+46
-5
lines changedFilter options
+46
-5
lines changed Original file line number Diff line number Diff line change
@@ -4,11 +4,11 @@
4 4
from django.conf import settings
5 5
from django.db.backends.base.creation import BaseDatabaseCreation
6 6
from django.db.utils import DatabaseError
7 +
from django.utils.crypto import get_random_string
7 8
from django.utils.functional import cached_property
8 9
from django.utils.six.moves import input
9 10 10 11
TEST_DATABASE_PREFIX = 'test_'
11 -
PASSWORD = 'Im_a_lumberjack'
12 12 13 13 14 14
class DatabaseCreation(BaseDatabaseCreation):
@@ -223,7 +223,11 @@ def _create_test_user(self, cursor, parameters, verbosity, keepdb=False):
223 223
]
224 224
# Ignore "user already exists" error when keepdb is on
225 225
acceptable_ora_err = 'ORA-01920' if keepdb else None
226 -
self._execute_allow_fail_statements(cursor, statements, parameters, verbosity, acceptable_ora_err)
226 +
success = self._execute_allow_fail_statements(cursor, statements, parameters, verbosity, acceptable_ora_err)
227 +
# If the password was randomly generated, change the user accordingly.
228 +
if not success and self._test_settings_get('PASSWORD') is None:
229 +
set_password = "ALTER USER %(user)s IDENTIFIED BY %(password)s"
230 +
self._execute_statements(cursor, [set_password], parameters, verbosity)
227 231
# Most test-suites can be run without the create-view privilege. But some need it.
228 232
extra = "GRANT CREATE VIEW TO %(user)s"
229 233
success = self._execute_allow_fail_statements(cursor, [extra], parameters, verbosity, 'ORA-01031')
@@ -298,7 +302,7 @@ def _test_settings_get(self, key, default=None, prefixed=None):
298 302
"""
299 303
settings_dict = self.connection.settings_dict
300 304
val = settings_dict['TEST'].get(key, default)
301 -
if val is None:
305 +
if val is None and prefixed:
302 306
val = TEST_DATABASE_PREFIX + settings_dict[prefixed]
303 307
return val
304 308
@@ -315,7 +319,11 @@ def _test_database_user(self):
315 319
return self._test_settings_get('USER', prefixed='USER')
316 320 317 321
def _test_database_passwd(self):
318 -
return self._test_settings_get('PASSWORD', default=PASSWORD)
322 +
password = self._test_settings_get('PASSWORD')
323 +
if password is None and self._test_user_create():
324 +
# Oracle passwords are limited to 30 chars and can't contain symbols.
325 +
password = get_random_string(length=30)
326 +
return password
319 327 320 328
def _test_database_tblspace(self):
321 329
return self._test_settings_get('TBLSPACE', prefixed='USER')
@@ -814,7 +814,12 @@ Default: ``None``
814 814
This is an Oracle-specific setting.
815 815 816 816
The password to use when connecting to the Oracle database that will be used
817 -
when running tests. If not provided, Django will use a hardcoded default value.
817 +
when running tests. If not provided, Django will generate a random password.
818 + 819 +
.. versionchanged:: 1.9.11
820 + 821 +
Older versions used a hardcoded default password. This was also changed
822 +
in 1.8.16 to fix possible security implications.
818 823 819 824
.. setting:: TEST_TBLSPACE
820 825
@@ -5,3 +5,17 @@ Django 1.8.16 release notes
5 5
*November 1, 2016*
6 6 7 7
Django 1.8.16 fixes two security issues in 1.8.15.
8 + 9 +
User with hardcoded password created when running tests on Oracle
10 +
=================================================================
11 + 12 +
When running tests with an Oracle database, Django creates a temporary database
13 +
user. In older versions, if a password isn't manually specified in the database
14 +
settings ``TEST`` dictionary, a hardcoded password is used. This could allow
15 +
an attacker with network access to the database server to connect.
16 + 17 +
This user is usually dropped after the test suite completes, but not when using
18 +
the ``manage.py test --keepdb`` option or if the user has an active session
19 +
(such as an attacker's connection).
20 + 21 +
A randomly generated password is now used for each test run.
Original file line number Diff line number Diff line change
@@ -5,3 +5,17 @@ Django 1.9.11 release notes
5 5
*November 1, 2016*
6 6 7 7
Django 1.9.11 fixes two security issues in 1.9.10.
8 + 9 +
User with hardcoded password created when running tests on Oracle
10 +
=================================================================
11 + 12 +
When running tests with an Oracle database, Django creates a temporary database
13 +
user. In older versions, if a password isn't manually specified in the database
14 +
settings ``TEST`` dictionary, a hardcoded password is used. This could allow
15 +
an attacker with network access to the database server to connect.
16 + 17 +
This user is usually dropped after the test suite completes, but not when using
18 +
the ``manage.py test --keepdb`` option or if the user has an active session
19 +
(such as an attacker's connection).
20 + 21 +
A randomly generated password is now used for each test run.
You can’t perform that action at this time.
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4