Complete release-specific testing for 2.5.0-rc4

[zenmonkeykstop]

No description provided.

[eaon]

Environment

• Install target: NUC11 (app) / NUC10 (mon)
• Tails version: 5.4
• Test Scenario: clean
• SSH over Tor: yes
• General notes: clean install to rc3, rc4 installed via unattended upgrades. Tests here ought to be unaffected

2.5.0 release-specific changes

• #6403 Unified Redis-backed sessions

  Note: session info is now stored server-side using Redis. Some useful redis-cli commands for testing include:

  • KEYS <pattern> - lists all keys matching a given pattern
  • GET <key> - returns the given key's value
  • TTL <key> - returns the time-to-live for a given key
  • EXPIRE <key> <sec> - sets a given key's expiry to the <sec> value in seconds

  redis-cli should be run in an app server terminal as the instance redis server is
  only available locally.

Upgrade-only

• ❌ Upgrade completed successfully from 2.4.2 SKIPPED (clean install)
• ❌ revoked_tokens table is no longer present in database SKIPPED (clean instal)

Login

• Log in to the JI

• Confirm that you are logged in as the expected user

• Edit the js cookie signature in Tor Browser and try to continue browsing the JI

• Confirm that you are logged out
• Login to the JI

• note your session id (in an app-server ssh session, use redis-cli and KEYS js_session:* to check it)
• Log out, then log back in again

• check your session id again and confirm that you received a new random-looking
  session id, and that your previous session id is no longer present

Sessions of multiple users are separate

• Login to the JI as user X in browser A
• Login to the JI as user Y in browser B

• Confirm that you are logged in as the expected user in each session

Sessions are renewed in accordance with the new expiration/renewal policy

• Login to the JI
• in an app server ssh session use redis-cli, KEYS *, and EXPIRE <key id> 10 to
  expire the session

• Try to continue browsing, and confirm that you are logged out automatically
• Confirm that a "logged out due to inactivity" message is displayed on the login screen

• Login to the JI
• use KEYS * and EXPIRE <key> 1799 to set the key expiry time to less than 30min

• check the key value with GET <key> and verify that the renew-count value is 5

• continue browsing in the JI

• Check the key TTL with TTL <key> and verify that it has had an additional 2hrs added
• check the key value with GET <key> and verify that the renew-count value is 4

• repeat the expiry/renewal process 4 more times, verifying that renew-count decreases each time

• once renew-count is 0, verify that the TTL is no longer renewed by browsing the JI

Logout works

• Login to the JI as user X in browser A
• Login to the JI as user Y in browser B
• Logout from user X in browser A

• Confirm that user X is logged out
• Confirm that user Y is still logged in

Deleting a user destroy all sessions of the user

• Login to the JI as admin X in browser A
• Login to the JI as admin/user Y in browser B
• From admin X in browser A, delete user Y

• Confirm that user Y in browser B is logged out

Changing a user password destroy all sessions of the user

• Login to the JI as admin X in browser A
• Login to the JI as admin/user Y in browser B
• From admin X in browser A, change password of user Y

• Confirm that user Y in browser B is logged out

• Login to the JI as admin X
• Change admin X password

• Confirm that admin X is logged out on password change

API and securedrop-client

Note: use SecureDrop Workstation, configured to connect to your QA instance

• Login to securedrop-client

• Confirm that the login is succesful
• on the app server, confirm that a session id was created
• confirm that basic authenticated operations (syncing sources, downloading docs, replies) work in the client
• Log out in the client (keeping the client session open in offline mode
• on the app server, confirm that the session id was destroyed
• Confirm that basic authenticated operations are no longer available in the client

---

• #6557, #6475 - locale changes
  • Run ./securedrop_admin sdconfig on the Admin Workstation, and confirm that
    the list of available languages matches those in the filesecuredrop/i18n.json
  • (install only) set up both Portugese locales during installation, and confirm that they are available in the locale widget in the SI and JI, listed including the locale country name.

---

• #6550 - double-escaped org names
  • In the Admin Interface, update the organization name to a string including an ampersand
  • verify that the ampersand is rendered correctly in the SI and JI

---

• #6543 - consistent terminology
  • there are no references to documents when using the SI, only files, messages, and submissions

---

• #6425 - removal of minification
  • in the SI index page source, there is no reference to static/gen/source.js, with the file included from static/js/source.js instead.
  • on the JI all sources page, there is no reference to static/gen/journalist.js, with the file included from static/js/journalist.js instead.
  • on the JI all sources page, with JS enabled, source filtering works correctly.

