Ticket #4376: django.contrib.auth.decorators.3.diff

django/contrib/auth/decorators.py

@@ -8 +8 @@
-    redirecting to the log-in page if necessary. The test should be a callable
-    that takes the user object and returns True if the user passes.
-    """
-
-
-
-
-
-
-
-
-
-
+
+
+
-
-
-
-
-
-
+
-    """
-    Decorator for views that checks that the user is logged in, redirecting
-    to the log-in page if necessary.
-    """
-
+return _CheckLogin(view_func, lambda u: u.is_authenticated()
-
-def permission_required(perm, login_url=None):
-    """
@@ -37 +26 @@
-    """
-    return user_passes_test(lambda u: u.has_perm(perm), login_url=login_url)
-
+
+class _CheckLogin(object):
+    """
+    Class that checks that the user passes the given test, redirecting to
+    the log-in page if necessary. If the test is passed, the view function
+    is invoked. The test should be a callable that takes the user object
+    and returns True if the user passes.
+
+    We use a class here so that we can define __get__. This way, when a
+    _CheckLogin object is used as a method decorator, the view function
+    is properly bound to its instance.
+    """
+    def __init__(self, view_func, test_func, login_url=None):
+        if not login_url:
+            from django.conf import settings
+            login_url = settings.LOGIN_URL
+        self.view_func = view_func
+        self.test_func = test_func
+        self.login_url = login_url
+        
+    def __get__(self, obj, cls=None):
+        view_func = self.view_func.__get__(obj, cls)
+        return _CheckLogin(view_func, self.test_func, self.login_url)
+    
+    def __call__(self, request, *args, **kwargs):
+        if self.test_func(request.user):
+            return self.view_func(request, *args, **kwargs)
+        path = quote(request.get_full_path())
+        tup = self.login_url, REDIRECT_FIELD_NAME, path
+        return HttpResponseRedirect('%s?%s=%s' % tup)
+

tests/modeltests/test_client/models.py

@@ -218 +218 @@
-        self.assertEqual(response.status_code, 200)
-        self.assertEqual(response.context['user'].username, 'testclient')
-
+    def test_view_with_method_login(self):
+        "Request a page that is protected with a @login_required method"
+        
+        # Get the page without logging in. Should result in 302.
+        response = self.client.get('/test_client/login_protected_method_view/')
+        self.assertRedirects(response, '/accounts/login/')
+        
+        # Log in
+        self.client.login(username='testclient', password='password')
+
+        # Request a page that requires a login
+        response = self.client.get('/test_client/login_protected_method_view/')
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response.context['user'].username, 'testclient')
+
+    def test_view_with_permissions(self):
+        "Request a page that is protected with @permission_required"
+        
+        # Get the page without logging in. Should result in 302.
+        response = self.client.get('/test_client/permission_protected_view/')
+        self.assertRedirects(response, '/accounts/login/')
+        
+        # Log in with wrong permissions. Should result in 302.
+        self.client.login(username='testclient', password='password')
+        response = self.client.get('/test_client/permission_protected_view/')
+        self.assertRedirects(response, '/accounts/login/')
+
+        # TODO: Log in with right permissions and request the page again
+
+    def test_view_with_method_permissions(self):
+        "Request a page that is protected with a @permission_required method"
+        
+        # Get the page without logging in. Should result in 302.
+        response = self.client.get('/test_client/permission_protected_method_view/')
+        self.assertRedirects(response, '/accounts/login/')
+        
+        # Log in with wrong permissions. Should result in 302.
+        self.client.login(username='testclient', password='password')
+        response = self.client.get('/test_client/permission_protected_method_view/')
+        self.assertRedirects(response, '/accounts/login/')
+
+        # TODO: Log in with right permissions and request the page again
+
-    def test_view_with_bad_login(self):
-        "Request a page that is protected with @login, but use bad credentials"
-

tests/modeltests/test_client/urls.py

@@ -13 +13 @@
-    (r'^form_view/$', views.form_view),
-    (r'^form_view_with_template/$', views.form_view_with_template),
-    (r'^login_protected_view/$', views.login_protected_view),
+    (r'^permission_protected_view/$', views.permission_protected_view),
+    (r'^login_protected_method_view/$', views.login_protected_method_view),
+    (r'^permission_protected_method_view/$', views.permission_protected_method_view),
-    (r'^session_view/$', views.session_view),
-    (r'^broken_view/$', views.broken_view),
-    (r'^mail_sending_view/$', views.mail_sending_view),

tests/modeltests/test_client/views.py

@@ -2 +2 @@
-from django.core.mail import EmailMessage, SMTPConnection
-from django.template import Context, Template
-from django.http import HttpResponse, HttpResponseRedirect, HttpResponseNotFound
-
+, permission_required
-from django.newforms.forms import Form
-from django.newforms import fields
-from django.shortcuts import render_to_response
@@ -112 +112 @@
-def login_protected_view(request):
-    "A simple view that is login protected."
-    t = Template('This is a login protected test. Username is {{ user.username }}.', name='Login Template')
-
+
-    
-    return HttpResponse(t.render(c))
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-def session_view(request):
-    "A view that modifies the session"