Merge lp:~canonical-isd-hackers/canonical-identity-provider/email-whitelist into lp:canonical-identity-provider/release

[Michael Foord]

Email addresses can be whitelisted to bypass captcha verification. Whitelist emails by providing a list of regular expressions to match emails in the EMAIL_WHITELIST_REGEXP_LIST setting (captcha section).

Email addresses can be whitelisted to bypass captcha verification. Whitelist emails by providing a list of regular expressions to match emails in the EMAIL_WHITELIST_REGEXP_LIST setting (captcha section).

This mp adds an EMAIL_WHITELIST_REGEXP_LIST setting to the captcha section of the sso config.

captcha.verify now takes an email address and all patterns will be checked against the supplied email. If a match is found then captcha verification is bypassed.

For our test email(s) I suggest the following pattern:

    ^canonicaltest(?:\+.+)?@gmail\.com$

So in local.cfg add:

[captcha]
email_whitelist_regexp_list =
    ^canonicaltest(?:\+.+)?@gmail\.com$

All tests pass in this branch.

[Michael Nelson (michael.nelson)]

Hi Michael. Excellent branch... the implementation and tests are all very clear.

The only potential danger I can see with this branch is the ability to add unsafe regexes, but I don't see anyway around that unless we restricted ourselves to gmail accounts (ie. usesd settings.GMAIL_IDENTIFIER_WHITELIST and automatically calculated the regex to allow identifier+whatever).

The only questions I've got below are for my own understanding or tiny style questions. I verified that all 611 tests pass.

> === modified file 'identityprovider/models/captcha.py'
> --- identityprovider/models/captcha.py 2011-06-30 04:55:13 +0000
> +++ identityprovider/models/captcha.py 2011-07-26 07:31:31 +0000
> @@ -190,3 +194,9 @@
> self._verified = False
> raise VerifyCaptchaError(self.response.traceback)
> return self._verified
> +
> + def check_whitelist(self, email):
> + for pattern in settings.EMAIL_WHITELIST_REGEXP_LIST:
> + if re.match(pattern, email):
> + return True
> + return False

So that's the crux of the branch right? Nice and simple :)

The only thought I had was whether it should be *outside* of captcha.verify(),
rather than being hidden within, but that's just a small point - nothing to
delay the branch landing over :)

>
> === modified file 'identityprovider/schema.py'
> --- identityprovider/schema.py 2011-07-12 09:41:08 +0000
> +++ identityprovider/schema.py 2011-07-26 07:31:31 +0000
> @@ -78,6 +78,9 @@
> captcha.captcha_public_key = StringConfigOption()
> captcha.captcha_private_key = StringConfigOption()
> captcha.disable_captcha_verification = BoolConfigOption()
> + captcha.email_whitelist_regexp_list = LinesConfigOption(
> + item=StringConfigOption(raw=True)

I wasn't sure at first why the raw=True was necessary, until I tried
repr('^canonicaltest(?:\+.+)?@gmail\.com$').

> + )
>
> # debug
> debug = ConfigSection()
>
> === modified file 'identityprovider/tests/test_auth.py'
> --- identityprovider/tests/test_auth.py 2011-07-15 15:17:19 +0000
> +++ identityprovider/tests/test_auth.py 2011-07-26 07:31:31 +0000

Great to fix up all the patch_object's :)

> === modified file 'identityprovider/tests/test_captcha.py'
> --- identityprovider/tests/test_captcha.py 2011-07-21 16:08:06 +0000
> +++ identityprovider/tests/test_captcha.py 2011-07-26 07:31:31 +0000
> === modified file 'identityprovider/tests/test_command_cleanup.py'
> --- identityprovider/tests/test_command_cleanup.py 2011-07-15 11:50:53 +0000
> +++ identityprovider/tests/test_command_cleanup.py 2011-07-26 07:31:31 +0000
> === modified file 'identityprovider/tests/test_forms.py'
> --- identityprovider/tests/test_forms.py 2011-07-15 11:50:53 +0000
> +++ identityprovider/tests/test_forms.py 2011-07-26 07:31:31 +0000
> @@ -18,6 +18,7 @@
> )
> from identityprovider.api10.forms import WebserviceCreateAccountForm
> from identityprovider.models.openidmodels import OpenIDRPConfig
> +from identityprovider.tests.utils import patch_settings
>
> from .utils import SSOBaseTestCase
>
> @@ -114,6 +115,23 @@
> self.assertTrue(form.is_valid())
> self.assertEqual(form.cleaned_da...

review: Approve (code)

[Michael Foord (mfoord)]

I agree with you about the danger of unsafe regexps. An accidental ".*" and captcha verification is always bypassed. :-o

> The only thought I had was whether it should be *outside* of captcha.verify(),
> rather than being hidden within, but that's just a small point - nothing to
> delay the branch landing over :)

Well, captcha.verify(...) is called from multiple places, so putting this into the verification seemed both "correct" (it is part of the verification) *and* simplest (only one place to change and update).

