← Back to branch summary

~ubuntu-branches/ubuntu/quantal/python-django/quantal

« back to all changes in this revision

Viewing changes to django/contrib/flatpages/tests/csrf.py

  • Committer: Bazaar Package Importer
  • Author(s): Jamie Strandboge
  • Date: 2010-10-12 11:34:35 UTC
  • mfrom: (1.1.12 upstream) (29.1.1 maverick-security)
  • Revision ID: james.westby@ubuntu.com-20101012113435-yy57c8tx6g9anf3e
Tags: 1.2.3-1ubuntu0.1
* SECURITY UPDATE: XSS in CSRF protections. New upstream release
  - CVE-2010-3082
* debian/patches/01_disable_url_verify_regression_tests.diff:
  - updated to disable another test that fails without internet connection
  - patch based on work by Kai Kasurinen and Krzysztof Klimonda
* debian/control: don't Build-Depends on locales-all, which doesn't exist
  in maverick

Show diffs side-by-side

added added

removed removed

Lines of Context:
django/contrib/flatpages/tests/csrf.py
 
1
import os
 
2
from django.conf import settings
 
3
from django.test import TestCase, Client
 
4
 
 
5
class FlatpageCSRFTests(TestCase):
 
6
    fixtures = ['sample_flatpages']
 
7
    urls = 'django.contrib.flatpages.tests.urls'
 
8
 
 
9
    def setUp(self):
 
10
        self.client = Client(enforce_csrf_checks=True)
 
11
        self.old_MIDDLEWARE_CLASSES = settings.MIDDLEWARE_CLASSES
 
12
        flatpage_middleware_class = 'django.contrib.flatpages.middleware.FlatpageFallbackMiddleware'
 
13
        csrf_middleware_class = 'django.middleware.csrf.CsrfViewMiddleware'
 
14
        if csrf_middleware_class not in settings.MIDDLEWARE_CLASSES:
 
15
            settings.MIDDLEWARE_CLASSES += (csrf_middleware_class,)
 
16
        if flatpage_middleware_class not in settings.MIDDLEWARE_CLASSES:
 
17
            settings.MIDDLEWARE_CLASSES += (flatpage_middleware_class,)
 
18
        self.old_TEMPLATE_DIRS = settings.TEMPLATE_DIRS
 
19
        settings.TEMPLATE_DIRS = (
 
20
            os.path.join(
 
21
                os.path.dirname(__file__),
 
22
                'templates'
 
23
            ),
 
24
        )
 
25
 
 
26
    def tearDown(self):
 
27
        settings.MIDDLEWARE_CLASSES = self.old_MIDDLEWARE_CLASSES
 
28
        settings.TEMPLATE_DIRS = self.old_TEMPLATE_DIRS
 
29
 
 
30
    def test_view_flatpage(self):
 
31
        "A flatpage can be served through a view, even when the middleware is in use"
 
32
        response = self.client.get('/flatpage_root/flatpage/')
 
33
        self.assertEquals(response.status_code, 200)
 
34
        self.assertContains(response, "<p>Isn't it flat!</p>")
 
35
 
 
36
    def test_view_non_existent_flatpage(self):
 
37
        "A non-existent flatpage raises 404 when served through a view, even when the middleware is in use"
 
38
        response = self.client.get('/flatpage_root/no_such_flatpage/')
 
39
        self.assertEquals(response.status_code, 404)
 
40
 
 
41
    def test_view_authenticated_flatpage(self):
 
42
        "A flatpage served through a view can require authentication"
 
43
        response = self.client.get('/flatpage_root/sekrit/')
 
44
        self.assertRedirects(response, '/accounts/login/?next=/flatpage_root/sekrit/')
 
45
 
 
46
    def test_fallback_flatpage(self):
 
47
        "A flatpage can be served by the fallback middlware"
 
48
        response = self.client.get('/flatpage/')
 
49
        self.assertEquals(response.status_code, 200)
 
50
        self.assertContains(response, "<p>Isn't it flat!</p>")
 
51
 
 
52
    def test_fallback_non_existent_flatpage(self):
 
53
        "A non-existent flatpage raises a 404 when served by the fallback middlware"
 
54
        response = self.client.get('/no_such_flatpage/')
 
55
        self.assertEquals(response.status_code, 404)
 
56
 
 
57
    def test_post_view_flatpage(self):
 
58
        "POSTing to a flatpage served through a view will raise a CSRF error if no token is provided (Refs #14156)"
 
59
        response = self.client.post('/flatpage_root/flatpage/')
 
60
        self.assertEquals(response.status_code, 403)
 
61
 
 
62
    def test_post_fallback_flatpage(self):
 
63
        "POSTing to a flatpage served by the middleware will raise a CSRF error if no token is provided (Refs #14156)"
 
64
        response = self.client.post('/flatpage/')
 
65
        self.assertEquals(response.status_code, 403)
 
66
 
 
67
    def test_post_unknown_page(self):
 
68
        "POSTing to an unknown page isn't caught as a 403 CSRF error"
 
69
        response = self.client.post('/no_such_page/')
 
70
        self.assertEquals(response.status_code, 404)