flask-appbuilder 5.2.2rc2__tar.gz → 5.2.3__tar.gz

{flask_appbuilder-5.2.2rc2 → flask_appbuilder-5.2.3}/CHANGELOG.rst

@@ -1,9 +1,16 @@
 Flask-AppBuilder ChangeLog
 ==========================
 
-Improvements and Bug fixes on 5.2.2rc2
+Improvements and Bug fixes on 5.2.3
 -----------------------------------
 
+- fix: distinguish authentication from authorization redirects (#2479) [Amin Ghadersohi]
+- fix: bump pinned dependencies to address vulnerabilities (#2474) [Daniel Vaz Gaspar]
+
+Improvements and Bug fixes on 5.2.2
+-----------------------------------
+
+- fix: preserve safe login redirects for authenticated users and return 403 on authorization failures
 - fix: anchor OAuth email whitelist regex to end of string (#2470) [Daniel Vaz Gaspar]
 - fix: switch from uuid1 to uuid4 for better randomness (#2435) [Rin]
 - fix: escape special characters in LDAP search filter username (#2469) [Daniel Vaz Gaspar]

{flask_appbuilder-5.2.2rc2 → flask_appbuilder-5.2.3}/Flask_AppBuilder.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: flask-appbuilder
-Version: 5.2.2rc2
+Version: 5.2.3
 Summary: Simple and rapid application development framework, built on top of Flask. includes detailed security, auto CRUD generation for your models, google charts and much more.
 Home-page: https://github.com/dpgaspar/flask-appbuilder/
 Author: Daniel Vaz Gaspar

{flask_appbuilder-5.2.2rc2 → flask_appbuilder-5.2.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: flask_appbuilder
-Version: 5.2.2rc2
+Version: 5.2.3
 Summary: Simple and rapid application development framework, built on top of Flask. includes detailed security, auto CRUD generation for your models, google charts and much more.
 Home-page: https://github.com/dpgaspar/flask-appbuilder/
 Author: Daniel Vaz Gaspar

{flask_appbuilder-5.2.2rc2 → flask_appbuilder-5.2.3}/flask_appbuilder/__init__.py

@@ -1,5 +1,5 @@
 __author__ = "Daniel Vaz Gaspar"
-__version__ = "5.2.2rc2"
+__version__ = "5.2.3"
 
 from .actions import action  # noqa: F401
 from .api import ModelRestApi  # noqa: F401

{flask_appbuilder-5.2.2rc2 → flask_appbuilder-5.2.3}/flask_appbuilder/_compat.py

@@ -1,12 +1,13 @@
 # -*- coding: utf-8 -*-
 """
-    Some py2/py3 compatibility support based on a stripped down
-    version of six so we don't have to depend on a specific version
-    of it.
+Some py2/py3 compatibility support based on a stripped down
+version of six so we don't have to depend on a specific version
+of it.
 
-    :copyright: (c) 2013 by Armin Ronacher.
-    :license: BSD, see LICENSE for more details.
+:copyright: (c) 2013 by Armin Ronacher.
+:license: BSD, see LICENSE for more details.
 """
+
 import sys
 
 PY2 = sys.version_info[0] == 2

{flask_appbuilder-5.2.2rc2 → flask_appbuilder-5.2.3}/flask_appbuilder/baseviews.py

@@ -86,7 +86,7 @@ class AbstractViewApi:
         endpoint: Optional[str] = None,
         static_folder: Optional[str] = None,
     ):
-        ...
+        pass
 
     def get_uninit_inner_views(self):
         """

{flask_appbuilder-5.2.2rc2 → flask_appbuilder-5.2.3}/flask_appbuilder/cli.py

@@ -14,7 +14,6 @@ import jinja2
 
 from .const import AUTH_DB, AUTH_LDAP, AUTH_OAUTH, AUTH_REMOTE_USER
 
-
 SQLA_REPO_URL = (
     "https://github.com/dpgaspar/Flask-AppBuilder-Skeleton/archive/refs/heads/v5.zip"
 )

