Changeset 7935

Timestamp:

07/16/08 14:21:15 (4 months ago)

Author:

brosner

Message:

newforms-admin: Fixed #5490 -- Properly quote special characters in primary keys in the admin. Added tests to ensure functionality. This also moves quote and unquote to django/contrib/admin/util.py. Thanks jdetaeye and shanx for all your help.

Files:

• django/branches/newforms-admin/django/contrib/admin/models.py (modified) (2 diffs)
• django/branches/newforms-admin/django/contrib/admin/options.py (modified) (3 diffs)
• django/branches/newforms-admin/django/contrib/admin/util.py (modified) (1 diff)
• django/branches/newforms-admin/django/contrib/admin/views/main.py (modified) (2 diffs)
• django/branches/newforms-admin/django/db/models/base.py (modified) (1 diff)
• django/branches/newforms-admin/tests/regressiontests/admin_views/fixtures/string-primary-key.xml (added)
• django/branches/newforms-admin/tests/regressiontests/admin_views/models.py (modified) (1 diff)
• django/branches/newforms-admin/tests/regressiontests/admin_views/tests.py (modified) (2 diffs)

django/branches/newforms-admin/django/contrib/admin/models.py

@@ -2 +2 @@
-from django.contrib.contenttypes.models import ContentType
-from django.contrib.auth.models import User
+from django.contrib.admin.util import quote
-from django.utils.translation import ugettext_lazy as _
-from django.utils.encoding import smart_unicode
@@ -51 +52 @@
-        This is relative to the Django admin index page.
-        """
-self.object_id
+quote(self.object_id)

django/branches/newforms-admin/django/contrib/admin/options.py

@@ -6 +6 @@
-from django.contrib.contenttypes.models import ContentType
-from django.contrib.admin import widgets
-
+quote, unquote, 
-from django.core.exceptions import ImproperlyConfigured, PermissionDenied
-from django.db import models, transaction
@@ -24 +24 @@
-class IncorrectLookupParameters(Exception):
-    pass
-
-def unquote(s):
-    """
-    Undo the effects of quote(). Based heavily on urllib.unquote().
-    """
-    mychr = chr
-    myatoi = int
-    list = s.split('_')
-    res = [list[0]]
-    myappend = res.append
-    del list[0]
-    for item in list:
-        if item[1:2]:
-            try:
-                myappend(mychr(myatoi(item[:2], 16)) + item[2:])
-            except ValueError:
-                myappend('_' + item)
-        else:
-            myappend('_' + item)
-    return "".join(res)
-
-def flatten_fieldsets(fieldsets):
@@ -657 +637 @@
-        # Populate deleted_objects, a data structure of all related objects that
-        # will also be deleted.
-force_unicod
+quot
-        perms_needed = sets.Set()
-        get_deleted_objects(deleted_objects, perms_needed, request.user, obj, opts, 1, self.admin_site)

django/branches/newforms-admin/django/contrib/admin/util.py

@@ -6 +6 @@
-from django.utils.encoding import force_unicode
-from django.utils.translation import ugettext as _
+
+
+def quote(s):
+    """
+    Ensure that primary key values do not confuse the admin URLs by escaping
+    any '/', '_' and ':' characters. Similar to urllib.quote, except that the
+    quoting is slightly different so that it doesn't get automatically
+    unquoted by the Web browser.
+    """
+    if not isinstance(s, basestring):
+        return s
+    res = list(s)
+    for i in range(len(res)):
+        c = res[i]
+        if c in """:/_#?;@&=+$,"<>%\\""":
+            res[i] = '_%02X' % ord(c)
+    return ''.join(res)
+
+def unquote(s):
+    """
+    Undo the effects of quote(). Based heavily on urllib.unquote().
+    """
+    mychr = chr
+    myatoi = int
+    list = s.split('_')
+    res = [list[0]]
+    myappend = res.append
+    del list[0]
+    for item in list:
+        if item[1:2]:
+            try:
+                myappend(mychr(myatoi(item[:2], 16)) + item[2:])
+            except ValueError:
+                myappend('_' + item)
+        else:
+            myappend('_' + item)
+    return "".join(res)
-
-def _nest_help(obj, depth, val):

