From e88134e2c2e8ffef94e4c1b502221479df6fd8ba Mon Sep 17 00:00:00 2001 From: Edward Oliveira Date: Mon, 12 Oct 2026 11:12:28 -0300 Subject: [PATCH] =?UTF-8?q?N=C3=A3o=20redireciona=20arquivos=20de=20m?= =?UTF-8?q?=C3=ADdia=20para=20troca=20de=20senha?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 5.5 --- sapl/base/tests/test_media.py | 13 +++++++++++++ sapl/middleware/check_password.py | 4 +++- 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/sapl/base/tests/test_media.py b/sapl/base/tests/test_media.py index 48dd71f3a..ef39c79c3 100644 --- a/sapl/base/tests/test_media.py +++ b/sapl/base/tests/test_media.py @@ -263,3 +263,16 @@ def test_modelo_protegido_fora_de_private_e_public(client): baker.make(DocumentoAdministrativo, restrito=True, texto_integral=path) assert _get(client, path).status_code == 404 + + +@pytest.mark.django_db(transaction=False) +def test_senha_fraca_nao_redireciona_media(client): + _login(client, 'fraca') + session = client.session + session['weak_password'] = True + session.save() + + response = _get(client, 'sapl/public/casalegislativa/logotipo.png') + + assert response.status_code == 200 + assert response.has_header('X-Accel-Redirect') diff --git a/sapl/middleware/check_password.py b/sapl/middleware/check_password.py index 329e24909..90bf40635 100644 --- a/sapl/middleware/check_password.py +++ b/sapl/middleware/check_password.py @@ -1,5 +1,6 @@ import logging +from django.conf import settings from django.shortcuts import redirect from django.urls import reverse @@ -14,7 +15,8 @@ class CheckWeakPasswordMiddleware: if request.user.is_authenticated and \ request.session.get('weak_password', False) and \ request.path != reverse('sapl.base:alterar_senha') and \ - request.path != reverse('sapl.base:logout'): + request.path != reverse('sapl.base:logout') and \ + not request.path.startswith(settings.MEDIA_URL): logging.warning(f"Usuário {request.user.username} possui senha fraca.") return redirect('sapl.base:alterar_senha')