Add a test for space-padded login attemps.

Add a test for keyword-containing login attemp.


git-svn-id: https://svn.erp5.org/repos/public/erp5/trunk@20900 20353a03-c40f-0410-a6d1-a30d3c3de9de

product/ERP5Security/tests/testERP5Security.py

@@ -155,6 +155,21 @@ class TestUserManagement(ERP5TypeTestCase):
     self._assertUserExists('the_user', 'secret')
     self._assertUserDoesNotExists('the_User', 'secret')
   
+  def test_PersonLoginIsNotStripped(self):
+    """Make sure 'foo ', ' foo' and ' foo ' do not match user 'foo'. """
+    p = self._makePerson(reference='foo', password='secret',)
+    self._assertUserExists('foo', 'secret')
+    self._assertUserDoesNotExists('foo ', 'secret')
+    self._assertUserDoesNotExists(' foo', 'secret')
+    self._assertUserDoesNotExists(' foo ', 'secret')
+
+  def test_PersonLoginCannotBeComposed(self):
+    """Make sure ZSQLCatalog keywords cannot be used at login time"""
+    p = self._makePerson(reference='foo', password='secret',)
+    self._assertUserExists('foo', 'secret')
+    self._assertUserDoesNotExists('bar', 'secret')
+    self._assertUserDoesNotExists('bar OR foo', 'secret')
+
   def test_PersonLoginNonAscii(self):
     """Login can contain non ascii chars."""
     p = self._makePerson(reference='j\xc3\xa9', password='secret',)