> Great to have the above, but I couldn't see why it was necessary given the
two tests below.

That was the test I wrote first. I think I was thinking that I could then just test .check_whitelist directly as I had already tested that verify used it. It didn't work out like that though.

I'm not entirely sure why we have dependencies in setup.py *and* in requirements.txt. I think it is because setup.py is used to build packages, but requirements.txt isn't.

> I don't see why you don't just use `with patch.object(Captcha, '_open')...`

Yeah, that would be better. I was just fixing some code that was a bit "odd". Just using patch.object would have been better...

[Ricardo Kirkner (ricardokirkner)]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

>> === modified file 'setup.py'
>> --- setup.py 2011-07-06 17:36:56 +0000
>> +++ setup.py 2011-07-26 07:31:31 +0000
>> @@ -39,7 +39,7 @@
>> 'NoseDjango==0.8.1',
>> 'nosexcover',
>> 'coverage==3.4',
>> - 'mock==0.6.0',
>> + 'mock==0.7.2',
>
> Why is this even in the setup.py? I thought (probably wrongly) that mock or
> nose or wsgi-intercept needed to be in the requirements.txt for setting up the dev environment,
> but not in the setup.py, as there's no need for them to be installed? I assume
> that's wrong then (on my part)? Do python packages install their test
> dependencies so they can be tested after install? (is that possible with our
> packages?)

This I can explain. These dependencies are test dependencies, and marked
so (using tests_require).

Having them marked as test dependencies, does not require you to have
them installed for running/installing your product, but allows
setuptools to look for them/install them if necessary when running your
tests via "python setup.py test".
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk4uqS0ACgkQaHF+Qaymu6cPeQCdEjUK/n0pFqSLyYugqF93ucRD
xTUAnR+O1KaXze2NtCda/rZ3n2M+iQvq
=niKk
-----END PGP SIGNATURE-----

=== modified file 'identityprovider/api10/forms.py'
--- identityprovider/api10/forms.py	2011-07-06 21:14:28 +0000
+++ identityprovider/api10/forms.py	2011-07-25 20:09:28 +0000
@@ -59,8 +59,8 @@
         remote_ip = cleaned_data['remote_ip']
 
         captcha = Captcha(captcha_id)
-
-        if captcha.verify(captcha_solution, remote_ip):
+        email = cleaned_data.get('email', '')
+        if captcha.verify(captcha_solution, remote_ip, email):
             return cleaned_data
         # not verified
         raise forms.ValidationError(_("Wrong captcha solution."))

=== modified file 'identityprovider/models/captcha.py'
--- identityprovider/models/captcha.py	2011-06-30 04:55:13 +0000
+++ identityprovider/models/captcha.py	2011-07-25 20:09:28 +0000
@@ -66,14 +66,15 @@
 
     As is verifying received solution:
 
-        >>> captcha = Captcha('captcha-id-received-from-client')
-        >>> captcha.verify("this-is-invalid-solution", ip_addr)
+        >>> email = '[e-mail]'
+        >>> captcha = Captcha('captcha-id-received-from-client', email)
+        >>> captcha.verify("this-is-invalid-solution", ip_addr, email)
         False
 
     Once verified solution is cached, so calling again to .verify() method is
     very cheap (and returns same result):
 
-        >>> captcha.verify("this-is-invalid-solution", ip_addr)
+        >>> captcha.verify("this-is-invalid-solution", ip_addr, email)
         False
 
     You can also get original response from reCaptcha:
@@ -159,7 +160,7 @@
 
         return CaptchaResponse(response.code, response, None)
 
-    def verify(self, captcha_solution, remote_ip):
+    def verify(self, captcha_solution, remote_ip, email):
         if self._verified is not None:
             return self._verified
 
