2009-05-13 05:54:58 +08:00
|
|
|
import unittest
|
2008-07-19 09:22:26 +08:00
|
|
|
from django import forms
|
2009-05-13 05:54:58 +08:00
|
|
|
from django.contrib.formtools import preview, wizard, utils
|
2007-11-30 00:32:23 +08:00
|
|
|
from django import http
|
|
|
|
from django.test import TestCase
|
|
|
|
|
|
|
|
success_string = "Done was called!"
|
|
|
|
|
|
|
|
class TestFormPreview(preview.FormPreview):
|
|
|
|
|
|
|
|
def done(self, request, cleaned_data):
|
|
|
|
return http.HttpResponse(success_string)
|
|
|
|
|
|
|
|
class TestForm(forms.Form):
|
|
|
|
field1 = forms.CharField()
|
|
|
|
field1_ = forms.CharField()
|
2008-08-27 04:19:12 +08:00
|
|
|
bool1 = forms.BooleanField(required=False)
|
2007-11-30 00:32:23 +08:00
|
|
|
|
|
|
|
class PreviewTests(TestCase):
|
2008-06-30 20:34:29 +08:00
|
|
|
urls = 'django.contrib.formtools.test_urls'
|
2007-11-30 00:32:23 +08:00
|
|
|
|
|
|
|
def setUp(self):
|
|
|
|
# Create a FormPreview instance to share between tests
|
|
|
|
self.preview = preview.FormPreview(TestForm)
|
|
|
|
input_template = '<input type="hidden" name="%s" value="%s" />'
|
|
|
|
self.input = input_template % (self.preview.unused_name('stage'), "%d")
|
2008-08-27 04:19:12 +08:00
|
|
|
self.test_data = {'field1':u'foo', 'field1_':u'asdf'}
|
2007-11-30 00:32:23 +08:00
|
|
|
|
|
|
|
def test_unused_name(self):
|
|
|
|
"""
|
|
|
|
Verifies name mangling to get uniue field name.
|
|
|
|
"""
|
|
|
|
self.assertEqual(self.preview.unused_name('field1'), 'field1__')
|
|
|
|
|
|
|
|
def test_form_get(self):
|
|
|
|
"""
|
|
|
|
Test contrib.formtools.preview form retrieval.
|
|
|
|
|
|
|
|
Use the client library to see if we can sucessfully retrieve
|
|
|
|
the form (mostly testing the setup ROOT_URLCONF
|
|
|
|
process). Verify that an additional hidden input field
|
|
|
|
is created to manage the stage.
|
|
|
|
|
|
|
|
"""
|
|
|
|
response = self.client.get('/test1/')
|
|
|
|
stage = self.input % 1
|
|
|
|
self.assertContains(response, stage, 1)
|
|
|
|
|
|
|
|
def test_form_preview(self):
|
|
|
|
"""
|
|
|
|
Test contrib.formtools.preview form preview rendering.
|
|
|
|
|
|
|
|
Use the client library to POST to the form to see if a preview
|
|
|
|
is returned. If we do get a form back check that the hidden
|
|
|
|
value is correctly managing the state of the form.
|
|
|
|
|
|
|
|
"""
|
|
|
|
# Pass strings for form submittal and add stage variable to
|
|
|
|
# show we previously saw first stage of the form.
|
2008-08-27 04:19:12 +08:00
|
|
|
self.test_data.update({'stage': 1})
|
|
|
|
response = self.client.post('/test1/', self.test_data)
|
2007-11-30 00:32:23 +08:00
|
|
|
# Check to confirm stage is set to 2 in output form.
|
|
|
|
stage = self.input % 2
|
|
|
|
self.assertContains(response, stage, 1)
|
|
|
|
|
|
|
|
def test_form_submit(self):
|
|
|
|
"""
|
|
|
|
Test contrib.formtools.preview form submittal.
|
|
|
|
|
|
|
|
Use the client library to POST to the form with stage set to 3
|
|
|
|
to see if our forms done() method is called. Check first
|
|
|
|
without the security hash, verify failure, retry with security
|
|
|
|
hash and verify sucess.
|
|
|
|
|
|
|
|
"""
|
|
|
|
# Pass strings for form submittal and add stage variable to
|
|
|
|
# show we previously saw first stage of the form.
|
2008-08-27 04:19:12 +08:00
|
|
|
self.test_data.update({'stage':2})
|
|
|
|
response = self.client.post('/test1/', self.test_data)
|
2007-11-30 00:32:23 +08:00
|
|
|
self.failIfEqual(response.content, success_string)
|
2008-08-27 04:19:12 +08:00
|
|
|
hash = self.preview.security_hash(None, TestForm(self.test_data))
|
|
|
|
self.test_data.update({'hash': hash})
|
|
|
|
response = self.client.post('/test1/', self.test_data)
|
|
|
|
self.assertEqual(response.content, success_string)
|
|
|
|
|
|
|
|
def test_bool_submit(self):
|
|
|
|
"""
|
|
|
|
Test contrib.formtools.preview form submittal when form contains:
|
|
|
|
BooleanField(required=False)
|
|
|
|
|
|
|
|
Ticket: #6209 - When an unchecked BooleanField is previewed, the preview
|
|
|
|
form's hash would be computed with no value for ``bool1``. However, when
|
|
|
|
the preview form is rendered, the unchecked hidden BooleanField would be
|
|
|
|
rendered with the string value 'False'. So when the preview form is
|
|
|
|
resubmitted, the hash would be computed with the value 'False' for
|
|
|
|
``bool1``. We need to make sure the hashes are the same in both cases.
