2015-01-28 12:35:27 +00:00
|
|
|
from functools import update_wrapper, wraps
|
2013-07-01 12:22:27 +00:00
|
|
|
from unittest import TestCase
|
2008-02-25 06:02:35 +00:00
|
|
|
|
2010-10-11 12:55:17 +00:00
|
|
|
from django.contrib.admin.views.decorators import staff_member_required
|
2015-01-28 12:35:27 +00:00
|
|
|
from django.contrib.auth.decorators import (
|
|
|
|
|
login_required, permission_required, user_passes_test,
|
|
|
|
|
)
|
|
|
|
|
from django.http import HttpRequest, HttpResponse, HttpResponseNotAllowed
|
2011-10-13 18:51:33 +00:00
|
|
|
from django.middleware.clickjacking import XFrameOptionsMiddleware
|
2010-10-11 12:55:17 +00:00
|
|
|
from django.utils.decorators import method_decorator
|
2014-11-24 13:36:10 +00:00
|
|
|
from django.utils.functional import allow_lazy, lazy
|
2015-01-28 12:35:27 +00:00
|
|
|
from django.views.decorators.cache import (
|
|
|
|
|
cache_control, cache_page, never_cache,
|
|
|
|
|
)
|
|
|
|
|
from django.views.decorators.clickjacking import (
|
|
|
|
|
xframe_options_deny, xframe_options_exempt, xframe_options_sameorigin,
|
|
|
|
|
)
|
|
|
|
|
from django.views.decorators.http import (
|
|
|
|
|
condition, require_GET, require_http_methods, require_POST, require_safe,
|
|
|
|
|
)
|
|
|
|
|
from django.views.decorators.vary import vary_on_cookie, vary_on_headers
|
2010-10-11 12:55:17 +00:00
|
|
|
|
2008-02-25 06:02:35 +00:00
|
|
|
|
|
|
|
|
def fully_decorated(request):
|
|
|
|
|
"""Expected __doc__"""
|
|
|
|
|
return HttpResponse('<html><body>dummy</body></html>')
|
|
|
|
|
fully_decorated.anything = "Expected __dict__"
|
|
|
|
|
|
|
|
|
|
|
2011-05-23 16:08:36 +00:00
|
|
|
def compose(*functions):
|
|
|
|
|
# compose(f, g)(*args, **kwargs) == f(g(*args, **kwargs))
|
|
|
|
|
functions = list(reversed(functions))
|
2013-10-22 10:21:07 +00:00
|
|
|
|
2011-05-23 16:08:36 +00:00
|
|
|
def _inner(*args, **kwargs):
|
|
|
|
|
result = functions[0](*args, **kwargs)
|
|
|
|
|
for f in functions[1:]:
|
|
|
|
|
result = f(result)
|
|
|
|
|
return result
|
|
|
|
|
return _inner
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
full_decorator = compose(
|
|
|
|
|
# django.views.decorators.http
|
|
|
|
|
require_http_methods(["GET"]),
|
|
|
|
|
require_GET,
|
|
|
|
|
require_POST,
|
|
|
|
|
require_safe,
|
2012-02-09 18:57:06 +00:00
|
|
|
condition(lambda r: None, lambda r: None),
|
2011-05-23 16:08:36 +00:00
|
|
|
|
|
|
|
|
# django.views.decorators.vary
|
|
|
|
|
vary_on_headers('Accept-language'),
|
|
|
|
|
vary_on_cookie,
|
|
|
|
|
|
|
|
|
|
# django.views.decorators.cache
|
2013-11-02 22:50:35 +00:00
|
|
|
cache_page(60 * 15),
|
2011-05-23 16:08:36 +00:00
|
|
|
cache_control(private=True),
|
|
|
|
|
never_cache,
|
|
|
|
|
|
|
|
|
|
# django.contrib.auth.decorators
|
|
|
|
|
# Apply user_passes_test twice to check #9474
|
2013-10-26 19:15:03 +00:00
|
|
|
user_passes_test(lambda u: True),
|
2011-05-23 16:08:36 +00:00
|
|
|
login_required,
|
|
|
|
|
permission_required('change_world'),
|
|
|
|
|
|
|
|
|
|
# django.contrib.admin.views.decorators
|
|
|
|
|
staff_member_required,
|
|
|
|
|
|
|
|
|
|
# django.utils.functional
|
|
|
|
|
allow_lazy,
|
|
|
|
|
lazy,
|
|
|
|
|
)
|
|
|
|
|
|
|
|
|
|
fully_decorated = full_decorator(fully_decorated)
|
2010-02-09 15:02:39 +00:00
|
|
|
|
2013-11-02 22:50:35 +00:00
|
|
|
|
2008-02-25 06:02:35 +00:00
|
|
|
class DecoratorsTest(TestCase):
|
|
|
|
|
|
|
|
|
|
def test_attributes(self):
|
|
|
|
|
"""
|
|
|
|
|
Tests that django decorators set certain attributes of the wrapped
|
|
|
|
|
function.
