← Back to branch summary

~ubuntu-branches/debian/sid/python-django/sid

« back to all changes in this revision

Viewing changes to tests/admin_views/tests.py

  • Committer: Package Import Robot
  • Author(s): Luke Faraone
  • Date: 2014-04-21 16:47:14 UTC
  • mfrom: (1.3.14)
  • Revision ID: package-import@ubuntu.com-20140421164714-3mlvyr7y1ssdo9e6
Tags: 1.6.3-1
* New upstream security release.
  - Unexpected code execution using ``reverse()``
  - CVE-2014-0472
  - Caching of anonymous pages could reveal CSRF token
  - CVE-2014-0473
  - MySQL typecasting could result in unexpected matches
  - CVE-2014-0474
* Drop patches 07_translation_encoding_fix and ticket21869.diff; merged
  upstream

Show diffs side-by-side

added added

removed removed

Lines of Context:
tests/admin_views/tests.py
9
9
from django.core import mail
10
10
from django.core.exceptions import ImproperlyConfigured
11
11
from django.core.files import temp as tempfile
12
 
from django.core.urlresolvers import reverse
 
12
from django.core.urlresolvers import get_script_prefix, reverse, set_script_prefix
13
13
# Register auth models with the admin.
14
14
from django.contrib import admin
15
15
from django.contrib.auth import get_permission_codename
16
16
from django.contrib.admin.helpers import ACTION_CHECKBOX_NAME
17
17
from django.contrib.admin.models import LogEntry, DELETION
18
18
from django.contrib.admin.sites import LOGIN_FORM_KEY
 
19
from django.contrib.admin.templatetags.admin_urls import add_preserved_filters
 
20
from django.contrib.admin.tests import AdminSeleniumWebDriverTestCase
19
21
from django.contrib.admin.util import quote
20
22
from django.contrib.admin.validation import ModelAdminValidator
21
23
from django.contrib.admin.views.main import IS_POPUP_VAR
22
 
from django.contrib.admin.tests import AdminSeleniumWebDriverTestCase
23
24
from django.contrib.auth import REDIRECT_FIELD_NAME
24
25
from django.contrib.auth.models import Group, User, Permission
25
26
from django.contrib.contenttypes.models import ContentType
33
34
from django.utils import translation
34
35
from django.utils import unittest
35
36
from django.utils.cache import get_max_age
36
 
from django.utils.encoding import iri_to_uri, force_bytes
 
37
from django.utils.encoding import iri_to_uri, force_bytes, force_text
37
38
from django.utils.html import escape
38
39
from django.utils.http import urlencode, urlquote
39
 
from django.utils.six.moves.urllib.parse import urljoin
 
40
from django.utils.six.moves.urllib.parse import parse_qsl, urljoin, urlparse
40
41
from django.utils._os import upath
41
42
from django.utils import six
42
43
 
4224
4225
    def tearDown(self):
4225
4226
        self.client.logout()
4226
4227
 
4227
 
    def get_changelist_filters_querystring(self):
4228
 
        return urlencode({
 
4228
    def assertURLEqual(self, url1, url2):
 
4229
        """
 
4230
        Assert that two URLs are equal despite the ordering
 
4231
        of their querystring. Refs #22360.
 
4232
        """
 
4233
        parsed_url1 = urlparse(url1)
 
4234
        path1 = parsed_url1.path
 
4235
        parsed_qs1 = dict(parse_qsl(parsed_url1.query))
 
4236
 
 
4237
        parsed_url2 = urlparse(url2)
 
4238
        path2 = parsed_url2.path
 
4239
        parsed_qs2 = dict(parse_qsl(parsed_url2.query))
 
4240
 
 
4241
        for parsed_qs in [parsed_qs1, parsed_qs2]:
 
4242
            if '_changelist_filters' in parsed_qs:
 
4243
                changelist_filters = parsed_qs['_changelist_filters']
 
4244
                parsed_filters = dict(parse_qsl(changelist_filters))
 
4245
                parsed_qs['_changelist_filters'] = parsed_filters
 
4246
 
 
4247
        self.assertEqual(path1, path2)
 
4248
        self.assertEqual(parsed_qs1, parsed_qs2)
 
4249
 
 
4250
    def test_assert_url_equal(self):
 
4251
        # Test equality.
 
4252
        self.assertURLEqual(
 
4253
            'http://testserver/test_admin/admin/auth/user/105/?_changelist_filters=is_staff__exact%3D0%26is_superuser__exact%3D0',
 
4254
            'http://testserver/test_admin/admin/auth/user/105/?_changelist_filters=is_staff__exact%3D0%26is_superuser__exact%3D0'
 
4255
        )
 
4256
 
 
4257
        # Test inequality.
 
4258
        with self.assertRaises(AssertionError):
 
4259
            self.assertURLEqual(
 
4260
                'http://testserver/test_admin/admin/auth/user/105/?_changelist_filters=is_staff__exact%3D0%26is_superuser__exact%3D0',
 
4261
                'http://testserver/test_admin/admin/auth/user/105/?_changelist_filters=is_staff__exact%3D1%26is_superuser__exact%3D1'
 
4262
            )
 
4263
 
 
4264
        # Ignore scheme and host.
 
