2008-12-03 06:40:00 +08:00
|
|
|
# -*- coding: utf-8 -*-
|
|
|
|
|
|
|
|
|
|
from django.test import TestCase
|
2008-12-03 07:00:06 +08:00
|
|
|
from django.http import HttpRequest, HttpResponse, HttpResponseForbidden
|
2008-12-03 08:34:18 +08:00
|
|
|
from django.contrib.csrf.middleware import CsrfMiddleware, _make_token, csrf_exempt
|
2008-12-03 06:40:00 +08:00
|
|
|
from django.conf import settings
|
|
|
|
|
|
2008-12-03 08:31:31 +08:00
|
|
|
|
2008-12-03 08:34:18 +08:00
|
|
|
def post_form_response():
|
|
|
|
|
resp = HttpResponse(content="""
|
|
|
|
|
<html><body><form method="POST"><input type="text" /></form></body></html>
|
|
|
|
|
""", mimetype="text/html")
|
|
|
|
|
return resp
|
|
|
|
|
|
|
|
|
|
def test_view(request):
|
|
|
|
|
return post_form_response()
|
|
|
|
|
|
2008-12-03 06:40:00 +08:00
|
|
|
class CsrfMiddlewareTest(TestCase):
|
|
|
|
|
|
|
|
|
|
_session_id = "1"
|
|
|
|
|
|
2008-12-03 07:00:06 +08:00
|
|
|
def _get_GET_no_session_request(self):
|
2008-12-03 06:40:00 +08:00
|
|
|
return HttpRequest()
|
|
|
|
|
|
2008-12-03 07:00:06 +08:00
|
|
|
def _get_GET_session_request(self):
|
|
|
|
|
req = self._get_GET_no_session_request()
|
2008-12-03 06:40:00 +08:00
|
|
|
req.COOKIES[settings.SESSION_COOKIE_NAME] = self._session_id
|
|
|
|
|
return req
|
|
|
|
|
|
2008-12-03 07:00:06 +08:00
|
|
|
def _get_POST_session_request(self):
|
|
|
|
|
req = self._get_GET_session_request()
|
|
|
|
|
req.method = "POST"
|
|
|
|
|
return req
|
|
|
|
|
|
|
|
|
|
def _get_POST_no_session_request(self):
|
|
|
|
|
req = self._get_GET_no_session_request()
|
|
|
|
|
req.method = "POST"
|
|
|
|
|
return req
|
|
|
|
|
|
|
|
|
|
def _get_POST_session_request_with_token(self):
|
|
|
|
|
req = self._get_POST_session_request()
|
|
|
|
|
req.POST['csrfmiddlewaretoken'] = _make_token(self._session_id)
|
|
|
|
|
return req
|
|
|
|
|
|
2008-12-03 06:40:00 +08:00
|
|
|
def _get_post_form_response(self):
|
2008-12-03 08:34:18 +08:00
|
|
|
return post_form_response()
|
2008-12-03 06:40:00 +08:00
|
|
|
|
|
|
|
|
def _get_new_session_response(self):
|
|
|
|
|
resp = self._get_post_form_response()
|
|
|
|
|
resp.cookies[settings.SESSION_COOKIE_NAME] = self._session_id
|
|
|
|
|
return resp
|
|
|
|
|
|
|
|
|
|
def _check_token_present(self, response):
|
|
|
|
|
self.assertContains(response, "name='csrfmiddlewaretoken' value='%s'" % _make_token(self._session_id))
|
|
|
|
|
|
2008-12-03 08:31:31 +08:00
|
|
|
def get_view(self):
|
2008-12-03 08:34:18 +08:00
|
|
|
return test_view
|
2008-12-03 08:31:31 +08:00
|
|
|
|
2008-12-03 07:00:06 +08:00
|
|
|
# Check the post processing
|
2008-12-03 06:40:00 +08:00
|
|
|
def test_process_response_no_session(self):
|
|
|
|
|
"""
|
2009-05-18 00:45:28 +08:00
|
|
|
Check the post-processor does nothing if no session active
|
2008-12-03 06:40:00 +08:00
|
|
|
"""
|
2008-12-03 07:00:06 +08:00
|
|
|
req = self._get_GET_no_session_request()
|
2008-12-03 06:40:00 +08:00
|
|
|
resp = self._get_post_form_response()
|
2009-02-08 03:32:37 +08:00
|
|
|
resp_content = resp.content # needed because process_response modifies resp
|
2008-12-03 06:40:00 +08:00
|
|
|
resp2 = CsrfMiddleware().process_response(req, resp)
|
|
|
|
|
self.assertEquals(resp_content, resp2.content)
|
|
|
|
|
|
|
|
|
|
def test_process_response_existing_session(self):
|
|
|
|
|
"""
|
|
|
|
|
Check that the token is inserted if there is an existing session
|
|
|
|
|
"""
|
2008-12-03 07:00:06 +08:00
|
|
|
req = self._get_GET_session_request()
|
2008-12-03 06:40:00 +08:00
|
|
|
resp = self._get_post_form_response()
|
2009-02-08 03:32:37 +08:00
|
|
|
resp_content = resp.content # needed because process_response modifies resp