|
|
|
|
|
"""
|
2011-03-03 15:04:39 +00:00
|
|
|
self.assertEqual(fully_decorated.__name__, 'fully_decorated')
|
|
|
|
|
self.assertEqual(fully_decorated.__doc__, 'Expected __doc__')
|
|
|
|
|
self.assertEqual(fully_decorated.__dict__['anything'], 'Expected __dict__')
|
2009-04-01 16:17:38 +00:00
|
|
|
|
|
|
|
|
def test_user_passes_test_composition(self):
|
|
|
|
|
"""
|
|
|
|
|
Test that the user_passes_test decorator can be applied multiple times
|
|
|
|
|
(#9474).
|
|
|
|
|
"""
|
|
|
|
|
def test1(user):
|
|
|
|
|
user.decorators_applied.append('test1')
|
|
|
|
|
return True
|
2010-10-11 12:55:17 +00:00
|
|
|
|
2009-04-01 16:17:38 +00:00
|
|
|
def test2(user):
|
|
|
|
|
user.decorators_applied.append('test2')
|
|
|
|
|
return True
|
2010-10-11 12:55:17 +00:00
|
|
|
|
2009-04-01 16:17:38 +00:00
|
|
|
def callback(request):
|
|
|
|
|
return request.user.decorators_applied
|
|
|
|
|
|
|
|
|
|
callback = user_passes_test(test1)(callback)
|
|
|
|
|
callback = user_passes_test(test2)(callback)
|
2010-10-11 12:55:17 +00:00
|
|
|
|
2013-10-17 08:17:41 +00:00
|
|
|
class DummyUser(object):
|
|
|
|
|
pass
|
|
|
|
|
|
|
|
|
|
class DummyRequest(object):
|
|
|
|
|
pass
|
2010-10-11 12:55:17 +00:00
|
|
|
|
2009-04-01 16:17:38 +00:00
|
|
|
request = DummyRequest()
|
|
|
|
|
request.user = DummyUser()
|
|
|
|
|
request.user.decorators_applied = []
|
|
|
|
|
response = callback(request)
|
2010-10-11 12:55:17 +00:00
|
|
|
|
2009-04-01 16:17:38 +00:00
|
|
|
self.assertEqual(response, ['test2', 'test1'])
|
2009-09-21 22:31:51 +00:00
|
|
|
|
|
|
|
|
def test_cache_page_new_style(self):
|
|
|
|
|
"""
|
|
|
|
|
Test that we can call cache_page the new way
|
|
|
|
|
"""
|
|
|
|
|
def my_view(request):
|
|
|
|
|
return "response"
|
|
|
|
|
my_view_cached = cache_page(123)(my_view)
|
|
|
|
|
self.assertEqual(my_view_cached(HttpRequest()), "response")
|
2009-09-28 21:54:54 +00:00
|
|
|
my_view_cached2 = cache_page(123, key_prefix="test")(my_view)
|
|
|
|
|
self.assertEqual(my_view_cached2(HttpRequest()), "response")
|
2009-09-21 22:31:51 +00:00
|
|
|
|
2011-04-28 13:04:16 +00:00
|
|
|
def test_require_safe_accepts_only_safe_methods(self):
|
|
|
|
|
"""
|
|
|
|
|
Test for the require_safe decorator.
|
|
|
|
|
A view returns either a response or an exception.
|
|
|
|
|
Refs #15637.
|
|
|
|
|
"""
|
|
|
|
|
def my_view(request):
|
|
|
|
|
return HttpResponse("OK")
|
|
|
|
|
my_safe_view = require_safe(my_view)
|
|
|
|
|
request = HttpRequest()
|
|
|
|
|
request.method = 'GET'
|
2013-05-21 09:42:15 +00:00
|
|
|
self.assertIsInstance(my_safe_view(request), HttpResponse)
|
2011-04-28 13:04:16 +00:00
|
|
|
request.method = 'HEAD'
|
2013-05-21 09:42:15 +00:00
|
|
|
self.assertIsInstance(my_safe_view(request), HttpResponse)
|
2011-04-28 13:04:16 +00:00
|
|
|
request.method = 'POST'
|
2013-05-21 09:42:15 +00:00
|
|
|
self.assertIsInstance(my_safe_view(request), HttpResponseNotAllowed)
|
2011-04-28 13:04:16 +00:00
|
|
|
request.method = 'PUT'
|
2013-05-21 09:42:15 +00:00
|
|
|
self.assertIsInstance(my_safe_view(request), HttpResponseNotAllowed)
|
2011-04-28 13:04:16 +00:00
|
|
|
request.method = 'DELETE'
|
2013-05-21 09:42:15 +00:00
|
|
|
self.assertIsInstance(my_safe_view(request), HttpResponseNotAllowed)
