/django/contrib/flatpages/tests/csrf.py
Python | 79 lines | 68 code | 11 blank | 0 comment | 2 complexity | 7c3808913d1979f43f8c42efa9b7e11f MD5 | raw file
Possible License(s): BSD-3-Clause
- import os
- from django.conf import settings
- from django.contrib.auth.models import User
- from django.test import TestCase, Client
- class FlatpageCSRFTests(TestCase):
- fixtures = ['sample_flatpages']
- urls = 'django.contrib.flatpages.tests.urls'
- def setUp(self):
- self.client = Client(enforce_csrf_checks=True)
- self.old_MIDDLEWARE_CLASSES = settings.MIDDLEWARE_CLASSES
- flatpage_middleware_class = 'django.contrib.flatpages.middleware.FlatpageFallbackMiddleware'
- csrf_middleware_class = 'django.middleware.csrf.CsrfViewMiddleware'
- if csrf_middleware_class not in settings.MIDDLEWARE_CLASSES:
- settings.MIDDLEWARE_CLASSES += (csrf_middleware_class,)
- if flatpage_middleware_class not in settings.MIDDLEWARE_CLASSES:
- settings.MIDDLEWARE_CLASSES += (flatpage_middleware_class,)
- self.old_TEMPLATE_DIRS = settings.TEMPLATE_DIRS
- settings.TEMPLATE_DIRS = (
- os.path.join(
- os.path.dirname(__file__),
- 'templates'
- ),
- )
- self.old_LOGIN_URL = settings.LOGIN_URL
- settings.LOGIN_URL = '/accounts/login/'
- def tearDown(self):
- settings.MIDDLEWARE_CLASSES = self.old_MIDDLEWARE_CLASSES
- settings.TEMPLATE_DIRS = self.old_TEMPLATE_DIRS
- settings.LOGIN_URL = self.old_LOGIN_URL
- def test_view_flatpage(self):
- "A flatpage can be served through a view, even when the middleware is in use"
- response = self.client.get('/flatpage_root/flatpage/')
- self.assertEqual(response.status_code, 200)
- self.assertContains(response, "<p>Isn't it flat!</p>")
- def test_view_non_existent_flatpage(self):
- "A non-existent flatpage raises 404 when served through a view, even when the middleware is in use"
- response = self.client.get('/flatpage_root/no_such_flatpage/')
- self.assertEqual(response.status_code, 404)
- def test_view_authenticated_flatpage(self):
- "A flatpage served through a view can require authentication"
- response = self.client.get('/flatpage_root/sekrit/')
- self.assertRedirects(response, '/accounts/login/?next=/flatpage_root/sekrit/')
- User.objects.create_user('testuser', 'test@example.com', 's3krit')
- self.client.login(username='testuser',password='s3krit')
- response = self.client.get('/flatpage_root/sekrit/')
- self.assertEqual(response.status_code, 200)
- self.assertContains(response, "<p>Isn't it sekrit!</p>")
- def test_fallback_flatpage(self):
- "A flatpage can be served by the fallback middlware"
- response = self.client.get('/flatpage/')
- self.assertEqual(response.status_code, 200)
- self.assertContains(response, "<p>Isn't it flat!</p>")
- def test_fallback_non_existent_flatpage(self):
- "A non-existent flatpage raises a 404 when served by the fallback middlware"
- response = self.client.get('/no_such_flatpage/')
- self.assertEqual(response.status_code, 404)
- def test_post_view_flatpage(self):
- "POSTing to a flatpage served through a view will raise a CSRF error if no token is provided (Refs #14156)"
- response = self.client.post('/flatpage_root/flatpage/')
- self.assertEqual(response.status_code, 403)
- def test_post_fallback_flatpage(self):
- "POSTing to a flatpage served by the middleware will raise a CSRF error if no token is provided (Refs #14156)"
- response = self.client.post('/flatpage/')
- self.assertEqual(response.status_code, 403)
- def test_post_unknown_page(self):
- "POSTing to an unknown page isn't caught as a 403 CSRF error"
- response = self.client.post('/no_such_page/')
- self.assertEqual(response.status_code, 404)