|
|
|
|
|
|
|
|
"""
|
|
|
|
self.test_data.update({'stage':2})
|
|
|
|
hash = self.preview.security_hash(None, TestForm(self.test_data))
|
|
|
|
self.test_data.update({'hash':hash, 'bool1':u'False'})
|
|
|
|
response = self.client.post('/test1/', self.test_data)
|
2007-11-30 00:32:23 +08:00
|
|
|
self.assertEqual(response.content, success_string)
|
|
|
|
|
2009-05-13 05:54:58 +08:00
|
|
|
class SecurityHashTests(unittest.TestCase):
|
|
|
|
|
|
|
|
def test_textfield_hash(self):
|
|
|
|
"""
|
|
|
|
Regression test for #10034: the hash generation function should ignore
|
|
|
|
leading/trailing whitespace so as to be friendly to broken browsers that
|
|
|
|
submit it (usually in textareas).
|
|
|
|
"""
|
2009-05-13 06:02:38 +08:00
|
|
|
f1 = HashTestForm({'name': 'joe', 'bio': 'Nothing notable.'})
|
|
|
|
f2 = HashTestForm({'name': ' joe', 'bio': 'Nothing notable. '})
|
|
|
|
hash1 = utils.security_hash(None, f1)
|
|
|
|
hash2 = utils.security_hash(None, f2)
|
|
|
|
self.assertEqual(hash1, hash2)
|
2009-05-13 05:54:58 +08:00
|
|
|
|
2009-05-13 06:02:38 +08:00
|
|
|
def test_empty_permitted(self):
|
|
|
|
"""
|
|
|
|
Regression test for #10643: the security hash should allow forms with
|
|
|
|
empty_permitted = True, or forms where data has not changed.
|
|
|
|
"""
|
|
|
|
f1 = HashTestBlankForm({})
|
|
|
|
f2 = HashTestForm({}, empty_permitted=True)
|
2009-05-13 05:54:58 +08:00
|
|
|
hash1 = utils.security_hash(None, f1)
|
|
|
|
hash2 = utils.security_hash(None, f2)
|
|
|
|
self.assertEqual(hash1, hash2)
|
|
|
|
|
2009-05-13 06:02:38 +08:00
|
|
|
class HashTestForm(forms.Form):
|
|
|
|
name = forms.CharField()
|
|
|
|
bio = forms.CharField()
|
|
|
|
|
|
|
|
class HashTestBlankForm(forms.Form):
|
|
|
|
name = forms.CharField(required=False)
|
|
|
|
bio = forms.CharField(required=False)
|
|
|
|
|
2008-08-27 05:33:56 +08:00
|
|
|
#
|
|
|
|
# FormWizard tests
|
|
|
|
#
|
|
|
|
|
|
|
|
class WizardPageOneForm(forms.Form):
|
|
|
|
field = forms.CharField()
|
|
|
|
|
|
|
|
class WizardPageTwoForm(forms.Form):
|
|
|
|
field = forms.CharField()
|
|
|
|
|
|
|
|
class WizardClass(wizard.FormWizard):
|
|
|
|
def render_template(self, *args, **kw):
|
Fixed #9977 - CsrfMiddleware gets template tag added, session dependency removed, and turned on by default.
This is a large change to CSRF protection for Django. It includes:
* removing the dependency on the session framework.
* deprecating CsrfResponseMiddleware, and replacing with a core template tag.
* turning on CSRF protection by default by adding CsrfViewMiddleware to
the default value of MIDDLEWARE_CLASSES.
* protecting all contrib apps (whatever is in settings.py)
using a decorator.
For existing users of the CSRF functionality, it should be a seamless update,
but please note that it includes DEPRECATION of features in Django 1.1,
and there are upgrade steps which are detailed in the docs.
Many thanks to 'Glenn' and 'bthomas', who did a lot of the thinking and work
on the patch, and to lots of other people including Simon Willison and
Russell Keith-Magee who refined the ideas.
Details of the rationale for these changes is found here:
http://code.djangoproject.com/wiki/CsrfProtection
As of this commit, the CSRF code is mainly in 'contrib'. The code will be
moved to core in a separate commit, to make the changeset as readable as
possible.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11660 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-27 07:23:07 +08:00
|
|
|
return http.HttpResponse("")
|
2008-08-27 05:33:56 +08:00
|
|
|
|
|
|
|
def done(self, request, cleaned_data):
|
|
|
|
return http.HttpResponse(success_string)
|
|
|
|
|
Fixed #9977 - CsrfMiddleware gets template tag added, session dependency removed, and turned on by default.
