testing plone site security policy - is your intranet doing what you think it is?

understand, develop, deliver. www.netsight.co.uk

Testing Plone Site Security Policy

Matt HamiltonNetsight Internet Solutions, UK

(Is your intranet doing what you think it is?)

http://www.netsight.co.uk



What this talk is NOT

• Not talking about security vulnerabilities

• Not talking about code unit testing

• Not talking about penetration testing




So what IS this talk?

It goes something a bit like this:






Is our intranet secure?

Boss






Is our intranet secure?

Boss

Yes of course!

You





• But is it really?! Lets think about this:






➡ You installed Plone







➡ You created a set of custom content types








➡ You created a custom workflow








➡ You created a custom workflow

➡ Users have group memberships, local roles, etc





So our site is now quite complex in terms of who should be allowed to do what and

where




Our use-case




Belron.net




Belron.net

• Belron.net Intranet is based around ‘Projects’ and ‘Groups’





Belron.net


- Users have local membership and roles of individual groups and projects





Belron.net



- Projects may be in various ‘states’: Public, Private, Secret





Belron.net




- Users have local roles to their project: Member, Contributor, Reviewer, Owner, Manager





Belron.net




- Users have local roles to their project: Member, Contributor, Reviewer, Owner, Manager

- Content within a project may be in various states: Private, Draft, Pending, Published





So....




So....

• If a piece of content is in the pending state, in a private project, in which I am a member and contributor, should I be able to edit it?




So....

• If a piece of content is in the pending state, in a private project, in which I am a member and contributor, should I be able to edit it?

• If a project is in the secret state, and I am a non-member should I be able to view the project description?




Policy decisions




Policy decisions

• These are POLICY decisions for the site, not really CODE decisions.




Policy decisions


- ie. these are high level objectives set by analysts/managers not coders




Policy decisions


- ie. these are high level objectives set by analysts/managers not coders

- But they will catch errors in the code or customisation




Coverage




Coverage

• So, we have 3 project states x 5 local roles x 4 content states = 60 permutations




Coverage


• oh... and in Plone Owner has special meaning on a piece of content... so 120 permutations




Coverage



• And for each one we want to test: can I View, Edit, List, Delete, Add....




Coverage



• And for each one we want to test: can I View, Edit, List, Delete, Add....

• For Belron.net we had approx 1,300 tests needed




An idea...

• What if there was a nice easy way to test all these different permutations in an automated way and drive it all from a manager-friendly spreadsheet and be able to visually see the results?




PolicyTestCase

• Similar to PloneTestCase

• Write a bunch of tests

• Export a spreadsheet as CSV

• Run the tests

• See the results in a table




PolicyTestCaseclass TestDefaultPlone(PolicyTestCase):

def afterSetUp(self):

# Setup the state, eg workflow etc

def ViewContent(self):

# Test we can view the content

def NoViewContent(self):

# Test we can NOT view the content




PolicyTestCase

def test_suite():

from unittest import TestSuite

suite = TestSuite()

csv = open('%s/test_scenarios_simple2.csv' % PACKAGE_HOME)

suite.addTest(makeSuiteFromCSV(TestDefaultPlone, csv))

return suite




Demo

Demo and walkthrough of the code




Questions?

Any questions?

Matt [email protected]

PolicyTestCase: in collective, will do a release real soon now ;)



mailto:[email protected]

mailto:[email protected]

testing plone site security policy - is your intranet doing what you think it is?

Technology