|
2008-12-03 06:40:00 +08:00
|
|
|
resp2 = CsrfMiddleware().process_response(req, resp)
|
|
|
|
|
self.assertNotEqual(resp_content, resp2.content)
|
|
|
|
|
self._check_token_present(resp2)
|
|
|
|
|
|
|
|
|
|
def test_process_response_new_session(self):
|
|
|
|
|
"""
|
|
|
|
|
Check that the token is inserted if there is a new session being started
|
|
|
|
|
"""
|
2008-12-03 07:00:06 +08:00
|
|
|
req = self._get_GET_no_session_request() # no session in request
|
2008-12-03 06:40:00 +08:00
|
|
|
resp = self._get_new_session_response() # but new session started
|
2009-02-08 03:32:37 +08:00
|
|
|
resp_content = resp.content # needed because process_response modifies resp
|
2008-12-03 06:40:00 +08:00
|
|
|
resp2 = CsrfMiddleware().process_response(req, resp)
|
|
|
|
|
self.assertNotEqual(resp_content, resp2.content)
|
|
|
|
|
self._check_token_present(resp2)
|
2008-12-03 07:00:06 +08:00
|
|
|
|
2009-02-08 01:47:02 +08:00
|
|
|
def test_process_response_exempt_view(self):
|
2009-02-08 03:32:37 +08:00
|
|
|
"""
|
|
|
|
|
Check that no post processing is done for an exempt view
|
|
|
|
|
"""
|
2009-02-08 01:47:02 +08:00
|
|
|
req = self._get_POST_session_request()
|
2009-02-08 03:32:37 +08:00
|
|
|
resp = csrf_exempt(self.get_view())(req)
|
|
|
|
|
resp_content = resp.content
|
2009-02-08 01:47:02 +08:00
|
|
|
resp2 = CsrfMiddleware().process_response(req, resp)
|
|
|
|
|
self.assertEquals(resp_content, resp2.content)
|
|
|
|
|
|
2008-12-03 07:00:06 +08:00
|
|
|
# Check the request processing
|
|
|
|
|
def test_process_request_no_session(self):
|
|
|
|
|
"""
|
|
|
|
|
Check that if no session is present, the middleware does nothing.
|
|
|
|
|
to the incoming request.
|
|
|
|
|
"""
|
|
|
|
|
req = self._get_POST_no_session_request()
|
2008-12-03 08:31:31 +08:00
|
|
|
req2 = CsrfMiddleware().process_view(req, self.get_view(), (), {})
|
2008-12-03 07:00:06 +08:00
|
|
|
self.assertEquals(None, req2)
|
|
|
|
|
|
|
|
|
|
def test_process_request_session_no_token(self):
|
|
|
|
|
"""
|
|
|
|
|
Check that if a session is present but no token, we get a 'forbidden'
|
|
|
|
|
"""
|
|
|
|
|
req = self._get_POST_session_request()
|
2008-12-03 08:31:31 +08:00
|
|
|
req2 = CsrfMiddleware().process_view(req, self.get_view(), (), {})
|
2008-12-03 07:00:06 +08:00
|
|
|
self.assertEquals(HttpResponseForbidden, req2.__class__)
|
|
|
|
|
|
|
|
|
|
def test_process_request_session_and_token(self):
|
|
|
|
|
"""
|
|
|
|
|
Check that if a session is present and a token, the middleware lets it through
|
|
|
|
|
"""
|
|
|
|
|
req = self._get_POST_session_request_with_token()
|
2008-12-03 08:31:31 +08:00
|
|
|
req2 = CsrfMiddleware().process_view(req, self.get_view(), (), {})
|
2008-12-03 07:00:06 +08:00
|
|
|
self.assertEquals(None, req2)
|
2008-12-03 08:34:18 +08:00
|
|
|
|
|
|
|
|
def test_process_request_session_no_token_exempt_view(self):
|
|
|
|
|
"""
|
|
|
|
|
Check that if a session is present and no token, but the csrf_exempt
|
|
|
|
|
decorator has been applied to the view, the middleware lets it through
|
|
|
|
|
"""
|
|
|
|
|
req = self._get_POST_session_request()
|
|
|
|
|
req2 = CsrfMiddleware().process_view(req, csrf_exempt(self.get_view()), (), {})
|
|
|
|
|
self.assertEquals(None, req2)
|
|
|
|
|
|
|
|
|
|
def test_ajax_exemption(self):
|
|
|
|
|
"""
|
2009-02-08 01:47:02 +08:00
|
|
|
Check that AJAX requests are automatically exempted.
|
2008-12-03 08:34:18 +08:00
|
|
|
"""
|
|
|
|
|
req = self._get_POST_session_request()
|
|
|
|
|
req.META['HTTP_X_REQUESTED_WITH'] = 'XMLHttpRequest'
|
|
|
|
|
req2 = CsrfMiddleware().process_view(req, self.get_view(), (), {})
|
|
|
|
|
self.assertEquals(None, req2)
|