{flask_appbuilder-5.2.2rc2 → flask_appbuilder-5.2.3}/flask_appbuilder/filemanager.py

@@ -197,7 +197,7 @@ class ImageManager(FileManager):
             :param image: The image object
             :param size: size is PIL tuple (width, height, force) ex: (200,100,True)
         """
-        (width, height, force) = size
+        width, height, force = size
 
         if image.size[0] > width or image.size[1] > height:
             if force:

{flask_appbuilder-5.2.2rc2 → flask_appbuilder-5.2.3}/flask_appbuilder/models/generic/filters.py

@@ -2,7 +2,6 @@ from flask_babel import lazy_gettext
 
 from ..filters import BaseFilter, BaseFilterConverter
 
-
 __all__ = [
     "GenericFilterConverter",
     "FilterNotContains",

{flask_appbuilder-5.2.2rc2 → flask_appbuilder-5.2.3}/flask_appbuilder/models/mixins.py

@@ -7,7 +7,6 @@ from sqlalchemy.ext.declarative import declared_attr
 from sqlalchemy.orm import relationship
 import sqlalchemy.types as types
 
-
 log = logging.getLogger(__name__)
 
 

{flask_appbuilder-5.2.2rc2 → flask_appbuilder-5.2.3}/flask_appbuilder/security/decorators.py

@@ -3,6 +3,7 @@ import logging
 from typing import Callable, List, Optional, TypeVar, Union
 
 from flask import (
+    abort,
     current_app,
     flash,
     jsonify,
@@ -34,9 +35,9 @@ def no_cache(view: Callable[..., Response]) -> Callable[..., Response]:
     @functools.wraps(view)
     def wrapped_view(*args, **kwargs) -> Response:
         response = make_response(view(*args, **kwargs))
-        response.headers[
-            "Cache-Control"
-        ] = "no-store, no-cache, must-revalidate, max-age=0"
+        response.headers["Cache-Control"] = (
+            "no-store, no-cache, must-revalidate, max-age=0"
+        )
         response.headers["Pragma"] = "no-cache"
         response.headers["Expires"] = "0"
         return response
@@ -172,6 +173,8 @@ def has_access(f):
             log.warning(
                 LOGMSG_ERR_SEC_ACCESS_DENIED, permission_str, self.__class__.__name__
             )
+            if current_user.is_authenticated and current_user.is_active:
+                abort(403)
             flash(as_unicode(FLAMSG_ERR_SEC_ACCESS_DENIED), "danger")
         return redirect(
             url_for(

{flask_appbuilder-5.2.2rc2 → flask_appbuilder-5.2.3}/flask_appbuilder/security/schemas.py

@@ -10,7 +10,6 @@ from flask_appbuilder.const import (
 from marshmallow import fields, Schema, ValidationError
 from marshmallow.validate import Length, OneOf
 
-
 provider_to_auth_type = {"db": AUTH_DB, "ldap": AUTH_LDAP}
 
 

{flask_appbuilder-5.2.2rc2 → flask_appbuilder-5.2.3}/flask_appbuilder/security/sqla/apis/user/api.py

@@ -229,18 +229,14 @@ class UserApi(ModelRestApi):
 
             if item_roles == [] and (item_groups is None and not model.groups):
                 return self.response_400(
-                    message=(
-                        "Cannot clear all roles unless at least one group is \
-                             assigned!"
-                    )
+                    message=("Cannot clear all roles unless at least one group is \
+                             assigned!")
                 )
 
             if item_groups == [] and (item_roles is None and not model.roles):
                 return self.response_400(
-                    message=(
-                        "Cannot clear all groups unless at least one role is \
-                             assigned!"
-                    )
+                    message=("Cannot clear all groups unless at least one role is \
+                             assigned!")
                 )
 
             for key, value in item.items():

