Ticket #8968: fix_8968_v4.patch

new file .gitignore

@@ +1 @@
+*.pyc

django/contrib/comments/views/moderation.py

@@ -34 +34 @@
             created = created,
             request = request,
         )
-        return next_redirect(request.POST.copy(), next, flag_done, c=comment.pk)
+        if request.POST.has_key('next'):
+            next = request.POST.get('next')
+        elif request.GET.has_key('next'):
+            next = request.GET.get('next')
+        return next_redirect(request.POST.copy(),next, flag_done, c=comment.pk)
 
     # Render a form on GET
     else:
+        next = request.GET.get('next',next)
         return render_to_response('comments/flag.html',
             {'comment': comment, "next": next},
             template.RequestContext(request)
@@ -74 +79 @@
             created = created,
             request = request,
         )
+        if request.POST.has_key('next'):
+            next = request.POST.get('next')
+        elif request.GET.has_key('next'):
+            next = request.GET.get('next')
         return next_redirect(request.POST.copy(), next, delete_done, c=comment.pk)
 
     # Render a form on GET
     else:
+        next = request.GET.get('next',next)
         return render_to_response('comments/delete.html',
             {'comment': comment, "next": next},
             template.RequestContext(request)
@@ -117 +127 @@
             created = created,
             request = request,
         )
+        if request.POST.has_key('next'):
+            next = request.POST.get('next')
+        elif request.GET.has_key('next'):
+            next = request.GET.get('next')
         return next_redirect(request.POST.copy(), next, approve_done, c=comment.pk)
 
     # Render a form on GET
     else:
+        next = request.GET.get('next',next)
         return render_to_response('comments/approve.html',
             {'comment': comment, "next": next},
             template.RequestContext(request)

docs/ref/contrib/comments/index.txt

@@ -24 +24 @@
 
 To get started using the ``comments`` app, follow these steps:
 
-    #. Install the comments framework by adding ``'django.contrib.comments'`` to    
+    #. Install the comments framework by adding ``'django.contrib.comments'`` to
        :setting:`INSTALLED_APPS`.
 
     #. Run ``manage.py syncdb`` so that Django will create the comment tables.
 
     #. Add the comment app's URLs to your project's ``urls.py``:
-   
+
        .. code-block:: python
 
             urlpatterns = patterns('',
@@ -41 +41 @@
 
     #. Use the `comment template tags`_ below to embed comments in your
        templates.
-    
+
 You might also want to examine :ref:`ref-contrib-comments-settings`.
-    
+
 Comment template tags
 =====================
 
@@ -67 +67 @@
     #. Refer to the object directly -- the more common method. Most of the
        time, you'll have some object in the template's context you want
        to attach the comment to; you can simply use that object.
-       
-       For example, in a blog entry page that has a variable named ``entry``, 
+
+       For example, in a blog entry page that has a variable named ``entry``,
        you could use the following to load the number of comments::
-       
+
             {% get_comment_count for entry as comment_count %}.
-            
+
     #. Refer to the object by content-type and object id. You'd use this method
        if you, for some reason, don't actually have direct access to the object.
-       
+
        Following the above example, if you knew the object ID was ``14`` but
        didn't have access to the actual object, you could do something like::
-       
+
             {% get_comment_count for blog.entry 14 as comment_count %}
-            
+
        In the above, ``blog.entry`` is the app label and (lower-cased) model
        name of the model class.
 
@@ -99 +99 @@
     {% for comment in comment_list %}
         ...
     {% endfor %}
-    
+
 This returns a list of :class:`~django.contrib.comments.models.Comment` objects;
 see :ref:`the comment model documentation <ref-contrib-comments-models>` for
 details.
@@ -116 +116 @@
 For example::
 
         {% get_comment_count for event as comment_count %}
-        
+
         <p>This event has {{ comment_count }} comments.</p>
-        
+
 
 Displaying the comment post form
 --------------------------------
@@ -153 +153 @@
 you can use in the template::
 
     {% get_comment_form for [object] as [varname] %}
-    
+
 A complete form might look like::
 
     {% get_comment_form for event as form %}
@@ -164 +164 @@
         <td><input type="submit" name="preview" class="submit-post" value="Preview"></td>
       </tr>
     </form>
-    
+
 Be sure to read the `notes on the comment form`_, below, for some special
 considerations you'll need to make if you're using this approach.
 