|
2011-04-28 13:04:16 +00:00
|
|
|
|
2010-02-09 15:02:39 +00:00
|
|
|
|
|
|
|
|
# For testing method_decorator, a decorator that assumes a single argument.
|
|
|
|
|
# We will get type arguments if there is a mismatch in the number of arguments.
|
|
|
|
|
def simple_dec(func):
|
|
|
|
|
def wrapper(arg):
|
|
|
|
|
return func("test:" + arg)
|
|
|
|
|
return wraps(func)(wrapper)
|
|
|
|
|
|
|
|
|
|
simple_dec_m = method_decorator(simple_dec)
|
|
|
|
|
|
|
|
|
|
|
2010-10-21 14:56:49 +00:00
|
|
|
# For testing method_decorator, two decorators that add an attribute to the function
|
|
|
|
|
def myattr_dec(func):
|
|
|
|
|
def wrapper(*args, **kwargs):
|
|
|
|
|
return func(*args, **kwargs)
|
|
|
|
|
wrapper.myattr = True
|
|
|
|
|
return wraps(func)(wrapper)
|
|
|
|
|
|
|
|
|
|
myattr_dec_m = method_decorator(myattr_dec)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
def myattr2_dec(func):
|
|
|
|
|
def wrapper(*args, **kwargs):
|
|
|
|
|
return func(*args, **kwargs)
|
|
|
|
|
wrapper.myattr2 = True
|
|
|
|
|
return wraps(func)(wrapper)
|
|
|
|
|
|
|
|
|
|
myattr2_dec_m = method_decorator(myattr2_dec)
|
|
|
|
|
|
2014-02-09 11:13:10 +00:00
|
|
|
|
2013-11-26 12:00:50 +00:00
|
|
|
class ClsDec(object):
|
|
|
|
|
def __init__(self, myattr):
|
|
|
|
|
self.myattr = myattr
|
|
|
|
|
|
|
|
|
|
def __call__(self, f):
|
|
|
|
|
|
|
|
|
|
def wrapped():
|
|
|
|
|
return f() and self.myattr
|
|
|
|
|
return update_wrapper(wrapped, f)
|
|
|
|
|
|
2010-10-21 14:56:49 +00:00
|
|
|
|
2010-02-09 15:02:39 +00:00
|
|
|
class MethodDecoratorTests(TestCase):
|
|
|
|
|
"""
|
|
|
|
|
Tests for method_decorator
|
|
|
|
|
"""
|
2010-10-21 14:56:49 +00:00
|
|
|
def test_preserve_signature(self):
|
2010-02-09 15:02:39 +00:00
|
|
|
class Test(object):
|
|
|
|
|
@simple_dec_m
|
|
|
|
|
def say(self, arg):
|
|
|
|
|
return arg
|
|
|
|
|
|
|
|
|
|
self.assertEqual("test:hello", Test().say("hello"))
|
2010-10-21 14:56:49 +00:00
|
|
|
|
|
|
|
|
def test_preserve_attributes(self):
|
|
|
|
|
# Sanity check myattr_dec and myattr2_dec
|
|
|
|
|
@myattr_dec
|
|
|
|
|
@myattr2_dec
|
|
|
|
|
def func():
|
|
|
|
|
pass
|
|
|
|
|
|
|
|
|
|
self.assertEqual(getattr(func, 'myattr', False), True)
|
|
|
|
|
self.assertEqual(getattr(func, 'myattr2', False), True)
|
|
|
|
|
|
|
|
|
|
# Now check method_decorator
|
|
|
|
|
class Test(object):
|
|
|
|
|
@myattr_dec_m
|
|
|
|
|
@myattr2_dec_m
|
|
|
|
|
def method(self):
|
|
|
|
|
"A method"
|
|
|
|
|
pass
|
|
|
|
|
|
|
|
|
|
self.assertEqual(getattr(Test().method, 'myattr', False), True)
|
|
|
|
|
self.assertEqual(getattr(Test().method, 'myattr2', False), True)
|
|
|
|
|
|
|
|
|
|
self.assertEqual(getattr(Test.method, 'myattr', False), True)
|
|
|
|
|
self.assertEqual(getattr(Test.method, 'myattr2', False), True)
|
|
|
|
|
|
|
|
|
|
self.assertEqual(Test.method.__doc__, 'A method')
|
2012-08-11 20:29:18 +00:00
|
|
|
self.assertEqual(Test.method.__name__, 'method')
|
2011-05-30 22:27:47 +00:00
|
|
|
|
2013-11-26 12:00:50 +00:00
|
|
|
# Test for argumented decorator
|
