Ticket #8049: 8049.diff

django/contrib/admin/sites.py

@@ -139 +139 @@
         Returns True if the given HttpRequest has permission to view
         *at least one* page in the admin site.
         """
-        return request.user.is_staff
+        return request.user.is_active and request.user.is_staff
 
     def check_dependencies(self):
         """

django/contrib/admin/templates/admin/base.html

@@ -22 +22 @@
         <div id="branding">
         {% block branding %}{% endblock %}
         </div>
-        {% if user.is_staff %}
+        {% if user.is_active and user.is_staff %}
         <div id="user-tools">
             {% trans 'Welcome,' %}
             <strong>{% firstof user.first_name user.username %}</strong>.

django/contrib/admin/views/decorators.py

@@ -28 +28 @@
     member, displaying the login page if necessary.
     """
     def _checklogin(request, *args, **kwargs):
-        if request.user.is_staff:
+        if request.user.is_active and request.user.is_staff:
             # The user is valid. Continue to the admin page.
             return view_func(request, *args, **kwargs)
 

django/contrib/auth/tests/auth_backends.py

@@ -29 +29 @@
         user.is_superuser = False
         user.save()
         self.assertEqual(user.has_perm('auth.test'), False)
+        user.is_staff = True
+        user.is_superuser = True
+        user.is_active = False
+        user.save()
+        self.assertEqual(user.has_perm('auth.test'), False)
 
     def test_custom_perms(self):
         user = User.objects.get(username='test')

django/core/xheaders.py

@@ -18 +18 @@
     """
     from django.conf import settings
     if (request.META.get('REMOTE_ADDR') in settings.INTERNAL_IPS
-            or (hasattr(request, 'user') and request.user.is_authenticated()
+            or (hasattr(request, 'user') and request.user.is_active
                 and request.user.is_staff)):
         response['X-Object-Type'] = "%s.%s" % (model._meta.app_label, model._meta.object_name.lower())
         response['X-Object-Id'] = str(object_id)

django/middleware/doc.py

@@ -12 +12 @@
         indicating the view function.  This is used by the documentation module
         to lookup the view function for an arbitrary page.
         """
-        if request.method == 'HEAD' and (request.META.get('REMOTE_ADDR') in settings.INTERNAL_IPS or request.user.is_staff):
+        if request.method == 'HEAD' and (request.META.get('REMOTE_ADDR') in settings.INTERNAL_IPS or
+                                         (request.user.is_active and request.user.is_staff)):
             response = http.HttpResponse()
             response['X-View'] = "%s.%s" % (view_func.__module__, view_func.__name__)
             return response

tests/regressiontests/admin_views/tests.py

@@ -602 +602 @@
         self.failUnlessEqual(logged.object_id, u'1')
         self.client.get('/test_admin/admin/logout/')
 
+    def testDisabledPermissionsWhenLoggedIn(self):
+        self.client.login(username='super', password='secret')
+        superuser = User.objects.get(username='super')
+        superuser.is_active = False
+        superuser.save()
+
+        response = self.client.get('/test_admin/admin/')
+        self.assertContains(response, 'id="login-form"')
+        self.assertNotContains(response, 'Log out')
+
+        response = self.client.get('/test_admin/admin/secure-view/')
+        open('/home/maniac/Desktop/response.html', 'w').write(response.content)
+        self.assertContains(response, 'id="login-form"')
+
 class AdminViewStringPrimaryKeyTest(TestCase):
     fixtures = ['admin-views-users.xml', 'string-primary-key.xml']
 