@@ -167,6 +168,9 @@
             self.response = None
             return True
 
+        if self.check_whitelist(email):
+            return True
+
         if isinstance(captcha_solution, unicode):
             captcha_solution = captcha_solution.encode('utf-8')
 
@@ -190,3 +194,9 @@
             self._verified = False
             raise VerifyCaptchaError(self.response.traceback)
         return self._verified
+
+    def check_whitelist(self, email):
+        for pattern in settings.EMAIL_WHITELIST_REGEXP_LIST:
+            if re.match(pattern, email):
+                return True
+        return False

=== modified file 'identityprovider/schema.py'
--- identityprovider/schema.py	2011-07-12 09:41:08 +0000
+++ identityprovider/schema.py	2011-07-25 20:09:28 +0000
@@ -78,6 +78,9 @@
     captcha.captcha_public_key = StringConfigOption()
     captcha.captcha_private_key = StringConfigOption()
     captcha.disable_captcha_verification = BoolConfigOption()
+    captcha.email_whitelist_regexp_list = LinesConfigOption(
+        item=StringConfigOption(raw=True)
+    )
 
     # debug
     debug = ConfigSection()

=== modified file 'identityprovider/tests/test_auth.py'
--- identityprovider/tests/test_auth.py	2011-07-15 15:17:19 +0000
+++ identityprovider/tests/test_auth.py	2011-07-25 20:09:28 +0000
@@ -5,7 +5,6 @@
 from mock import (
     Mock,
     patch,
-    patch_object,
 )
 from oauth_backend.models import Consumer
 from piston.oauth import OAuthError as PistonOAuthError
@@ -171,19 +170,19 @@
 
     def test_is_authenticated_invalid_request(self):
         mock_is_valid_request = Mock(return_value=False)
-        with patch_object(self.auth, 'is_valid_request', mock_is_valid_request):
+        with patch.object(self.auth, 'is_valid_request', mock_is_valid_request):
             self.assertEqual(self.auth.is_authenticated(self.request), False)
 
     def test_is_authenticated_piston_oauth_error(self):
         mock_validate_token = Mock(side_effect=PistonOAuthError)
-        with patch_object(self.auth, 'validate_token', mock_validate_token):
+        with patch.object(self.auth, 'validate_token', mock_validate_token):
             self.assertEqual(self.auth.is_authenticated(self.request), False)
 
     def test_is_authenticated_no_consumer_token(self):
         consumer, token, params = None, None, None
         mock_validate_token = Mock(return_value=(consumer, token, params))
         # authentication fails as there is no consumer and token in the request
-        with patch_object(self.auth, 'validate_token', mock_validate_token):
+        with patch.object(self.auth, 'validate_token', mock_validate_token):
             self.assertEqual(self.auth.is_authenticated(self.request), False)
 
     @patch('identityprovider.auth.Account.objects.get')
@@ -194,7 +193,7 @@
         consumer, token, params = Mock(), Mock(), None
         # make sure validate_token returns a consumer and a token
         mock_validate_token = Mock(return_value=(consumer, token, params))
-        with patch_object(self.auth, 'validate_token', mock_validate_token):
+        with patch.object(self.auth, 'validate_token', mock_validate_token):
             self.assertEqual(self.auth.is_authenticated(self.request), False)
 
     @patch('identityprovider.auth.Account.objects.get')
@@ -206,7 +205,7 @@
         consumer, params = Mock(), None
         # make sure validate_token returns a consumer and a token
         mock_validate_token = Mock(return_value=(consumer, mock_token, params))
-        with patch_object(self.auth, 'validate_token', mock_validate_token):
+        with patch.object(self.auth, 'validate_token', mock_validate_token):
             response = self.auth.is_authenticated(self.request)
 
         self.assertEqual(response, True)

=== modified file 'identityprovider/tests/test_captcha.py'
--- identityprovider/tests/test_captcha.py	2011-07-21 16:08:06 +0000
+++ identityprovider/tests/test_captcha.py	2011-07-25 20:09:28 +0000
@@ -27,7 +27,7 @@
             captcha = Captcha(None)
             captcha._open = Mock()
             captcha._open.return_value.is_error = True
-            captcha.verify(captcha_solution, 'foobar')
+            captcha.verify(captcha_solution, 'foobar', '')
 
         captcha_response = mock_urlencode.call_args[0][0]['response']
         self.assertEqual(captcha_response, encoded_solution)
@@ -59,7 +59,7 @@
     def test_verify_is_short_circuited_when_disabled_in_settings(self):
         with patch_settings(DISABLE_CAPTCHA_VERIFICATION=True):
             captcha = Captcha('test')
-            verify_result = captcha.verify('solution', '127.0.0.1')
+            verify_result = captcha.verify('solution', '127.0.0.1', '')
 
         self.assertTrue(verify_result)
         self.assertTrue(captcha.response is None)

