1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
|
from django.contrib.auth.models import User
from django.contrib.flatpages.models import FlatPage
from django.contrib.sites.models import Site
from django.test import Client, TestCase, modify_settings, override_settings
from .settings import FLATPAGES_TEMPLATES
@modify_settings(INSTALLED_APPS={"append": "django.contrib.flatpages"})
@override_settings(
LOGIN_URL="/accounts/login/",
MIDDLEWARE=[
"django.middleware.common.CommonMiddleware",
"django.contrib.sessions.middleware.SessionMiddleware",
"django.middleware.csrf.CsrfViewMiddleware",
"django.contrib.auth.middleware.AuthenticationMiddleware",
"django.contrib.messages.middleware.MessageMiddleware",
"django.contrib.flatpages.middleware.FlatpageFallbackMiddleware",
],
ROOT_URLCONF="flatpages_tests.urls",
CSRF_FAILURE_VIEW="django.views.csrf.csrf_failure",
TEMPLATES=FLATPAGES_TEMPLATES,
SITE_ID=1,
)
class FlatpageCSRFTests(TestCase):
@classmethod
def setUpTestData(cls):
# don't use the manager because we want to ensure the site exists
# with pk=1, regardless of whether or not it already exists.
cls.site1 = Site(pk=1, domain="example.com", name="example.com")
cls.site1.save()
cls.fp1 = FlatPage.objects.create(
url="/flatpage/",
title="A Flatpage",
content="Isn't it flat!",
enable_comments=False,
template_name="",
registration_required=False,
)
cls.fp2 = FlatPage.objects.create(
url="/location/flatpage/",
title="A Nested Flatpage",
content="Isn't it flat and deep!",
enable_comments=False,
template_name="",
registration_required=False,
)
cls.fp3 = FlatPage.objects.create(
url="/sekrit/",
title="Sekrit Flatpage",
content="Isn't it sekrit!",
enable_comments=False,
template_name="",
registration_required=True,
)
cls.fp4 = FlatPage.objects.create(
url="/location/sekrit/",
title="Sekrit Nested Flatpage",
content="Isn't it sekrit and deep!",
enable_comments=False,
template_name="",
registration_required=True,
)
cls.fp1.sites.add(cls.site1)
cls.fp2.sites.add(cls.site1)
cls.fp3.sites.add(cls.site1)
cls.fp4.sites.add(cls.site1)
def setUp(self):
self.client = Client(enforce_csrf_checks=True)
def test_view_flatpage(self):
"A flatpage can be served through a view, even when the middleware is in use"
response = self.client.get("/flatpage_root/flatpage/")
self.assertContains(response, "<p>Isn't it flat!</p>")
def test_view_non_existent_flatpage(self):
"""
A nonexistent flatpage raises 404 when served through a view, even when
the middleware is in use.
"""
response = self.client.get("/flatpage_root/no_such_flatpage/")
self.assertEqual(response.status_code, 404)
def test_view_authenticated_flatpage(self):
"A flatpage served through a view can require authentication"
response = self.client.get("/flatpage_root/sekrit/")
self.assertRedirects(response, "/accounts/login/?next=/flatpage_root/sekrit/")
user = User.objects.create_user("testuser", "test@example.com", "s3krit")
self.client.force_login(user)
response = self.client.get("/flatpage_root/sekrit/")
self.assertContains(response, "<p>Isn't it sekrit!</p>")
def test_fallback_flatpage(self):
"A flatpage can be served by the fallback middleware"
response = self.client.get("/flatpage/")
self.assertContains(response, "<p>Isn't it flat!</p>")
def test_fallback_non_existent_flatpage(self):
"""
A nonexistent flatpage raises a 404 when served by the fallback
middleware.
"""
response = self.client.get("/no_such_flatpage/")
self.assertEqual(response.status_code, 404)
def test_post_view_flatpage(self):
"""
POSTing to a flatpage served through a view will raise a CSRF error if
no token is provided.
"""
response = self.client.post("/flatpage_root/flatpage/")
self.assertEqual(response.status_code, 403)
def test_post_fallback_flatpage(self):
"""
POSTing to a flatpage served by the middleware will raise a CSRF error
if no token is provided.
"""
response = self.client.post("/flatpage/")
self.assertEqual(response.status_code, 403)
def test_post_unknown_page(self):
"POSTing to an unknown page isn't caught as a 403 CSRF error"
response = self.client.post("/no_such_page/")
self.assertEqual(response.status_code, 404)
|