@@ -185 +185 @@
 
 To specify the URL you want to redirect to after the comment has been posted,
 you can include a hidden form input called ``next`` in your comment form. For example::
- 
+
     <input type="hidden" name="next" value="{% url my_comment_was_posted %}" />
 
+The ``next`` parameter can be passed into the comment system in a variety of ways,
+but POST will always be preferred over GET and the named parameter is always overridden.
+
+A ``next`` parameter can be specified in ``urls.py`` with the following line::
+
+    (r'^flag/(\d+)/$', flag, {'next': '/I/am/done/'})
+
 .. _notes-on-the-comment-form:
 
 Notes on the comment form
@@ -198 +205 @@
 
     * It contains a number of hidden fields that contain timestamps, information
       about the object the comment should be attached to, and a "security hash"
-      used to validate this information. If someone tampers with this data -- 
+      used to validate this information. If someone tampers with this data --
       something comment spammers will try -- the comment submission will fail.
-      
+
       If you're rendering a custom comment form, you'll need to make sure to
       pass these values through unchanged.
-      
+
     * The timestamp is used to ensure that "reply attacks" can't continue very
       long. Users who wait too long between requesting the form and posting a
       comment will have their submissions refused.
-      
+
     * The comment form includes a "honeypot_" field. It's a trap: if any data is
       entered in that field, the comment will be considered spam (spammers often
       automatically fill in all fields in an attempt to make valid submissions).
-      
+
       The default form hides this field with a piece of CSS and further labels
       it with a warning field; if you use the comment form with a custom
       template you should be sure to do the same.
-    
+
 .. _honeypot: http://en.wikipedia.org/wiki/Honeypot_(computing)
 
 More information

tests/regressiontests/comment_tests/tests/moderation_view_tests.py

@@ -3 +3 @@
 from django.contrib.contenttypes.models import ContentType
 from regressiontests.comment_tests.tests import CommentTestCase
 from django.contrib.comments import signals
-
+from django.contrib.comments.views.moderation import delete
+import re
 class FlagViewTests(CommentTestCase):
 
     def testFlagGet(self):
@@ -92 +93 @@
         self.client.login(username="normaluser", password="normaluser")
         response = self.client.post("/delete/%d/" % pk)
         self.assertEqual(response["Location"], "http://testserver/deleted/?c=%d" % pk)
+        
+        response = self.client.post("/delete/%d/" % pk,{"next":"/somewhere/else/"})
+        location = response["Location"]        
+        match = re.search(r"^http://testserver/somewhere/else/\?c=\d+$", location)
+        self.failUnless(match != None, "Unexpected redirect location: %s" % location)
         c = Comment.objects.get(pk=pk)
         self.failUnless(c.is_removed)
         self.assertEqual(c.flags.filter(flag=CommentFlag.MODERATOR_DELETION, user__username="normaluser").count(), 1)
@@ -106 +112 @@
 
         # Post a comment and check the signals
         self.testDeletePost()
-        self.assertEqual(received_signals, [signals.comment_was_flagged])
+        self.assertEqual(received_signals, [signals.comment_was_flagged,signals.comment_was_flagged])
 
     def testDeletedView(self):
         comments = self.createSomeComments()
         pk = comments[0].pk        
         response = self.client.get("/deleted/", data={"c":pk})
         self.assertTemplateUsed(response, "comments/deleted.html")
+        
+    def testDeletedViewNextGet(self):
+        comments = self.createSomeComments()
+        pk = comments[0].pk        
+        makeModerator("normaluser")
+        self.client.login(username="normaluser", password="normaluser")
+        response = self.client.get("/delete/%d/" % pk, data={"next":"/somewhere/else"})
+        self.assertEqual(response.context[1]['next'],"/somewhere/else")
+        self.assertTemplateUsed(response, "comments/delete.html")
+        
 
 class ApproveViewTests(CommentTestCase):
 

tests/regressiontests/comment_tests/urls.py

@@ -5 +5 @@
     url(r'^flag/(\d+)/$',    'custom_flag_comment'),
     url(r'^delete/(\d+)/$',  'custom_delete_comment'),
     url(r'^approve/(\d+)/$', 'custom_approve_comment'),
+   
 )
-