=== modified file 'identityprovider/tests/test_command_cleanup.py'
--- identityprovider/tests/test_command_cleanup.py	2011-07-15 11:50:53 +0000
+++ identityprovider/tests/test_command_cleanup.py	2011-07-25 20:09:28 +0000
@@ -8,7 +8,7 @@
 from django.core.management import call_command
 from django.db import connection
 from django.test import TestCase
-from mock import patch_object
+from mock import patch
 
 from identityprovider.models import OpenIDNonce
 
@@ -34,7 +34,7 @@
         self.populate()
 
         mock_stdout = StringIO()
-        with patch_object(sys, 'stdout', mock_stdout):
+        with patch.object(sys, 'stdout', mock_stdout):
             call_command('cleanup', verbosity=0)
         mock_stdout.seek(0)
         self.assertTrue('No items selected to clean up.' in mock_stdout.read())

=== modified file 'identityprovider/tests/test_forms.py'
--- identityprovider/tests/test_forms.py	2011-07-15 11:50:53 +0000
+++ identityprovider/tests/test_forms.py	2011-07-25 20:09:28 +0000
@@ -18,6 +18,7 @@
 )
 from identityprovider.api10.forms import WebserviceCreateAccountForm
 from identityprovider.models.openidmodels import OpenIDRPConfig
+from identityprovider.tests.utils import patch_settings
 
 from .utils import SSOBaseTestCase
 
@@ -114,6 +115,23 @@
         self.assertTrue(form.is_valid())
         self.assertEqual(form.cleaned_data['platform'], 'desktop')
 
+    def test_captcha_checked_for_whitelist(self):
+        data = {
+            'email': '[e-mail]',
+            'password': 'password1A',
+            'captcha_id': '1',
+            'captcha_solution': '2',
+            'remote_ip': '127.0.0.1',
+        }
+        pattern = '^canonicaltest(?:\+.+)?@gmail\.com$'
+        overrides = dict(
+            DISABLE_CAPTCHA_VERIFICATION=False,
+            EMAIL_WHITELIST_REGEXP_LIST=[pattern],
+        )
+        with patch_settings(**overrides):
+            form = WebserviceCreateAccountForm(data)
+            self.assertTrue(form.is_valid())
+
     def test_default_cleaned_validate_redirect_to(self):
         data = {
             'email': '[e-mail]',

=== modified file 'identityprovider/tests/test_models_captcha.py'
--- identityprovider/tests/test_models_captcha.py	2011-01-20 21:48:43 +0000
+++ identityprovider/tests/test_models_captcha.py	2011-07-25 20:09:28 +0000
@@ -4,7 +4,10 @@
 import unittest
 import urllib2
 
-from mock import patch_object
+from mock import (
+    Mock,
+    patch,
+)
 
 from cStringIO import StringIO
 from django.conf import settings
@@ -16,6 +19,8 @@
     VerifyCaptchaError,
 )
 
+from identityprovider.tests.utils import patch_settings
+
 
 class CaptchaResponseTestCase(unittest.TestCase):
 
@@ -37,11 +42,11 @@
 
 class CaptchaTestCase(unittest.TestCase):
 
-    @patch_object(Captcha, '_open')
+    @patch.object(Captcha, '_open')
     def test_new_captcha_error(self, mock_open):
         self.assertRaises(NewCaptchaError, Captcha.new)
 
-    @patch_object(Captcha, '_open')
+    @patch.object(Captcha, '_open')
     def test_new_captcha_no_challenge(self, mock_open):
         try:
             Captcha.new()
@@ -70,23 +75,56 @@
     def tearDown(self):
         settings.DISABLE_CAPTCHA_VERIFICATION = self.old_DISABLE_CAPTCHA_VERIFICATION
 