---

• #6609 - Arabic
  • (Install only) Verify that ar is an available language when running ./securedrop-admin sdconfig

[zenmonkeykstop]

###IN PROGRESS###

(VMs/fresh install/Tails 5.5)

2.5.0 release-specific changes

• #6403 Unified Redis-backed sessions

  Note: session info is now stored server-side using Redis. Some useful redis-cli commands for testing include:

  • KEYS <pattern> - lists all keys matching a given pattern
  • GET <key> - returns the given key's value
  • TTL <key> - returns the time-to-live for a given key
  • EXPIRE <key> <sec> - sets a given key's expiry to the <sec> value in seconds

  redis-cli should be run in an app server terminal as the instance redis server is
  only available locally.

Upgrade-only

• Upgrade completed successfully from 2.4.2
• revoked_tokens table is no longer present in database

Login

• Log in to the JI

• Confirm that you are logged in as the expected user

• Edit the js cookie signature in Tor Browser and try to continue browsing the JI

• Confirm that you are logged out
• Login to the JI

• note your session id (in an app-server ssh session, use redis-cli and KEYS js_session:* to check it)
• Log out, then log back in again

• check your session id again and confirm that you received a new random-looking
  session id, and that your previous session id is no longer present

Sessions of multiple users are separate

• Login to the JI as user X in browser A
• Login to the JI as user Y in browser B

• Confirm that you are logged in as the expected user in each session

Sessions are renewed in accordance with the new expiration/renewal policy

• Login to the JI
• in an app server ssh session use redis-cli, KEYS *, and EXPIRE <key id> 10 to
  expire the session

• Try to continue browsing, and confirm that you are logged out automatically
• Confirm that a "logged out due to inactivity" message is displayed on the login screen

• Login to the JI
• use KEYS * and EXPIRE <key> 1799 to set the key expiry time to less than 30min

• check the key value with GET <key> and verify that the renew-count value is 5

• continue browsing in the JI

• Check the key TTL with TTL <key> and verify that it has had an additional 2hrs added
• check the key value with GET <key> and verify that the renew-count value is 4

• repeat the expiry/renewal process 4 more times, verifying that renew-count decreases each time

• once renew-count is 0, verify that the TTL is no longer renewed by browsing the JI

Logout works

• Login to the JI as user X in browser A
• Login to the JI as user Y in browser B
• Logout from user X in browser A

• Confirm that user X is logged out
• Confirm that user Y is still logged in

Deleting a user destroy all sessions of the user

• Login to the JI as admin X in browser A
• Login to the JI as admin/user Y in browser B
• From admin X in browser A, delete user Y

• Confirm that user Y in browser B is logged out

Changing a user password destroy all sessions of the user

• Login to the JI as admin X in browser A
• Login to the JI as admin/user Y in browser B
• From admin X in browser A, change password of user Y

• Confirm that user Y in browser B is logged out

• Login to the JI as admin X
• Change admin X password

• Confirm that admin X is logged out on password change

API and securedrop-client SKIPPED

---

• #6557, #6475 - locale changes
  • Run ./securedrop_admin sdconfig on the Admin Workstation, and confirm that
    the list of available languages matches those in the filesecuredrop/i18n.json
  • (install only) set up both Portugese locales during installation, and confirm that they are available in the locale widget in the SI and JI, listed including the locale country name.

---

• #6550 - double-escaped org names
  • In the Admin Interface, update the organization name to a string including an ampersand
  • verify that the ampersand is rendered correctly in the SI and JI

---

• #6543 - consistent terminology
  • there are no references to documents when using the SI, only files, messages, and submissions

---

• #6425 - removal of minification
  • in the SI index page source, there is no reference to static/gen/source.js, with the file included from static/js/source.js instead.
  • on the JI all sources page, there is no reference to static/gen/journalist.js, with the file included from static/js/journalist.js instead.
  • on the JI all sources page, with JS enabled, source filtering works correctly.

---

• #6609 - Arabic
  • (Install only) Verify that ar is an available language when running ./securedrop-admin sdconfig

---

• #6615 - Require admins to authenticate when changing their passphrase

  • log in to the JI as an admin user
  • navigate to the admin section
  • Confirm that you can change the passphrase for another user without authenticating
  • Confirm that if you choose to edit your own account via the edit button on the admin page, you are presented with the authentication fields in the passphrase change form
  • Navigate to the edit page for a different user
  • Use webdev tools to modify the new-password form action, replacing the user's uid with the admin account's uid
  • Click Reset Password and confirm that you receive a 403 error
  • Check the journalist error logs and confirm that a message was logged about the disallowed passphrase change.

---