{flask_appbuilder-5.2.2rc2 → flask_appbuilder-5.2.3}/flask_appbuilder/security/views.py

@@ -45,7 +45,6 @@ from werkzeug.wrappers import Response as WerkzeugResponse
 from wtforms import PasswordField, validators
 from wtforms.validators import EqualTo
 
-
 log = logging.getLogger(__name__)
 
 
@@ -577,6 +576,11 @@ class AuthView(BaseView):
     def login(self):
         pass
 
+    def _get_safe_next_url(self) -> str:
+        """Return the requested redirect target, or the application index."""
+        next_url = request.args.get("next", self.appbuilder.get_url_for_index)
+        return get_safe_redirect(next_url)
+
     def _get_authenticated_user(self):
         """Resolve the current user before logout clears the session.
         Returns a fresh User model from DB, or None if not authenticated.
@@ -618,7 +622,8 @@ class AuthDBView(AuthView):
     @no_cache
     def login(self):
         if g.user is not None and g.user.is_authenticated:
-            return redirect(self.appbuilder.get_url_for_index)
+            # The target has been restricted by get_safe_redirect.
+            return redirect(self._get_safe_next_url())  # lgtm[py/url-redirection]
         form = LoginForm_db()
         if form.validate_on_submit():
             next_url = get_safe_redirect(request.args.get("next", ""))
@@ -642,7 +647,8 @@ class AuthLDAPView(AuthView):
     @no_cache
     def login(self):
         if g.user is not None and g.user.is_authenticated:
-            return redirect(self.appbuilder.get_url_for_index)
+            # The target has been restricted by get_safe_redirect.
+            return redirect(self._get_safe_next_url())  # lgtm[py/url-redirection]
         form = LoginForm_db()
         if form.validate_on_submit():
             next_url = get_safe_redirect(request.args.get("next", ""))
@@ -668,7 +674,8 @@ class AuthOAuthView(AuthView):
         log.debug("Provider: %s", provider)
         if g.user is not None and g.user.is_authenticated:
             log.debug("Already authenticated %s", g.user)
-            return redirect(self.appbuilder.get_url_for_index)
+            # The target has been restricted by get_safe_redirect.
+            return redirect(self._get_safe_next_url())  # lgtm[py/url-redirection]
 
         if provider is None:
             return self.render_template(
@@ -789,7 +796,8 @@ class AuthSAMLView(AuthView):
     @no_cache
     def login(self, idp: Optional[str] = None) -> WerkzeugResponse:
         if g.user is not None and g.user.is_authenticated:
-            return redirect(self.appbuilder.get_url_for_index)
+            # The target has been restricted by get_safe_redirect.
+            return redirect(self._get_safe_next_url())  # lgtm[py/url-redirection]
 
         sm = self.appbuilder.sm
         providers = sm.saml_providers
@@ -984,8 +992,8 @@ class AuthRemoteUserView(AuthView):
     def login(self) -> WerkzeugResponse:
         username = request.environ.get(self.appbuilder.sm.auth_remote_user_env_var)
         if g.user is not None and g.user.is_authenticated:
-            next_url = request.args.get("next", "")
-            return redirect(get_safe_redirect(next_url))
+            # The target has been restricted by get_safe_redirect.
+            return redirect(self._get_safe_next_url())  # lgtm[py/url-redirection]
         if username:
             user = self.appbuilder.sm.auth_user_remote_user(username)
             if user is None:

{flask_appbuilder-5.2.2rc2 → flask_appbuilder-5.2.3}/flask_appbuilder/utils/base.py

@@ -8,7 +8,6 @@ from flask import current_app, request
 from flask_babel import gettext
 from flask_babel.speaklater import LazyString
 
-
 log = logging.getLogger(__name__)
 
 

{flask_appbuilder-5.2.2rc2 → flask_appbuilder-5.2.3}/flask_appbuilder/views.py

@@ -29,7 +29,6 @@ from flask_appbuilder.urltools import (
 )
 from flask_appbuilder.widgets import GroupFormListWidget, ListMasterWidget
 
