrepError # We import LDAPCommitError only because it is imported from us by other files. It is not needed here from uffd.ldapalchemy import LDAPMapper, LDAPCommitError # pylint: disable=unused-import @@ -74,7 +74,7 @@ def test_user_bind(bind_dn, bind_pw): conn = connect_and_bind_to_ldap(server, bind_dn, bind_pw) if not conn: return False - except (LDAPBindError, LDAPPasswordIsMandatoryError, LDAPInvalidDnError): + except (LDAPBindError, LDAPPasswordIsMandatoryError, LDAPInvalidDnError, LDAPSASLPrepError): return False conn.search(conn.user, encode_filter(current_app.config["LDAP_USER_SEARCH_FILTER"])) diff --git a/uffd/session/views.py b/uffd/session/views.py index cde2a3fd00247cd913eae261706f2769e579e3cb..a29557a74bc9c95a3dfd801aff81114b69317e97 100644 --- a/uffd/session/views.py +++ b/uffd/session/views.py @@ -9,7 +9,7 @@ from uffd.database import db from uffd.csrf import csrf_protect from uffd.secure_redirect import secure_local_redirect from uffd.user.models import User -from uffd.ldap import ldap, test_user_bind, LDAPInvalidDnError, LDAPBindError, LDAPPasswordIsMandatoryError +from uffd.ldap import ldap, test_user_bind, LDAPInvalidDnError, LDAPBindError, LDAPPasswordIsMandatoryError, LDAPSASLPrepError from uffd.ratelimit import Ratelimit, host_ratelimit, format_delay from uffd.session.models import DeviceLoginInitiation, DeviceLoginConfirmation @@ -46,7 +46,7 @@ def login_get_user(loginname, password): session['user_pw'] = password try: ldap.get_connection() - except (LDAPBindError, LDAPPasswordIsMandatoryError): + except (LDAPBindError, LDAPPasswordIsMandatoryError, LDAPSASLPrepError): session.clear() return None