mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-10-24 06:06:09 +00:00
Code Issues 32 Releases Wiki Activity

Fixed #11513 -- Ensure that the redirect at the end of an object change won't redirect to a page for which the user doesn't have permission. Thanks to rlaager for the report and draft patch, and to Julien Phalip for the final patch.

Browse Source 
git-svn-id: http://code.djangoproject.com/svn/django/trunk@15584 bcc190cf-cafb-0310-a4f2-bffc1f526a37
This commit is contained in:
Russell Keith-Magee
2011-02-19 14:05:07 +00:00
parent fe3c9ad551
commit 75a1aaa1f9
3 changed files with 51 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
tests/regressiontests/admin_views/tests.py
View File

@@ -35,7 +35,8 @@ from models import (Article, BarAccount, CustomArticle, EmptyModel,
Person, Persona, Picture, Podcast, Section, Subscriber, Vodcast,
Language, Collector, Widget, Grommet, DooHickey, FancyDoodad, Whatsit,
Category, Post, Plot, FunkyTag, Chapter, Book, Promo, WorkHour, Employee,
Question, Answer, Inquisition, Actor, FoodDelivery)
Question, Answer, Inquisition, Actor, FoodDelivery,
RowLevelChangePermissionModel)
class AdminViewBasicTest(TestCase):
@@ -792,6 +793,40 @@ class AdminViewPermissionsTest(TestCase):
'Plural error message not found in response to post with multiple errors.')
self.client.get('/test_admin/admin/logout/')
# Test redirection when using row-level change permissions. Refs #11513.
RowLevelChangePermissionModel.objects.create(name="odd id")
RowLevelChangePermissionModel.objects.create(name="even id")
for login_dict in [self.super_login, self.changeuser_login, self.adduser_login, self.deleteuser_login]:
self.client.post('/test_admin/admin/', login_dict)
request = self.client.get('/test_admin/admin/admin_views/rowlevelchangepermissionmodel/1/')
self.assertEqual(request.status_code, 403)
request = self.client.post('/test_admin/admin/admin_views/rowlevelchangepermissionmodel/1/', {'name': 'changed'})
self.assertEquals(RowLevelChangePermissionModel.objects.get(id=1).name, 'odd id')
self.assertEqual(request.status_code, 403)
request = self.client.get('/test_admin/admin/admin_views/rowlevelchangepermissionmodel/2/')
self.assertEqual(request.status_code, 200)
request = self.client.post('/test_admin/admin/admin_views/rowlevelchangepermissionmodel/2/', {'name': 'changed'})
self.assertEquals(RowLevelChangePermissionModel.objects.get(id=2).name, 'changed')
self.assertRedirects(request, '/test_admin/admin/')
self.client.get('/test_admin/admin/logout/')
for login_dict in [self.joepublic_login, self.no_username_login]:
self.client.post('/test_admin/admin/', login_dict)
request = self.client.get('/test_admin/admin/admin_views/rowlevelchangepermissionmodel/1/')
self.assertEqual(request.status_code, 200)
self.assertContains(request, 'login-form')
request = self.client.post('/test_admin/admin/admin_views/rowlevelchangepermissionmodel/1/', {'name': 'changed'})
self.assertEquals(RowLevelChangePermissionModel.objects.get(id=1).name, 'odd id')
self.assertEqual(request.status_code, 200)
self.assertContains(request, 'login-form')
request = self.client.get('/test_admin/admin/admin_views/rowlevelchangepermissionmodel/2/')
self.assertEqual(request.status_code, 200)
self.assertContains(request, 'login-form')
request = self.client.post('/test_admin/admin/admin_views/rowlevelchangepermissionmodel/2/', {'name': 'changed again'})
self.assertEquals(RowLevelChangePermissionModel.objects.get(id=2).name, 'changed')
self.assertEqual(request.status_code, 200)
self.assertContains(request, 'login-form')
self.client.get('/test_admin/admin/logout/')
def testConditionallyShowAddSectionLink(self):
"""
The foreign key widget should only show the "add related" button if the