Security settings

*** Settings ***

Resource  plone/app/robotframework/server.robot
Resource  plone/app/robotframework/keywords.robot
Resource  Selenium2Screenshots/keywords.robot

Library  OperatingSystem

Suite Setup  Run keywords  Suite Setup  Test Setup
Suite Teardown  Run keywords  Test teardown  Suite Teardown

*** Variables ***

${FIXTURE}  plone.app.robotframework.PLONE_ROBOT_TESTING
@{DIMENSIONS}  1024  768
@{APPLY_PROFILES}  plone.app.contenttypes:plone-content


*** Keywords ***

Suite Setup
    Run keyword if  not sys.argv[0].startswith('bin/robot')
    ...             Setup Plone site  ${FIXTURE}
    Run keyword if  sys.argv[0].startswith('bin/robot')
    ...             Open test browser
    Run keyword and ignore error  Set window size  @{DIMENSIONS}

Test Setup
    Import library  Remote  ${PLONE_URL}/RobotRemote

    Run keyword if  sys.argv[0].startswith('bin/robot')
    ...             Remote ZODB SetUp  ${FIXTURE}

    ${language} =  Get environment variable  LANGUAGE  'en'
    Set default language  ${language}

    Enable autologin as  Manager
    ${user_id} =  Translate  user_id
    ...  default=jane-doe
    ${user_fullname} =  Translate  user_fullname
    ...  default=Jane Doe
    Create user  ${user_id}  Member  fullname=${user_fullname}
    Set autologin username  ${user_id}

Test Teardown
    Run keyword if  sys.argv[0].startswith('bin/robot')
    ...             Remote ZODB TearDown  ${FIXTURE}

Suite Teardown
    Run keyword if  not sys.argv[0].startswith('bin/robot')
    ...             Teardown Plone Site
    Run keyword if  sys.argv[0].startswith('bin/robot')
    ...             Close all browsers

*** Test Cases ***

Show Security setup screen
    Go to  ${PLONE_URL}/@@security-controlpanel
    Capture and crop page screenshot
    ...  ${CURDIR}/../../_robot/security-setup.png
    ...  css=#content

Of the various settings here, the most important ones are:

Enable self-registration

Setting this option will mean that new users can register themselves. It is strongly advised to keep the “let users select their own passwords” UNchecked when choosing this option, as at least all new users will have to have a valid email. This helps in slowing down bot-generated attacks.

Use email address as login name

As most people have difficulty remembering login names, it can be good to allow email addresses as logins.