4265
        self.assertURLEqual(
 
4266
            'http://testserver/test_admin/admin/auth/user/105/?_changelist_filters=is_staff__exact%3D0%26is_superuser__exact%3D0',
 
4267
            '/test_admin/admin/auth/user/105/?_changelist_filters=is_staff__exact%3D0%26is_superuser__exact%3D0'
 
4268
        )
 
4269
 
 
4270
        # Ignore ordering of querystring.
 
4271
        self.assertURLEqual(
 
4272
            '/test_admin/admin/auth/user/?is_staff__exact=0&is_superuser__exact=0',
 
4273
            '/test_admin/admin/auth/user/?is_superuser__exact=0&is_staff__exact=0'
 
4274
        )
 
4275
 
 
4276
        # Ignore ordering of _changelist_filters.
 
4277
        self.assertURLEqual(
 
4278
            '/test_admin/admin/auth/user/105/?_changelist_filters=is_staff__exact%3D0%26is_superuser__exact%3D0',
 
4279
            '/test_admin/admin/auth/user/105/?_changelist_filters=is_superuser__exact%3D0%26is_staff__exact%3D0'
 
4280
        )
 
4281
 
 
4282
    def get_changelist_filters(self):
 
4283
        return {
4229
4284
            'is_superuser__exact': 0,
4230
4285
            'is_staff__exact': 0,
4231
 
        })
 
4286
        }
 
4287
 
 
4288
    def get_changelist_filters_querystring(self):
 
4289
        return urlencode(self.get_changelist_filters())
4232
4290
 
4233
4291
    def get_preserved_filters_querystring(self):
4234
4292
        return urlencode({
4284
4342
        self.assertEqual(response.status_code, 200)
4285
4343
 
4286
4344
        # Check the `change_view` link has the correct querystring.
4287
 
        detail_link = """<a href="%s">joepublic</a>""" % self.get_change_url()
4288
 
        self.assertContains(response, detail_link, count=1)
 
4345
        detail_link = re.search(
 
4346
            '<a href="(.*?)">joepublic</a>',
 
4347
            force_text(response.content)
 
4348
        )
 
4349
        self.assertURLEqual(detail_link.group(1), self.get_change_url())
4289
4350
 
4290
4351
    def test_change_view(self):
4291
4352
        # Get the `change_view`.
4293
4354
        self.assertEqual(response.status_code, 200)
4294
4355
 
4295
4356
        # Check the form action.
4296
 
        form_action = """<form enctype="multipart/form-data" action="?%s" method="post" id="user_form">""" % self.get_preserved_filters_querystring()
4297
 
        self.assertContains(response, form_action, count=1)
 
4357
        form_action = re.search(
 
4358
            '<form enctype="multipart/form-data" action="(.*?)" method="post" id="user_form".*?>',
 
4359
            force_text(response.content)
 
4360
        )
 
4361
        self.assertURLEqual(form_action.group(1), '?%s' % self.get_preserved_filters_querystring())
4298
4362
 
4299
4363
        # Check the history link.
4300
 
        history_link = """<a href="%s" class="historylink">History</a>""" % self.get_history_url()
4301
 
        self.assertContains(response, history_link, count=1)
 
4364
        history_link = re.search(
 
4365
            '<a href="(.*?)" class="historylink">History</a>',
 
4366
            force_text(response.content)
 
4367
        )
 
4368
        self.assertURLEqual(history_link.group(1), self.get_history_url())
4302
4369
 
4303
4370
        # Check the delete link.
4304
 
        delete_link = """<a href="%s" class="deletelink">Delete</a>""" % (self.get_delete_url())
4305
 
        self.assertContains(response, delete_link, count=1)
 
4371
        delete_link = re.search(
 
4372
            '<a href="(.*?)" class="deletelink">Delete</a>',
 
4373
            force_text(response.content)
 
4374
        )
 
4375
        self.assertURLEqual(delete_link.group(1), self.get_delete_url())
4306
4376
 
4307
4377
        # Test redirect on "Save".
4308
4378
        post_data = {
4315
4385
 
4316
4386
        post_data['_save'] = 1
4317
4387
        response = self.client.post(self.get_change_url(), data=post_data)
4318
 
        self.assertRedirects(response, self.get_changelist_url())
 
4388
        self.assertEqual(response.status_code, 302)
 
4389
        self.assertURLEqual(
 
4390
            response.url,
 
4391
            self.get_changelist_url()
 
4392
        )
4319
4393
        post_data.pop('_save')
4320
4394
 
4321
4395
        # Test redirect on "Save and continue".
4322
4396
        post_data['_continue'] = 1
4323
4397
        response = self.client.post(self.get_change_url(), data=post_data)
4324
 
        self.assertRedirects(response, self.get_change_url())
 
4398
        self.assertEqual(response.status_code, 302)
 