-
 log = logging.getLogger(__name__)
 
 

{flask_appbuilder-5.2.2rc2 → flask_appbuilder-5.2.3}/flask_appbuilder/widgets.py

@@ -10,7 +10,6 @@ from flask import current_app
 
 from ._compat import as_unicode
 
-
 log = logging.getLogger(__name__)
 
 

{flask_appbuilder-5.2.2rc2 → flask_appbuilder-5.2.3}/setup.py

@@ -4,7 +4,6 @@ import re
 
 from setuptools import find_packages, setup
 
-
 with io.open("flask_appbuilder/__init__.py", "rt", encoding="utf8") as f:
     version = re.search(r"__version__ = \"(.*?)\"", f.read()).group(1)
 

{flask_appbuilder-5.2.2rc2 → flask_appbuilder-5.2.3}/tests/security/test_auth_ldap.py

@@ -98,9 +98,9 @@ class LDAPSearchTestCase(unittest.TestCase):
         self.app.config["AUTH_LDAP_BIND_USER"] = "cn=admin,dc=example,dc=org"
         self.app.config["AUTH_LDAP_BIND_PASSWORD"] = "admin_password"
         self.app.config["AUTH_LDAP_SEARCH"] = "ou=users,dc=example,dc=org"
-        self.app.config[
-            "AUTH_LDAP_SEARCH_FILTER"
-        ] = "(memberOf=cn=staff,ou=groups,dc=example,dc=org)"
+        self.app.config["AUTH_LDAP_SEARCH_FILTER"] = (
+            "(memberOf=cn=staff,ou=groups,dc=example,dc=org)"
+        )
         with self.app.app_context():
             SQLA = get_sqla_class()
             db = SQLA(self.app)
@@ -154,9 +154,9 @@ class LDAPSearchTestCase(unittest.TestCase):
         self.app.config["AUTH_LDAP_BIND_USER"] = "cn=admin,dc=example,dc=org"
         self.app.config["AUTH_LDAP_BIND_PASSWORD"] = "admin_password"
         self.app.config["AUTH_LDAP_SEARCH"] = "ou=users,dc=example,dc=org"
-        self.app.config[
-            "AUTH_LDAP_SEARCH_FILTER"
-        ] = "(memberOf=cn=staff,ou=groups,dc=example,dc=org)"
+        self.app.config["AUTH_LDAP_SEARCH_FILTER"] = (
+            "(memberOf=cn=staff,ou=groups,dc=example,dc=org)"
+        )
         with self.app.app_context():
             SQLA = get_sqla_class()
             db = SQLA(self.app)
@@ -258,9 +258,9 @@ class LDAPSearchTestCase(unittest.TestCase):
         """
         LDAP: test login flow for - active user
         """
-        self.app.config[
-            "AUTH_LDAP_USERNAME_FORMAT"
-        ] = "cn=%s,ou=users,dc=example,dc=org"
+        self.app.config["AUTH_LDAP_USERNAME_FORMAT"] = (
+            "cn=%s,ou=users,dc=example,dc=org"
+        )
         self.app.config["AUTH_LDAP_SEARCH"] = "ou=users,dc=example,dc=org"
         with self.app.app_context():
             SQLA = get_sqla_class()
@@ -297,9 +297,9 @@ class LDAPSearchTestCase(unittest.TestCase):
         """
         LDAP: test login flow for - inactive user
         """
-        self.app.config[
-            "AUTH_LDAP_USERNAME_FORMAT"
-        ] = "cn=%s,ou=users,dc=example,dc=org"
+        self.app.config["AUTH_LDAP_USERNAME_FORMAT"] = (
+            "cn=%s,ou=users,dc=example,dc=org"
+        )
         self.app.config["AUTH_LDAP_SEARCH"] = "ou=users,dc=example,dc=org"
         with self.app.app_context():
             SQLA = get_sqla_class()
@@ -340,9 +340,9 @@ class LDAPSearchTestCase(unittest.TestCase):
             "cn=staff,ou=groups,dc=example,dc=org": ["Admin"],
             "cn=readers,ou=groups,dc=example,dc=org": ["User"],
         }