This is a large change to CSRF protection for Django. It includes:
* removing the dependency on the session framework.
* deprecating CsrfResponseMiddleware, and replacing with a core template tag.
* turning on CSRF protection by default by adding CsrfViewMiddleware to
the default value of MIDDLEWARE_CLASSES.
* protecting all contrib apps (whatever is in settings.py)
using a decorator.
For existing users of the CSRF functionality, it should be a seamless update,
but please note that it includes DEPRECATION of features in Django 1.1,
and there are upgrade steps which are detailed in the docs.
Many thanks to 'Glenn' and 'bthomas', who did a lot of the thinking and work
on the patch, and to lots of other people including Simon Willison and
Russell Keith-Magee who refined the ideas.
Details of the rationale for these changes is found here:
http://code.djangoproject.com/wiki/CsrfProtection
As of this commit, the CSRF code is mainly in 'contrib'. The code will be
moved to core in a separate commit, to make the changeset as readable as
possible.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11660 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-27 07:23:07 +08:00
|
|
|
class DummyRequest(http.HttpRequest):
|
2008-08-27 05:33:56 +08:00
|
|
|
def __init__(self, POST=None):
|
Fixed #9977 - CsrfMiddleware gets template tag added, session dependency removed, and turned on by default.
This is a large change to CSRF protection for Django. It includes:
* removing the dependency on the session framework.
* deprecating CsrfResponseMiddleware, and replacing with a core template tag.
* turning on CSRF protection by default by adding CsrfViewMiddleware to
the default value of MIDDLEWARE_CLASSES.
* protecting all contrib apps (whatever is in settings.py)
using a decorator.
For existing users of the CSRF functionality, it should be a seamless update,
but please note that it includes DEPRECATION of features in Django 1.1,
and there are upgrade steps which are detailed in the docs.
Many thanks to 'Glenn' and 'bthomas', who did a lot of the thinking and work
on the patch, and to lots of other people including Simon Willison and
Russell Keith-Magee who refined the ideas.
Details of the rationale for these changes is found here:
http://code.djangoproject.com/wiki/CsrfProtection
As of this commit, the CSRF code is mainly in 'contrib'. The code will be
moved to core in a separate commit, to make the changeset as readable as
possible.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11660 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-27 07:23:07 +08:00
|
|
|
super(DummyRequest, self).__init__()
|
2008-08-27 05:33:56 +08:00
|
|
|
self.method = POST and "POST" or "GET"
|
Fixed #9977 - CsrfMiddleware gets template tag added, session dependency removed, and turned on by default.
This is a large change to CSRF protection for Django. It includes:
* removing the dependency on the session framework.
* deprecating CsrfResponseMiddleware, and replacing with a core template tag.
* turning on CSRF protection by default by adding CsrfViewMiddleware to
the default value of MIDDLEWARE_CLASSES.
* protecting all contrib apps (whatever is in settings.py)
using a decorator.
For existing users of the CSRF functionality, it should be a seamless update,
but please note that it includes DEPRECATION of features in Django 1.1,
and there are upgrade steps which are detailed in the docs.
Many thanks to 'Glenn' and 'bthomas', who did a lot of the thinking and work
on the patch, and to lots of other people including Simon Willison and
Russell Keith-Magee who refined the ideas.
Details of the rationale for these changes is found here:
http://code.djangoproject.com/wiki/CsrfProtection
As of this commit, the CSRF code is mainly in 'contrib'. The code will be
moved to core in a separate commit, to make the changeset as readable as
possible.
git-svn-id: http://code.djangoproject.com/svn/django/trunk@11660 bcc190cf-cafb-0310-a4f2-bffc1f526a37
2009-10-27 07:23:07 +08:00
|
|
|
if POST is not None:
|
|
|
|
self.POST.update(POST)
|
|
|
|
self._dont_enforce_csrf_checks = True
|
2008-08-27 05:33:56 +08:00
|
|
|
|
|
|
|
class WizardTests(TestCase):
|
|
|
|
def test_step_starts_at_zero(self):
|
|
|
|
"""
|
|
|
|
step should be zero for the first form
|
|
|
|
"""
|
|
|
|
wizard = WizardClass([WizardPageOneForm, WizardPageTwoForm])
|
|
|
|
request = DummyRequest()
|
|
|
|
wizard(request)
|
|
|
|
self.assertEquals(0, wizard.step)
|
|
|
|
|
|
|
|
def test_step_increments(self):
|
|
|
|
"""
|
|
|
|
step should be incremented when we go to the next page
|
|
|
|
"""
|
|
|
|
wizard = WizardClass([WizardPageOneForm, WizardPageTwoForm])
|
|
|
|
request = DummyRequest(POST={"0-field":"test", "wizard_step":"0"})
|
|
|
|
response = wizard(request)
|
|
|
|
self.assertEquals(1, wizard.step)
|
|
|
|
|