Ticket #15671: no-hasattr3.diff

django/contrib/auth/tests/remote_user.py

@@ -1 +1 @@
 from datetime import datetime
 
 from django.conf import settings
+from django.contrib.auth import middleware
 from django.contrib.auth.backends import RemoteUserBackend
 from django.contrib.auth.models import User
+from django.core.exceptions import ImproperlyConfigured
+from django.core.handlers.wsgi import WSGIRequest
 from django.test import TestCase
 
 
@@ -92 +95 @@
         response = self.client.get('/remote_user/', REMOTE_USER=self.known_user)
         self.assertEqual(default_login, response.context['user'].last_login)
 
+    def test_auth_middleware_required(self):
+        """
+        Tests that an ImproperlyConfigured exception is raised when the
+        AuthenticationMiddleware is not properly installed.
+        """
+        # Remove the AuthenticationMiddleware.
+        middleware = 'django.contrib.auth.middleware.AuthenticationMiddleware'
+        settings.MIDDLEWARE_CLASSES = filter(lambda x: x != middleware,
+                                             settings.MIDDLEWARE_CLASSES)
+        # Cleanup the side-effects of having the AuthenticationMiddleware
+        # installed in a previous test run.
+        if WSGIRequest.__dict__.get('user'):
+          del WSGIRequest.user
+        self.assertRaises(ImproperlyConfigured, self.client.get,
+                          '/remote_user/', REMOTE_USER=self.known_user)
+
+    def test_raises_attribute_error(self):
+        """
+        Tests that an AttributeError exception raised when accessing
+        request.user should bubble up when the AuthenticationMiddleware is
+        properly installed.
+        """
+        class BrokenLazyUser(object):
+            def __get__(self, request, obj_type=None):
+                raise AttributeError
+        curr_lazy_user = middleware.LazyUser
+        middleware.LazyUser = BrokenLazyUser
+        try:
+            self.assertRaises(AttributeError, self.client.get, '/remote_user/',
+                              REMOTE_USER=self.known_user)
+        finally:
+            middleware.LazyUser = curr_lazy_user
+
     def tearDown(self):
         """Restores settings to avoid breaking other tests."""
         settings.MIDDLEWARE_CLASSES = self.curr_middleware

django/contrib/auth/middleware.py

@@ -38 +38 @@
 
     def process_request(self, request):
         # AuthenticationMiddleware is required so that request.user exists.
-        if not hasattr(request, 'user'):
+        # Accessing the request.user attribute itself may result in an
+        # AttributeError being raised during the process of lazily loading the
+        # real User object.  We want to allow that exception to raise, so we
+        # only check that the LazyUser is present on the request class.
+        if request.__class__.__dict__.get('user', None) is None:
             raise ImproperlyConfigured(
                 "The Django remote user auth middleware requires the"
                 " authentication middleware to be installed.  Edit your"