import os from django.conf import settings from django.contrib.auth.models import User from django.test import TestCase, Client class FlatpageCSRFTests(TestCase): fixtures = ['sample_flatpages'] urls = 'django.contrib.flatpages.tests.urls' def setUp(self): self.client = Client(enforce_csrf_checks=True) self.old_MIDDLEWARE_CLASSES = settings.MIDDLEWARE_CLASSES flatpage_middleware_class = 'django.contrib.flatpages.middleware.FlatpageFallbackMiddleware' csrf_middleware_class = 'django.middleware.csrf.CsrfViewMiddleware' if csrf_middleware_class not in settings.MIDDLEWARE_CLASSES: settings.MIDDLEWARE_CLASSES += (csrf_middleware_class,) if flatpage_middleware_class not in settings.MIDDLEWARE_CLASSES: settings.MIDDLEWARE_CLASSES += (flatpage_middleware_class,) self.old_TEMPLATE_DIRS = settings.TEMPLATE_DIRS settings.TEMPLATE_DIRS = ( os.path.join( os.path.dirname(__file__), 'templates' ), ) self.old_LOGIN_URL = settings.LOGIN_URL settings.LOGIN_URL = '/accounts/login/' def tearDown(self): settings.MIDDLEWARE_CLASSES = self.old_MIDDLEWARE_CLASSES settings.TEMPLATE_DIRS = self.old_TEMPLATE_DIRS settings.LOGIN_URL = self.old_LOGIN_URL def test_view_flatpage(self): "A flatpage can be served through a view, even when the middleware is in use" response = self.client.get('/flatpage_root/flatpage/') self.assertEquals(response.status_code, 200) self.assertContains(response, "

Isn't it flat!

") def test_view_non_existent_flatpage(self): "A non-existent flatpage raises 404 when served through a view, even when the middleware is in use" response = self.client.get('/flatpage_root/no_such_flatpage/') self.assertEquals(response.status_code, 404) def test_view_authenticated_flatpage(self): "A flatpage served through a view can require authentication" response = self.client.get('/flatpage_root/sekrit/') self.assertRedirects(response, '/accounts/login/?next=/flatpage_root/sekrit/') User.objects.create_user('testuser', 'test@example.com', 's3krit') self.client.login(username='testuser',password='s3krit') response = self.client.get('/flatpage_root/sekrit/') self.assertEquals(response.status_code, 200) self.assertContains(response, "

Isn't it sekrit!

") def test_fallback_flatpage(self): "A flatpage can be served by the fallback middlware" response = self.client.get('/flatpage/') self.assertEquals(response.status_code, 200) self.assertContains(response, "

Isn't it flat!

") def test_fallback_non_existent_flatpage(self): "A non-existent flatpage raises a 404 when served by the fallback middlware" response = self.client.get('/no_such_flatpage/') self.assertEquals(response.status_code, 404) def test_post_view_flatpage(self): "POSTing to a flatpage served through a view will raise a CSRF error if no token is provided (Refs #14156)" response = self.client.post('/flatpage_root/flatpage/') self.assertEquals(response.status_code, 403) def test_post_fallback_flatpage(self): "POSTing to a flatpage served by the middleware will raise a CSRF error if no token is provided (Refs #14156)" response = self.client.post('/flatpage/') self.assertEquals(response.status_code, 403) def test_post_unknown_page(self): "POSTing to an unknown page isn't caught as a 403 CSRF error" response = self.client.post('/no_such_page/') self.assertEquals(response.status_code, 404)