A RetroSearch Logo

Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Search Query:

Showing content from https://github.com/django/django/commit/36f580a17f0b3cb087deadf3b65eea024f479c21 below:

Fixed CVE-2019-19118 -- Required edit permissions on parent model for… · django/django@36f580a · GitHub

1 +

from selenium.common.exceptions import NoSuchElementException

2 + 1 3

from django.contrib.admin import ModelAdmin, TabularInline

2 4

from django.contrib.admin.helpers import InlineAdminForm

3 5

from django.contrib.admin.tests import AdminSeleniumTestCase

@@ -852,6 +854,98 @@ def test_inline_change_fk_all_perms(self):

852 854

)

853 855 854 856 857 +

@override_settings(ROOT_URLCONF='admin_inlines.urls')

858 +

class TestReadOnlyChangeViewInlinePermissions(TestCase):

859 + 860 +

@classmethod

861 +

def setUpTestData(cls):

862 +

cls.user = User.objects.create_user('testing', password='password', is_staff=True)

863 +

cls.user.user_permissions.add(

864 +

Permission.objects.get(codename='view_poll', content_type=ContentType.objects.get_for_model(Poll))

865 +

)

866 +

cls.user.user_permissions.add(

867 +

*Permission.objects.filter(

868 +

codename__endswith="question", content_type=ContentType.objects.get_for_model(Question)

869 +

).values_list('pk', flat=True)

870 +

)

871 + 872 +

cls.poll = Poll.objects.create(name="Survey")

873 +

cls.add_url = reverse('admin:admin_inlines_poll_add')

874 +

cls.change_url = reverse('admin:admin_inlines_poll_change', args=(cls.poll.id,))

875 + 876 +

def setUp(self):

877 +

self.client.force_login(self.user)

878 + 879 +

def test_add_url_not_allowed(self):

880 +

response = self.client.get(self.add_url)

881 +

self.assertEqual(response.status_code, 403)

882 + 883 +

response = self.client.post(self.add_url, {})

884 +

self.assertEqual(response.status_code, 403)

885 + 886 +

def test_post_to_change_url_not_allowed(self):

887 +

response = self.client.post(self.change_url, {})

888 +

self.assertEqual(response.status_code, 403)

889 + 890 +

def test_get_to_change_url_is_allowed(self):

891 +

response = self.client.get(self.change_url)

892 +

self.assertEqual(response.status_code, 200)

893 + 894 +

def test_main_model_is_rendered_as_read_only(self):

895 +

response = self.client.get(self.change_url)

896 +

self.assertContains(

897 +

response,

898 +

'<div class="readonly">%s</div>' % self.poll.name,

899 +

html=True

900 +

)

901 +

input = '<input type="text" name="name" value="%s" class="vTextField" maxlength="40" required id="id_name">'

902 +

self.assertNotContains(

903 +

response,

904 +

input % self.poll.name,

905 +

html=True

906 +

)

907 + 908 +

def test_inlines_are_rendered_as_read_only(self):

909 +

question = Question.objects.create(text="How will this be rendered?", poll=self.poll)

910 +

response = self.client.get(self.change_url)

911 +

self.assertContains(

912 +

response,

913 +

'<td class="field-text"><p>%s</p></td>' % question.text,

914 +

html=True

915 +

)

916 +

self.assertNotContains(response, 'id="id_question_set-0-text"')

917 +

self.assertNotContains(response, 'id="id_related_objs-0-DELETE"')

918 + 919 +

def test_submit_line_shows_only_close_button(self):

920 +

response = self.client.get(self.change_url)

921 +

self.assertContains(

922 +

response,

923 +

'<a href="/admin/admin_inlines/poll/" class="closelink">Close</a>',

924 +

html=True

925 +

)

926 +

delete_link = '<p class="deletelink-box"><a href="/admin/admin_inlines/poll/%s/delete/" class="deletelink">Delete</a></p>' # noqa

927 +

self.assertNotContains(

928 +

response,

929 +

delete_link % self.poll.id,

930 +

html=True

931 +

)

932 +

self.assertNotContains(response, '<input type="submit" value="Save and add another" name="_addanother">')

933 +

self.assertNotContains(response, '<input type="submit" value="Save and continue editing" name="_continue">')

934 + 935 +

def test_inline_delete_buttons_are_not_shown(self):

936 +

Question.objects.create(text="How will this be rendered?", poll=self.poll)

937 +

response = self.client.get(self.change_url)

938 +

self.assertNotContains(

939 +

response,

940 +

'<input type="checkbox" name="question_set-0-DELETE" id="id_question_set-0-DELETE">',

941 +

html=True

942 +

)

943 + 944 +

def test_extra_inlines_are_not_shown(self):

945 +

response = self.client.get(self.change_url)

946 +

self.assertNotContains(response, 'id="id_question_set-0-text"')

947 + 948 + 855 949

@override_settings(ROOT_URLCONF='admin_inlines.urls')

856 950

class SeleniumTests(AdminSeleniumTestCase):

857 951

@@ -955,6 +1049,24 @@ def test_add_inlines(self):

955 1049

self.assertEqual(ProfileCollection.objects.all().count(), 1)

956 1050

self.assertEqual(Profile.objects.all().count(), 3)

957 1051 1052 +

def test_add_inline_link_absent_for_view_only_parent_model(self):

1053 +

user = User.objects.create_user('testing', password='password', is_staff=True)

1054 +

user.user_permissions.add(

1055 +

Permission.objects.get(codename='view_poll', content_type=ContentType.objects.get_for_model(Poll))

1056 +

)

1057 +

user.user_permissions.add(

1058 +

*Permission.objects.filter(

1059 +

codename__endswith="question", content_type=ContentType.objects.get_for_model(Question)

1060 +

).values_list('pk', flat=True)

1061 +

)

1062 +

self.admin_login(username='testing', password='password')

1063 +

poll = Poll.objects.create(name="Survey")

1064 +

change_url = reverse('admin:admin_inlines_poll_change', args=(poll.id,))

1065 +

self.selenium.get(self.live_server_url + change_url)

1066 +

with self.disable_implicit_wait():

1067 +

with self.assertRaises(NoSuchElementException):

1068 +

self.selenium.find_element_by_link_text('Add another Question')

1069 + 958 1070

def test_delete_inlines(self):

959 1071

self.admin_login(username='super', password='secret')

960 1072

self.selenium.get(self.live_server_url + reverse('admin:admin_inlines_profilecollection_add'))


RetroSearch is an open source project built by @garambo | Open a GitHub Issue

Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo

HTML: 3.2 | Encoding: UTF-8 | Version: 0.7.4