4399
        self.assertURLEqual(
 
4400
            response.url,
 
4401
            self.get_change_url()
 
4402
        )
4325
4403
        post_data.pop('_continue')
4326
4404
 
4327
4405
        # Test redirect on "Save and add new".
4328
4406
        post_data['_addanother'] = 1
4329
4407
        response = self.client.post(self.get_change_url(), data=post_data)
4330
 
        self.assertRedirects(response, self.get_add_url())
 
4408
        self.assertEqual(response.status_code, 302)
 
4409
        self.assertURLEqual(
 
4410
            response.url,
 
4411
            self.get_add_url()
 
4412
        )
4331
4413
        post_data.pop('_addanother')
4332
4414
 
4333
4415
    def test_add_view(self):
4336
4418
        self.assertEqual(response.status_code, 200)
4337
4419
 
4338
4420
        # Check the form action.
4339
 
        form_action = """<form enctype="multipart/form-data" action="?%s" method="post" id="user_form">""" % self.get_preserved_filters_querystring()
4340
 
        self.assertContains(response, form_action, count=1)
 
4421
        form_action = re.search(
 
4422
            '<form enctype="multipart/form-data" action="(.*?)" method="post" id="user_form".*?>',
 
4423
            force_text(response.content)
 
4424
        )
 
4425
        self.assertURLEqual(form_action.group(1), '?%s' % self.get_preserved_filters_querystring())
4341
4426
 
4342
 
        # Test redirect on "Save".
4343
4427
        post_data = {
4344
4428
            'username': 'dummy',
4345
4429
            'password1': 'test',
4346
4430
            'password2': 'test',
4347
4431
        }
4348
4432
 
 
4433
        # Test redirect on "Save".
4349
4434
        post_data['_save'] = 1
4350
4435
        response = self.client.post(self.get_add_url(), data=post_data)
4351
 
        self.assertRedirects(response, self.get_change_url(User.objects.latest('pk').pk))
 
4436
        self.assertEqual(response.status_code, 302)
 
4437
        self.assertURLEqual(
 
4438
            response.url,
 
4439
            self.get_change_url(User.objects.latest('pk').pk)
 
4440
        )
4352
4441
        post_data.pop('_save')
4353
4442
 
4354
4443
        # Test redirect on "Save and continue".
4355
4444
        post_data['username'] = 'dummy2'
4356
4445
        post_data['_continue'] = 1
4357
4446
        response = self.client.post(self.get_add_url(), data=post_data)
4358
 
        self.assertRedirects(response, self.get_change_url(User.objects.latest('pk').pk))
 
4447
        self.assertEqual(response.status_code, 302)
 
4448
        self.assertURLEqual(
 
4449
            response.url,
 
4450
            self.get_change_url(User.objects.latest('pk').pk)
 
4451
        )
4359
4452
        post_data.pop('_continue')
4360
4453
 
4361
4454
        # Test redirect on "Save and add new".
4362
4455
        post_data['username'] = 'dummy3'
4363
4456
        post_data['_addanother'] = 1
4364
4457
        response = self.client.post(self.get_add_url(), data=post_data)
4365
 
        self.assertRedirects(response, self.get_add_url())
 
4458
        self.assertEqual(response.status_code, 302)
 
4459
        self.assertURLEqual(
 
4460
            response.url,
 
4461
            self.get_add_url()
 
4462
        )
4366
4463
        post_data.pop('_addanother')
4367
4464
 
4368
4465
    def test_delete_view(self):
4369
4466
        # Test redirect on "Delete".
4370
4467
        response = self.client.post(self.get_delete_url(), {'post': 'yes'})
4371
 
        self.assertRedirects(response, self.get_changelist_url())
 
4468
        self.assertEqual(response.status_code, 302)
 
4469
        self.assertURLEqual(
 
4470
            response.url,
 
4471
            self.get_changelist_url()
 
4472
        )
 
4473
 
 
4474
    def test_url_prefix(self):
 
4475
        context = {
 
4476
            'preserved_filters': self.get_preserved_filters_querystring(),
 
4477
            'opts': User._meta,
 
4478
        }
 
4479
 
 
4480
        url = reverse('admin:auth_user_changelist', current_app=self.admin_site.name)
 
4481
        self.assertURLEqual(
 
4482
            self.get_changelist_url(),
 
4483
            add_preserved_filters(context, url),
 
4484
        )
 
4485
 
 
4486
        original_prefix = get_script_prefix()
 
4487
        try:
 
4488
            set_script_prefix('/prefix/')
 
4489
            url = reverse('admin:auth_user_changelist', current_app=self.admin_site.name)
 
4490
            self.assertURLEqual(
 
4491
                self.get_changelist_url(),
 
4492
                add_preserved_filters(context, url),
 
4493
            )
 
4494
        finally:
 
4495
            set_script_prefix(original_prefix)
 
4496
 
4372
4497
 
4373
4498
class NamespacedAdminKeepChangeListFiltersTests(AdminKeepChangeListFiltersTests):
4374
4499
    admin_site = site2