@@ -622 +636 @@
         response = self.client.get('/test_admin/admin/admin_views/modelwithstringprimarykey/%s/history/' % quote(self.pk))
         self.assertContains(response, escape(self.pk))
         self.failUnlessEqual(response.status_code, 200)
- 
+
     def test_get_change_view(self):
         "Retrieving the object using urlencoded form of primary key should work"
         response = self.client.get('/test_admin/admin/admin_views/modelwithstringprimarykey/%s/' % quote(self.pk))

tests/regressiontests/special_headers/fixtures/data.xml

@@ +1 @@
+<?xml version="1.0" encoding="utf-8"?>
+<django-objects version="1.0">
+    <object pk="100" model="auth.user">
+        <field type="CharField" name="username">super</field>
+        <field type="CharField" name="first_name">Super</field>
+        <field type="CharField" name="last_name">User</field>
+        <field type="CharField" name="email">super@example.com</field>
+        <field type="CharField" name="password">sha1$995a3$6011485ea3834267d719b4c801409b8b1ddd0158</field>
+        <field type="BooleanField" name="is_staff">True</field>
+        <field type="BooleanField" name="is_active">True</field>
+        <field type="BooleanField" name="is_superuser">True</field>
+        <field type="DateTimeField" name="last_login">2007-05-30 13:20:10</field>
+        <field type="DateTimeField" name="date_joined">2007-05-30 13:20:10</field>
+        <field to="auth.group" name="groups" rel="ManyToManyRel"></field>
+        <field to="auth.permission" name="user_permissions" rel="ManyToManyRel"></field>
+    </object>
+    <object pk="1" model="special_headers.article">
+        <field type="TextField" name="text">text</field>
+    </object>
+</django-objects>

tests/regressiontests/special_headers/models.py

@@ +1 @@
+from django.db import models
+
+class Article(models.Model):
+    text = models.TextField()

tests/regressiontests/special_headers/templates/special_headers/article_detail.html

@@ +1 @@
+{{ object }}

tests/regressiontests/special_headers/tests.py

@@ +1 @@
+from django.test import TestCase
+from django.contrib.auth.models import User
+
+class SpecialHeadersTest(TestCase):
+    fixtures = ['data.xml']
+
+    def test_xheaders(self):
+        user = User.objects.get(username='super')
+        response = self.client.get('/special_headers/article/1/')
+        # import pdb; pdb.set_trace()
+        self.failUnless('X-Object-Type' not in response)
+        self.client.login(username='super', password='secret')
+        response = self.client.get('/special_headers/article/1/')
+        self.failUnless('X-Object-Type' in response)
+        user.is_staff = False
+        user.save()
+        response = self.client.get('/special_headers/article/1/')
+        self.failUnless('X-Object-Type' not in response)
+        user.is_staff = True
+        user.is_active = False
+        user.save()
+        response = self.client.get('/special_headers/article/1/')
+        self.failUnless('X-Object-Type' not in response)
+
+    def test_xview(self):
+        user = User.objects.get(username='super')
+        response = self.client.head('/special_headers/xview/')
+        self.failUnless('X-View' not in response)
+        self.client.login(username='super', password='secret')
+        response = self.client.head('/special_headers/xview/')
+        self.failUnless('X-View' in response)
+        user.is_staff = False
+        user.save()
+        response = self.client.head('/special_headers/xview/')
+        self.failUnless('X-View' not in response)
+        user.is_staff = True
+        user.is_active = False
+        user.save()
+        response = self.client.head('/special_headers/xview/')
+        self.failUnless('X-View' not in response)

tests/regressiontests/special_headers/urls.py

@@ +1 @@
+# coding: utf-8
+from django.conf.urls.defaults import *
+from django.views.generic.list_detail import object_detail
+from models import Article
+import views
+
+urlpatterns = patterns('',
+    (r'^article/(?P<object_id>\d+)/$', object_detail, {'queryset': Article.objects.all()}),
+    (r'^xview/$', views.xview),
+)

tests/regressiontests/special_headers/views.py

@@ +1 @@
+# -*- coding:utf-8 -*-
+from django.http import HttpResponse
+from django.utils.decorators import decorator_from_middleware
+from django.middleware.doc import XViewMiddleware
+
+xview_dec = decorator_from_middleware(XViewMiddleware)
+
+def xview(request):
+    return HttpResponse()
+xview = xview_dec(xview)

tests/urls.py

@@ -35 +35 @@
 
     # conditional get views
     (r'condition/', include('regressiontests.conditional_processing.urls')),
+
+    # special headers views
+    (r'special_headers/', include('regressiontests.special_headers.urls')),
 )