diff --git a/awx/api/generics.py b/awx/api/generics.py index 5509f09f80..32376ffe9b 100644 --- a/awx/api/generics.py +++ b/awx/api/generics.py @@ -66,14 +66,15 @@ class LoggedLoginView(auth_views.LoginView): original_user = getattr(request, 'user', None) ret = super(LoggedLoginView, self).post(request, *args, **kwargs) current_user = getattr(request, 'user', None) + if current_user and getattr(current_user, 'pk', None) and current_user != original_user: logger.info("User {} logged in.".format(current_user.username)) if request.user.is_authenticated: return ret else: - ret.status = 401 + ret.status_code = 401 return ret - + class LoggedLogoutView(auth_views.LogoutView): diff --git a/awx/main/tests/functional/api/test_auth.py b/awx/main/tests/functional/api/test_auth.py new file mode 100644 index 0000000000..dfc92e67f5 --- /dev/null +++ b/awx/main/tests/functional/api/test_auth.py @@ -0,0 +1,26 @@ +import pytest + +from django.contrib import auth +from django.test import Client + +from rest_framework.test import APIRequestFactory + +from awx.api.generics import LoggedLoginView +from awx.api.versioning import drf_reverse + + +@pytest.mark.django_db +def test_invalid_login(): + anon = auth.get_user(Client()) + url = drf_reverse('api:login') + + factory = APIRequestFactory() + + data = {'userame': 'invalid', 'password': 'invalid'} + + request = factory.post(url, data) + request.user = anon + + response = LoggedLoginView.as_view()(request) + + assert response.status_code == 401