Ticket #4617: django-auth-decorators-plus-tests.diff

django/contrib/auth/decorators.py

@@ -1 +1 @@
 from django.contrib.auth import REDIRECT_FIELD_NAME
-from django.http import HttpResponseRedirect
+from django.http import HttpResponseRedirect, HttpResponseForbidden
 from django.utils.http import urlquote
 
 def user_passes_test(test_func, login_url=None, redirect_field_name=REDIRECT_FIELD_NAME):
@@ -60 +60 @@
     def __call__(self, request, *args, **kwargs):
         if self.test_func(request.user):
             return self.view_func(request, *args, **kwargs)
-        path = urlquote(request.get_full_path())
-        tup = self.login_url, self.redirect_field_name, path
-        return HttpResponseRedirect('%s?%s=%s' % tup)
+        elif not request.user.is_authenticated():
+            path = urlquote(request.get_full_path())
+            tup = self.login_url, self.redirect_field_name, path
+            return HttpResponseRedirect('%s?%s=%s' % tup)
+        else:
+            return HttpResponseForbidden('<h1>Permission denied</h1>')
+

django/test/testcases.py

@@ -101 +101 @@
              " (expected %d)") %
                  (path, redirect_response.status_code, target_status_code))
 
+    def assertStatusCode(self, response, status_code):
+        """Asserts that a response had a scecific status code."""
+        self.assertEqual(response.status_code, status_code,
+            ("Wrong status code: Response code was %d"
+             " (expected %d)" % (response.status_code, status_code)))
+
     def assertContains(self, response, text, count=None, status_code=200):
         """
         Asserts that a response indicates that a page was retreived

tests/modeltests/test_client/models.py

@@ -325 +325 @@
         login = self.client.login(username='testclient', password='password')
         self.failUnless(login, 'Could not log in')
 
-        # Log in with wrong permissions. Should result in 302.
+        # Log in with wrong permissions. Should result in 403 (Forbidden).
         response = self.client.get('/test_client/permission_protected_view/')
-        self.assertRedirects(response, 'http://testserver/accounts/login/?next=/test_client/permission_protected_view/')
+        self.assertStatusCode(response, 403)
 
         # TODO: Log in with right permissions and request the page again
 
@@ -342 +342 @@
         login = self.client.login(username='testclient', password='password')
         self.failUnless(login, 'Could not log in')
 
-        # Log in with wrong permissions. Should result in 302.
+        # Log in with wrong permissions. Should result in 403 (Forbidden).
         response = self.client.get('/test_client/permission_protected_method_view/')
-        self.assertRedirects(response, 'http://testserver/accounts/login/?next=/test_client/permission_protected_method_view/')
+        self.assertStatusCode(response, 403)
 
         # TODO: Log in with right permissions and request the page again