-        self.app.config[
-            "AUTH_LDAP_USERNAME_FORMAT"
-        ] = "cn=%s,ou=users,dc=example,dc=org"
+        self.app.config["AUTH_LDAP_USERNAME_FORMAT"] = (
+            "cn=%s,ou=users,dc=example,dc=org"
+        )
         self.app.config["AUTH_LDAP_SEARCH"] = "ou=users,dc=example,dc=org"
         self.app.config["AUTH_USER_REGISTRATION"] = True
         self.app.config["AUTH_USER_REGISTRATION_ROLE"] = "Public"
@@ -381,9 +381,9 @@ class LDAPSearchTestCase(unittest.TestCase):
         LDAP: test login flow for - direct bind - unregistered user
         """
         self.app.config["AUTH_LDAP_SEARCH"] = "ou=users,dc=example,dc=org"
-        self.app.config[
-            "AUTH_LDAP_USERNAME_FORMAT"
-        ] = "cn=%s,ou=users,dc=example,dc=org"
+        self.app.config["AUTH_LDAP_USERNAME_FORMAT"] = (
+            "cn=%s,ou=users,dc=example,dc=org"
+        )
         self.app.config["AUTH_USER_REGISTRATION"] = True
         self.app.config["AUTH_USER_REGISTRATION_ROLE"] = "Public"
         with self.app.app_context():
@@ -418,9 +418,9 @@ class LDAPSearchTestCase(unittest.TestCase):
         LDAP: test login flow for - direct bind - unregistered user - no self-registration
         """
         self.app.config["AUTH_LDAP_SEARCH"] = "ou=users,dc=example,dc=org"
-        self.app.config[
-            "AUTH_LDAP_USERNAME_FORMAT"
-        ] = "cn=%s,ou=users,dc=example,dc=org"
+        self.app.config["AUTH_LDAP_USERNAME_FORMAT"] = (
+            "cn=%s,ou=users,dc=example,dc=org"
+        )
         self.app.config["AUTH_USER_REGISTRATION"] = False
         with self.app.app_context():
             SQLA = get_sqla_class()
@@ -446,9 +446,9 @@ class LDAPSearchTestCase(unittest.TestCase):
         LDAP: test login flow for - direct bind - unregistered user - no ldap search
         """
         self.app.config["AUTH_LDAP_SEARCH"] = None
-        self.app.config[
-            "AUTH_LDAP_USERNAME_FORMAT"
-        ] = "cn=%s,ou=users,dc=example,dc=org"
+        self.app.config["AUTH_LDAP_USERNAME_FORMAT"] = (
+            "cn=%s,ou=users,dc=example,dc=org"
+        )
         self.app.config["AUTH_USER_REGISTRATION"] = True
         with self.app.app_context():
             SQLA = get_sqla_class()
@@ -472,9 +472,9 @@ class LDAPSearchTestCase(unittest.TestCase):
         LDAP: test login flow for - direct bind - registered user
         """
         self.app.config["AUTH_LDAP_SEARCH"] = "ou=users,dc=example,dc=org"
-        self.app.config[
-            "AUTH_LDAP_USERNAME_FORMAT"
-        ] = "cn=%s,ou=users,dc=example,dc=org"
+        self.app.config["AUTH_LDAP_USERNAME_FORMAT"] = (
+            "cn=%s,ou=users,dc=example,dc=org"
+        )
         with self.app.app_context():
             SQLA = get_sqla_class()
             db = SQLA(self.app)
@@ -508,9 +508,9 @@ class LDAPSearchTestCase(unittest.TestCase):
         LDAP: test login flow for - direct bind - registered user - no ldap search
         """
         self.app.config["AUTH_LDAP_SEARCH"] = None
-        self.app.config[
-            "AUTH_LDAP_USERNAME_FORMAT"
-        ] = "cn=%s,ou=users,dc=example,dc=org"
+        self.app.config["AUTH_LDAP_USERNAME_FORMAT"] = (