-    @patch_object(Captcha, '_open')
+    @patch.object(Captcha, '_open')
+    def test_verify_calls_check_whitelist(self, mock_open):
+        captcha = Captcha(None)
+        captcha.check_whitelist = Mock(return_value=False)
+
+        result = captcha.verify(None, 'localhost', 'foo')
+        self.assertFalse(result)
+        self.assertTrue(mock_open.called)
+
+        captcha.check_whitelist.assert_called_with('foo')
+
+    @patch.object(Captcha, '_open')
+    def test_check_whitelist_match(self, mock_open):
+        captcha = Captcha(None)
+
+        regexps = ['not a match', '^foo$']
+        with patch_settings(
+                EMAIL_WHITELIST_REGEXP_LIST=regexps
+            ):
+            result = captcha.verify(None, 'localhost', 'foo')
+            self.assertTrue(result)
+            self.assertFalse(mock_open.called)
+
+    @patch.object(Captcha, '_open')
+    def test_check_whitelist_no_match(self, mock_open):
+        captcha = Captcha(None)
+
+        regexps = ['not a match', '^bar$']
+        with patch_settings(
+                EMAIL_WHITELIST_REGEXP_LIST=regexps
+            ):
+            result = captcha.verify(None, 'localhost', 'foo')
+            self.assertFalse(result)
+            self.assertTrue(mock_open.called)
+
+    @patch.object(Captcha, '_open')
     def test_verify_already_verified(self, mock_open):
         c = Captcha(None)
         c._verified = True
-        r = c.verify(None, None)
+        r = c.verify(None, None, '')
         self.assertTrue(r)
 
-    @patch_object(Captcha, '_open')
+    @patch.object(Captcha, '_open')
     def test_verify_no_verification(self, mock_open):
-        settings.DISABLE_CAPTCHA_VERIFICATION = True
-
-        c = Captcha(None)
-        r = c.verify(None, None)
-        self.assertTrue(r)
-
-    @patch_object(Captcha, '_open')
-    def test_verify_response_ok(self, mock_open):
+        with patch_settings(DISABLE_CAPTCHA_VERIFICATION=True):
+            c = Captcha(None)
+            r = c.verify(None, None, '')
+            self.assertTrue(r)
+
+    def test_verify_response_ok(self):
         @classmethod
         def mock_open(cls, request):
             r = CaptchaResponse(200, StringIO('true\nok'))
@@ -94,25 +132,28 @@
         old_open = Captcha._open
         Captcha._open = mock_open
 
-        c = Captcha.new()
-        r = c.verify(None, "localhost")
-
-        self.assertTrue(r)
-        self.assertEqual(c.message, 'ok')
-
-        Captcha._open = old_open
-
-    @patch_object(Captcha, '_open')
+        try:
+            c = Captcha.new()
+            r = c.verify(None, "localhost", '')
+
+            self.assertTrue(r)
+            self.assertEqual(c.message, 'ok')
+        finally:
+            Captcha._open = old_open
+
+    @patch.object(Captcha, '_open')
     def test_verify_no_captcha_id(self, mock_open):
         c = Captcha(None)
-        r = c.verify(None, 'localhost')
+        r = c.verify(None, 'localhost', '')
 
         self.assertFalse(r)
         self.assertEqual(c.message, 'no-challenge')
 
-    @patch_object(Captcha, '_open')
+    @patch.object(Captcha, '_open')
     def test_verify_error(self, mock_open):
         c = Captcha(None)
         c.captcha_id = 'challenge-id'
 
-        self.assertRaises(VerifyCaptchaError, c.verify, None, 'localhost')
+        self.assertRaises(
+            VerifyCaptchaError, c.verify, None, 'localhost', ''
+        )

=== modified file 'identityprovider/tests/test_views_ui.py'
--- identityprovider/tests/test_views_ui.py	2011-07-19 14:21:42 +0000
+++ identityprovider/tests/test_views_ui.py	2011-07-25 20:09:28 +0000
@@ -7,7 +7,7 @@
 import urllib2
 from urlparse import urlsplit
 
-from mock import patch_object, patch
+from mock import patch
 
 from django.conf import settings
 from django.core import mail
@@ -30,6 +30,7 @@
 from identityprovider.tests.utils import (
     LPAccountTestCase,
     MockHandler,
+    patch_settings,
 )
 from identityprovider.utils import is_django_13
 
@@ -592,7 +593,7 @@
             def __init__(self, *args):
                 pass
 