django/branches/newforms-admin/django/contrib/admin/views/main.py

@@ -1 +1 @@
-from django.contrib.admin.filterspecs import FilterSpec
-from django.contrib.admin.options import IncorrectLookupParameters
+from django.contrib.admin.util import quote
-from django.core.paginator import Paginator, InvalidPage
-from django.db import models
@@ -30 +31 @@
-# Text to display within change-list table cells if the value is blank.
-EMPTY_CHANGELIST_VALUE = '(None)'
-
-def quote(s):
-    """
-    Ensure that primary key values do not confuse the admin URLs by escaping
-    any '/', '_' and ':' characters. Similar to urllib.quote, except that the
-    quoting is slightly different so that it doesn't get automatically
-    unquoted by the Web browser.
-    """
-    if type(s) != type(''):
-        return s
-    res = list(s)
-    for i in range(len(res)):
-        c = res[i]
-        if c in ':/_':
-            res[i] = '_%02X' % ord(c)
-    return ''.join(res)
-
-class ChangeList(object):

django/branches/newforms-admin/django/db/models/base.py

@@ -138 +138 @@
-
-    def add_to_class(cls, name, value):
+        if name == 'Admin':
+            import warnings
+            warnings.warn("The inner Admin class for %s is no longer supported. "
+                "Please use a ModelAdmin instead." % cls.__name__)
-        if hasattr(value, 'contribute_to_class'):
-            value.contribute_to_class(cls, name)

django/branches/newforms-admin/tests/regressiontests/admin_views/models.py

@@ -49 +49 @@
-            }
-        )
+
+class ModelWithStringPrimaryKey(models.Model):
+    id = models.CharField(max_length=255, primary_key=True)
+    
+    def __unicode__(self):
+        return self.id
-        
-admin.site.register(Article, ArticleAdmin)
-admin.site.register(CustomArticle, CustomArticleAdmin)
-admin.site.register(Section)
+admin.site.register(ModelWithStringPrimaryKey)

django/branches/newforms-admin/tests/regressiontests/admin_views/tests.py

@@ -3 +3 @@
-from django.contrib.auth.models import User, Permission
-from django.contrib.contenttypes.models import ContentType
+from django.contrib.admin.models import LogEntry
-from django.contrib.admin.sites import LOGIN_FORM_KEY, _encode_post_data
+from django.contrib.admin.util import quote
+from django.utils.html import escape
-
-# local test models
-
+, ModelWithStringPrimaryKey
-
-def get_perm(Model, perm):
@@ -319 +322 @@
-        self.failUnlessEqual(Article.objects.all().count(), 0)
-        self.client.get('/test_admin/admin/logout/')
+
+class AdminViewStringPrimaryKeyTest(TestCase):
+    fixtures = ['admin-views-users.xml', 'string-primary-key.xml']
+    
+    def __init__(self, *args):
+        super(AdminViewStringPrimaryKeyTest, self).__init__(*args)
+        self.pk = """abcdefghijklmnopqrstuvwxyz ABCDEFGHIJKLMNOPQRSTUVWXYZ 1234567890 -_.!~*'() ;/?:@&=+$, <>#%" {}|\^[]`"""
+    
+    def setUp(self):
+        self.client.login(username='super', password='secret')
+        content_type_pk = ContentType.objects.get_for_model(ModelWithStringPrimaryKey).pk
+        LogEntry.objects.log_action(100, content_type_pk, self.pk, self.pk, 2, change_message='')
+    
+    def tearDown(self):
+        self.client.logout()
+    
+    def test_get_change_view(self):
+        "Retrieving the object using urlencoded form of primary key should work"
+        response = self.client.get('/test_admin/admin/admin_views/modelwithstringprimarykey/%s/' % quote(self.pk))
+        self.assertContains(response, escape(self.pk))
+        self.failUnlessEqual(response.status_code, 200)
+    
+    def test_changelist_to_changeform_link(self):
+        "The link from the changelist referring to the changeform of the object should be quoted"
+        response = self.client.get('/test_admin/admin/admin_views/modelwithstringprimarykey/')
+        should_contain = """<tr class="row1"><th><a href="%s/">%s</a></th></tr>""" % (quote(self.pk), escape(self.pk))
+        self.assertContains(response, should_contain)
+    
+    def test_recentactions_link(self):
+        "The link from the recent actions list referring to the changeform of the object should be quoted"
+        response = self.client.get('/test_admin/admin/')
+        should_contain = """<a href="admin_views/modelwithstringprimarykey/%s/">%s</a>""" % (quote(self.pk), escape(self.pk))
+        self.assertContains(response, should_contain)
+    
+    def test_deleteconfirmation_link(self):
+        "The link from the delete confirmation page referring back to the changeform of the object should be quoted"
+        response = self.client.get('/test_admin/admin/admin_views/modelwithstringprimarykey/%s/delete/' % quote(self.pk))
+        should_contain = """<a href="../../%s/">%s</a>""" % (quote(self.pk), escape(self.pk))
+        self.assertContains(response, should_contain)