+            "cn=%s,ou=users,dc=example,dc=org"
+        )
         with self.app.app_context():
             SQLA = get_sqla_class()
             db = SQLA(self.app)
@@ -707,9 +707,9 @@ class LDAPSearchTestCase(unittest.TestCase):
             "cn=staff,ou=groups,dc=example,dc=org": ["Admin"]
         }
         self.app.config["AUTH_LDAP_SEARCH"] = "ou=users,dc=example,dc=org"
-        self.app.config[
-            "AUTH_LDAP_USERNAME_FORMAT"
-        ] = "cn=%s,ou=users,dc=example,dc=org"
+        self.app.config["AUTH_LDAP_USERNAME_FORMAT"] = (
+            "cn=%s,ou=users,dc=example,dc=org"
+        )
         self.app.config["AUTH_USER_REGISTRATION"] = True
         self.app.config["AUTH_USER_REGISTRATION_ROLE"] = "Public"
         with self.app.app_context():
@@ -750,9 +750,9 @@ class LDAPSearchTestCase(unittest.TestCase):
             "cn=staff,ou=groups,dc=example,dc=org": ["Admin", "User"]
         }
         self.app.config["AUTH_LDAP_SEARCH"] = "ou=users,dc=example,dc=org"
-        self.app.config[
-            "AUTH_LDAP_USERNAME_FORMAT"
-        ] = "cn=%s,ou=users,dc=example,dc=org"
+        self.app.config["AUTH_LDAP_USERNAME_FORMAT"] = (
+            "cn=%s,ou=users,dc=example,dc=org"
+        )
         self.app.config["AUTH_USER_REGISTRATION"] = True
         self.app.config["AUTH_USER_REGISTRATION_ROLE"] = "Public"
         with self.app.app_context():
@@ -793,9 +793,9 @@ class LDAPSearchTestCase(unittest.TestCase):
             "cn=staff,ou=groups,dc=example,dc=org": ["Admin", "User"]
         }
         self.app.config["AUTH_ROLES_SYNC_AT_LOGIN"] = False
-        self.app.config[
-            "AUTH_LDAP_USERNAME_FORMAT"
-        ] = "cn=%s,ou=users,dc=example,dc=org"
+        self.app.config["AUTH_LDAP_USERNAME_FORMAT"] = (
+            "cn=%s,ou=users,dc=example,dc=org"
+        )
         self.app.config["AUTH_LDAP_SEARCH"] = "ou=users,dc=example,dc=org"
         with self.app.app_context():
             SQLA = get_sqla_class()
@@ -839,9 +839,9 @@ class LDAPSearchTestCase(unittest.TestCase):
             "cn=staff,ou=groups,dc=example,dc=org": ["Admin", "User"]
         }
         self.app.config["AUTH_ROLES_SYNC_AT_LOGIN"] = True
-        self.app.config[
-            "AUTH_LDAP_USERNAME_FORMAT"
-        ] = "cn=%s,ou=users,dc=example,dc=org"
+        self.app.config["AUTH_LDAP_USERNAME_FORMAT"] = (
+            "cn=%s,ou=users,dc=example,dc=org"
+        )
         self.app.config["AUTH_LDAP_SEARCH"] = "ou=users,dc=example,dc=org"
         with self.app.app_context():
             SQLA = get_sqla_class()
@@ -1056,9 +1056,9 @@ class LDAPSearchTestCase(unittest.TestCase):
         LDAP: Keeping next url after failed login attempt
         """
         self.app.config["AUTH_LDAP_SEARCH"] = "ou=users,dc=example,dc=org"
-        self.app.config[
-            "AUTH_LDAP_USERNAME_FORMAT"
-        ] = "cn=%s,ou=users,dc=example,dc=org"
+        self.app.config["AUTH_LDAP_USERNAME_FORMAT"] = (
+            "cn=%s,ou=users,dc=example,dc=org"
+        )
         self.app.config["AUTH_USER_REGISTRATION"] = True
         self.app.config["AUTH_USER_REGISTRATION_ROLE"] = "Public"
         self.app.config["WTF_CSRF_ENABLED"] = False