|
|
|
|
def test_argumented(self):
|
|
|
|
|
class Test(object):
|
|
|
|
|
@method_decorator(ClsDec(False))
|
|
|
|
|
def method(self):
|
|
|
|
|
return True
|
|
|
|
|
|
|
|
|
|
self.assertEqual(Test().method(), False)
|
2014-02-09 11:13:10 +00:00
|
|
|
|
2014-02-09 11:10:05 +00:00
|
|
|
def test_descriptors(self):
|
|
|
|
|
|
|
|
|
|
def original_dec(wrapped):
|
|
|
|
|
def _wrapped(arg):
|
|
|
|
|
return wrapped(arg)
|
|
|
|
|
|
|
|
|
|
return _wrapped
|
|
|
|
|
|
|
|
|
|
method_dec = method_decorator(original_dec)
|
|
|
|
|
|
|
|
|
|
class bound_wrapper(object):
|
|
|
|
|
def __init__(self, wrapped):
|
|
|
|
|
self.wrapped = wrapped
|
|
|
|
|
self.__name__ = wrapped.__name__
|
|
|
|
|
|
|
|
|
|
def __call__(self, arg):
|
|
|
|
|
return self.wrapped(arg)
|
|
|
|
|
|
|
|
|
|
def __get__(self, instance, owner):
|
|
|
|
|
return self
|
|
|
|
|
|
|
|
|
|
class descriptor_wrapper(object):
|
|
|
|
|
def __init__(self, wrapped):
|
|
|
|
|
self.wrapped = wrapped
|
|
|
|
|
self.__name__ = wrapped.__name__
|
|
|
|
|
|
|
|
|
|
def __get__(self, instance, owner):
|
|
|
|
|
return bound_wrapper(self.wrapped.__get__(instance, owner))
|
|
|
|
|
|
|
|
|
|
class Test(object):
|
|
|
|
|
@method_dec
|
|
|
|
|
@descriptor_wrapper
|
|
|
|
|
def method(self, arg):
|
|
|
|
|
return arg
|
|
|
|
|
|
|
|
|
|
self.assertEqual(Test().method(1), 1)
|
|
|
|
|
|
2011-05-30 22:27:47 +00:00
|
|
|
|
|
|
|
|
class XFrameOptionsDecoratorsTests(TestCase):
|
|
|
|
|
"""
|
|
|
|
|
Tests for the X-Frame-Options decorators.
|
|
|
|
|
"""
|
|
|
|
|
def test_deny_decorator(self):
|
|
|
|
|
"""
|
|
|
|
|
Ensures @xframe_options_deny properly sets the X-Frame-Options header.
|
|
|
|
|
"""
|
|
|
|
|
@xframe_options_deny
|
|
|
|
|
def a_view(request):
|
|
|
|
|
return HttpResponse()
|
|
|
|
|
r = a_view(HttpRequest())
|
|
|
|
|
self.assertEqual(r['X-Frame-Options'], 'DENY')
|
|
|
|
|
|
|
|
|
|
def test_sameorigin_decorator(self):
|
|
|
|
|
"""
|
|
|
|
|
Ensures @xframe_options_sameorigin properly sets the X-Frame-Options
|
|
|
|
|
header.
|
|
|
|
|
"""
|
|
|
|
|
@xframe_options_sameorigin
|
|
|
|
|
def a_view(request):
|
|
|
|
|
return HttpResponse()
|
|
|
|
|
r = a_view(HttpRequest())
|
|
|
|
|
self.assertEqual(r['X-Frame-Options'], 'SAMEORIGIN')
|
|
|
|
|
|
|
|
|
|
def test_exempt_decorator(self):
|
|
|
|
|
"""
|
|
|
|
|
Ensures @xframe_options_exempt properly instructs the
|
|
|
|
|
XFrameOptionsMiddleware to NOT set the header.
|
|
|
|
|
"""
|
|
|
|
|
@xframe_options_exempt
|
|
|
|
|
def a_view(request):
|
|
|
|
|
return HttpResponse()
|
|
|
|
|
req = HttpRequest()
|
|
|
|
|
resp = a_view(req)
|
|
|
|
|
self.assertEqual(resp.get('X-Frame-Options', None), None)
|
|
|
|
|
self.assertTrue(resp.xframe_options_exempt)
|
|
|
|
|
|
|
|
|
|
# Since the real purpose of the exempt decorator is to suppress
|
|
|
|
|
# the middleware's functionality, let's make sure it actually works...
|
|
|
|
|
r = XFrameOptionsMiddleware().process_response(req, resp)
|
|
|
|
|
self.assertEqual(r.get('X-Frame-Options', None), None)
|