-            def verify(self, solution, ip_addr):
+            def verify(self, solution, ip_addr, email):
                 self.message = 'no-challenge'
                 return False
 
@@ -635,7 +636,7 @@
             self.assertEqual(len(mail.outbox), mails_sent)
             mail.outbox = []
 
-    @patch_object(logging.Logger, 'debug')
+    @patch.object(logging.Logger, 'debug')
     def test_new_account_when_person_exists_and_account_not(self, mock_debug):
         person = Person.objects.create(displayname='Person')
         EmailAddress.objects.create(email='[e-mail]',
@@ -815,6 +816,55 @@
         msg = 'It appears that our captcha service was unable to load'
         self.assertContains(r, msg)
 
+    def test_new_account_captcha_whitelist(self):
+        email = '[e-mail]'
+        pattern = '^canonicaltest(?:\+.+)?@gmail\.com$'
+        overrides = dict(
+            DISABLE_CAPTCHA_VERIFICATION=False,
+            EMAIL_WHITELIST_REGEXP_LIST=[pattern],
+        )
+        with patch_settings(**overrides):
+            response = _post_new_account(
+                self.client,
+                email=email
+            )
+            # should redirect to '/+email-sent'
+            self.assertEqual(response.status_code, 302)
+            redirect = response['location']
+            self.assertTrue(redirect.endswith('/+email-sent'))
+
+    def test_new_account_captcha_whitelist_with_uuid(self):
+        email = '[e-mail]'
+        pattern = '^canonicaltest(?:\+.+)?@gmail\.com$'
+        overrides = dict(
+            DISABLE_CAPTCHA_VERIFICATION=False,
+            EMAIL_WHITELIST_REGEXP_LIST=[pattern],
+        )
+        with patch_settings(**overrides):
+            response = _post_new_account(
+                self.client,
+                email=email
+            )
+            # should redirect to '/+email-sent'
+            self.assertEqual(response.status_code, 302)
+            redirect = response['location']
+            self.assertTrue(redirect.endswith('/+email-sent'))
+
+    def test_new_account_captcha_whitelist_fail(self):
+        email = '[e-mail]'
+        pattern = '^canonicaltest(?:\+.+)?@gmail\.com$'
+        overrides = dict(
+            DISABLE_CAPTCHA_VERIFICATION=False,
+            EMAIL_WHITELIST_REGEXP_LIST=[pattern],
+        )
+        with patch_settings(**overrides):
+            response = _post_new_account(
+                self.client,
+                email=email
+            )
+            msg = 'It appears that our captcha service was unable to load'
+            self.assertContains(response, msg)
+
 
 class LanguagesTestCase(SSOBaseTestCase):
 

=== modified file 'identityprovider/views/ui.py'
--- identityprovider/views/ui.py	2011-07-21 16:08:06 +0000
+++ identityprovider/views/ui.py	2011-07-25 20:09:28 +0000
@@ -464,9 +464,10 @@
 def _verify_captcha_response(template, request, form):
     captcha = Captcha(request.POST.get('recaptcha_challenge_field'))
     captcha_solution = request.POST.get('recaptcha_response_field')
+    email = request.POST.get('email', '')
     ip_addr = request.environ["REMOTE_ADDR"]
     try:
-        verified = captcha.verify(captcha_solution, ip_addr)
+        verified = captcha.verify(captcha_solution, ip_addr, email)
         if verified:
             return None
     except VerifyCaptchaError, e:

=== modified file 'requirements.txt'
--- requirements.txt	2011-07-12 14:38:02 +0000
+++ requirements.txt	2011-07-25 20:09:28 +0000
@@ -6,7 +6,7 @@
 NoseDjango==0.8.1
 nosexcover
 coverage==3.4
-mock==0.6.0
+mock==0.7.2
 wsgiref==0.1.2
 wsgi-intercept==0.4
 zope.testbrowser==3.5.1

=== modified file 'setup.py'
--- setup.py	2011-07-06 17:36:56 +0000
+++ setup.py	2011-07-25 20:09:28 +0000
@@ -39,7 +39,7 @@
     'NoseDjango==0.8.1',
     'nosexcover',
     'coverage==3.4',
-    'mock==0.6.0',
+    'mock==0.7.2',
     'wsgiref==0.1.2',
     'wsgi-intercept==0.4',
     'zope.testbrowser==3.5.1',