{flask_appbuilder-5.2.2rc2 → flask_appbuilder-5.2.3}/tests/security/test_auth_oauth.py

@@ -306,9 +306,9 @@ class OAuthRegistrationRoleTestCase(unittest.TestCase):
         OAUTH: test login flow for - unregistered user - jmespath registration role
         """
         self.app.config["AUTH_USER_REGISTRATION"] = True
-        self.app.config[
-            "AUTH_USER_REGISTRATION_ROLE_JMESPATH"
-        ] = "contains(['alice'], username) && 'User' || 'Public'"
+        self.app.config["AUTH_USER_REGISTRATION_ROLE_JMESPATH"] = (
+            "contains(['alice'], username) && 'User' || 'Public'"
+        )
         with self.app.app_context():
             SQLA = get_sqla_class()
             db = SQLA(self.app)
@@ -427,9 +427,9 @@ class OAuthRegistrationRoleTestCase(unittest.TestCase):
         """  # noqa
         self.app.config["AUTH_ROLES_SYNC_AT_LOGIN"] = False
         self.app.config["AUTH_USER_REGISTRATION"] = True
-        self.app.config[
-            "AUTH_USER_REGISTRATION_ROLE_JMESPATH"
-        ] = "contains(['alice'], username) && 'User' || 'Public'"
+        self.app.config["AUTH_USER_REGISTRATION_ROLE_JMESPATH"] = (
+            "contains(['alice'], username) && 'User' || 'Public'"
+        )
         with self.app.app_context():
             SQLA = get_sqla_class()
             db = SQLA(self.app)
@@ -470,9 +470,9 @@ class OAuthRegistrationRoleTestCase(unittest.TestCase):
         """  # noqa
         self.app.config["AUTH_ROLES_SYNC_AT_LOGIN"] = True
         self.app.config["AUTH_USER_REGISTRATION"] = True
-        self.app.config[
-            "AUTH_USER_REGISTRATION_ROLE_JMESPATH"
-        ] = "contains(['alice'], username) && 'User' || 'Public'"
+        self.app.config["AUTH_USER_REGISTRATION_ROLE_JMESPATH"] = (
+            "contains(['alice'], username) && 'User' || 'Public'"
+        )
         with self.app.app_context():
             SQLA = get_sqla_class()
             db = SQLA(self.app)

{flask_appbuilder-5.2.2rc2 → flask_appbuilder-5.2.3}/tests/security/test_mvc_security.py

@@ -162,6 +162,25 @@ class MVCSecurityTestCase(BaseMVCTestCase):
         )
         assert response.location == "/users/list/"
 
+    def test_authenticated_db_login_valid_next_url(self):
+        """An authenticated login request retains a safe next URL."""
+        self.browser_login(self.client, USERNAME_ADMIN, PASSWORD_ADMIN)
+
+        response = self.client.get("/login/?next=/users/list/", follow_redirects=False)
+
+        assert response.status_code == 302
+        assert response.location == "/users/list/"
+
+    def test_authenticated_access_denial_returns_forbidden(self):
+        """A logged-in user lacking permission is not sent back to login."""
+        self.browser_login(self.client, USERNAME_ADMIN, PASSWORD_ADMIN)
+
+        with patch.object(self.appbuilder.sm, "has_access", return_value=False):
+            response = self.client.get("/model1view/list/", follow_redirects=False)
+
+        assert response.status_code == 403
+        assert response.location is None
+
     def test_db_login_valid_http_scheme_url(self):
         """
         Test Security valid http scheme next URL
@@ -371,10 +390,10 @@ class MVCSecurityTestCase(BaseMVCTestCase):
             self.assertEqual(rv.status_code, 200)
             # Test unauthorized EDIT
             rv = client.get(f"/model1view/edit/{model_id}")
-            self.assertEqual(rv.status_code, 302)
+            self.assertEqual(rv.status_code, 403)
             # Test unauthorized DELETE
             rv = client.get(f"/model1view/delete/{model_id}")
-            self.assertEqual(rv.status_code, 302)
+            self.assertEqual(rv.status_code, 403)
 
