Merge 95e00c5 into 111dfa4

invenio_oauth2server/forms.py

@@ -1,7 +1,7 @@
 # -*- coding: utf-8 -*-
 #
 # This file is part of Invenio.
-# Copyright (C) 2014, 2015, 2016 CERN.
+# Copyright (C) 2014, 2015, 2016, 2018 CERN.
 #
 # Invenio is free software; you can redistribute it
 # and/or modify it under the terms of the GNU General Public License as
@@ -169,8 +169,14 @@ class TokenForm(Form):
 
     name = fields.StringField(
         description=_('Name of personal access token.'),
-        validators=[validators.DataRequired()],
+        validators=[
+            validators.DataRequired(),
+            validators.Length(
+                max=40,
+                message=_('The name must be less than 40 characters long.'))
+        ]
     )
+
     scopes = fields.SelectMultipleField(
         widget=scopes_multi_checkbox,
         choices=[],  # Must be dynamically provided in view.

tests/test_settings.py

@@ -1,7 +1,7 @@
 # -*- coding: utf-8 -*-
 #
 # This file is part of Invenio.
-# Copyright (C) 2015, 2016 CERN.
+# Copyright (C) 2015, 2016, 2018 CERN.
 #
 # Invenio is free software; you can redistribute it
 # and/or modify it under the terms of the GNU General Public License as
@@ -54,6 +54,17 @@ def test_personal_token_management(settings_fixture):
             resp.status_code == 200
             assert _('New personal access token') in str(resp.get_data())
 
+            # Create a new token with invalid form data
+            resp = client.post(
+                url_for('invenio_oauth2server_settings.token_new'),
+                data={
+                    'name': 'x' * (40 + 1),  # max length is 40
+                },
+                follow_redirects=True
+            )
+            assert resp.status_code == 200
+            assert 'name must be less than 40 char' in str(resp.get_data())
+
             # Create a new token
             resp = client.post(
                 url_for('invenio_oauth2server_settings.token_new'),