34 lines
922 B
Go
34 lines
922 B
Go
package models
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
// TestRandomAdminPassword covers SECURITY_TODO #12: the first-run admin
|
|
// password comes from the ambiguous-safe alphabet, has fixed length, and
|
|
// differs between generations.
|
|
func TestRandomAdminPassword(t *testing.T) {
|
|
pw := randomAdminPassword()
|
|
if len(pw) != 16 {
|
|
t.Fatalf("password length = %d, want 16", len(pw))
|
|
}
|
|
for _, c := range pw {
|
|
if !strings.ContainsRune(adminPasswordAlphabet, c) {
|
|
t.Fatalf("password contains rune %q outside alphabet", c)
|
|
}
|
|
}
|
|
if pw == randomAdminPassword() {
|
|
t.Fatal("two generated passwords are identical")
|
|
}
|
|
}
|
|
|
|
// TestGravatarOffByDefault covers SECURITY_TODO #15: new deployments must not
|
|
// leak MD5(email) to Gravatar unless an admin deliberately enables it.
|
|
func TestGravatarOffByDefault(t *testing.T) {
|
|
cc := defaultCommentConfig()
|
|
if cc.UseGravatar {
|
|
t.Fatal("default CommentConfig enables Gravatar")
|
|
}
|
|
}
|