     def test_sec_reset_password(self):
         """

{flask_appbuilder-5.2.2rc2 → flask_appbuilder-5.2.3}/tests/test_addon.py

@@ -4,7 +4,6 @@ import os
 from tests.base import FABTestCase
 from tests.fixtures.addon_manager import DummyAddOnManager
 
-
 log = logging.getLogger(__name__)
 
 

{flask_appbuilder-5.2.2rc2 → flask_appbuilder-5.2.3}/tests/test_custom_indexview.py

@@ -19,9 +19,9 @@ class FlaskTestCase(FABTestCase):
         self.app = Flask(__name__, template_folder=".")
         self.basedir = os.path.abspath(os.path.dirname(__file__))
         self.app.config.from_object("tests.config_api")
-        self.app.config[
-            "FAB_INDEX_VIEW"
-        ] = "tests.test_custom_indexview.CustomIndexView"
+        self.app.config["FAB_INDEX_VIEW"] = (
+            "tests.test_custom_indexview.CustomIndexView"
+        )
 
     def test_custom_indexview(self):
         """

{flask_appbuilder-5.2.2rc2 → flask_appbuilder-5.2.3}/tests/test_fab_cli.py

@@ -228,9 +228,9 @@ class SQLAlchemyImportExportTestCase(FABTestCase):
     def test_import_roles(self):
         with tempfile.TemporaryDirectory() as tmp_dir:
             app = Flask("dst_app")
-            app.config[
-                "SQLALCHEMY_DATABASE_URI"
-            ] = f"sqlite:///{os.path.join(tmp_dir, 'dst.db')}"
+            app.config["SQLALCHEMY_DATABASE_URI"] = (
+                f"sqlite:///{os.path.join(tmp_dir, 'dst.db')}"
+            )
             with app.app_context():
                 SQLA = get_sqla_class()
                 db = SQLA(app)

{flask_appbuilder-5.2.2rc2 → flask_appbuilder-5.2.3}/tests/test_hooks.py

@@ -10,7 +10,6 @@ from flask_appbuilder.utils.legacy import get_sqla_class
 from tests.base import FABTestCase
 from tests.const import PASSWORD_ADMIN, USERNAME_ADMIN
 
-
 log = logging.getLogger(__name__)
 
 

{flask_appbuilder-5.2.2rc2 → flask_appbuilder-5.2.3}/tests/test_mvc.py

@@ -1550,7 +1550,7 @@ class MVCTestCase(BaseMVCTestCase):
             )
             pk = model1.id
             rv = client.get(f"/model1permoverride/delete/{pk}")
-            self.assertEqual(rv.status_code, 302)
+            self.assertEqual(rv.status_code, 403)
             model = self.appbuilder.session.query(Model1).filter_by(id=pk).one_or_none()
             self.assertEqual(model.field_string, "test1")
 

{flask_appbuilder-5.2.2rc2 → flask_appbuilder-5.2.3}/tests/test_security_api.py

@@ -13,7 +13,6 @@ from tests.base import FABTestCase
 from tests.const import PASSWORD_ADMIN, USERNAME_ADMIN
 from werkzeug.security import generate_password_hash
 
-
 log = logging.getLogger(__name__)