Page '
'test '
"has the same url 'test' as current page.
"
).format(self.get_page_change_uri("en", page2))
self.assertEqual(response.status_code, 200)
self.assertContains(response, expected_error, html=True)
@override_settings(CMS_PERMISSION=False)
def test_reverse_id_error_location(self):
superuser = self.get_superuser()
create_page("Page 1", "nav_playground.html", "en", reverse_id="p1")
page2 = create_page("Page 2", "nav_playground.html", "en")
page2_endpoint = self.get_admin_url(Page, "advanced", page2.pk)
# Assemble a bunch of data to test the page form
page2_data = {
"reverse_id": "p1",
"template": "col_two.html",
}
with self.login_user_context(superuser):
response = self.client.post(page2_endpoint, page2_data)
expected_error = '
' "
A page with this reverse URL id exists already.
"
self.assertEqual(response.status_code, 200)
self.assertContains(response, expected_error.format(page2.pk), html=True)
@override_settings(CMS_PERMISSION=False)
def test_advanced_settings_endpoint_fails_gracefully(self):
admin_user = self.get_superuser()
page = create_page("Page 1", "nav_playground.html", "en")
page_data = {
"language": "en",
"template": "col_two.html",
}
path = admin_reverse("cms_page_advanced", args=(page.pk,))
# It's important to test fields that are validated
# automatically by Django vs fields that are validated
# via the clean() method by us.
# Fields validated by Django will not be in cleaned data
# if they have an error so if we rely on these in the clean()
# method then an error will be raised.
# So test that the form short circuits if there's errors.
page_data["application_urls"] = "TestApp"
with self.login_user_context(admin_user):
response = self.client.post(path, page_data)
# Assert user is not redirected because there was a form error
self.assertEqual(response.status_code, 200)
page = page.reload()
# Make sure no change was made
self.assertEqual(page.application_urls, None)
@override_settings(CMS_PERMISSION=True)
def test_advanced_settings_endpoint_permissions(self):
"""
Test that the advanced settings endpoint respects various permission levels
"""
admin_user = self.get_superuser()
staff_user = self._get_staff_user(use_global_permissions=False)
page = create_page("Page 1", "nav_playground.html", "en", created_by=admin_user)
path = admin_reverse("cms_page_advanced", args=(page.pk,))
# Test with no permissions
with self.login_user_context(staff_user):
response = self.client.get(path)
self.assertEqual(response.status_code, 403)
# Test with change permission only (no advanced settings permission)
gpp = GlobalPagePermission.objects.create(
user=staff_user,
can_change=True,
can_change_advanced_settings=False,
)
gpp.sites.set(Site.objects.all())
with self.login_user_context(staff_user):
response = self.client.get(path)
self.assertEqual(response.status_code, 403)
# Test with advanced settings permission only
gpp.can_change = False
gpp.can_change_advanced_settings = True
gpp.save()
with self.login_user_context(staff_user):
response = self.client.get(path)
self.assertEqual(response.status_code, 403)
# Test with both permissions
gpp.can_change = True
gpp.can_change_advanced_settings = True
gpp.save()
with self.login_user_context(staff_user):
response = self.client.get(path)
# Check that advanced settings fields are present
self.assertContains(response, 'name="reverse_id"')
self.assertContains(response, 'name="application_urls"')
# Test with permissions change permission only
gpp.can_change_advanced_settings = False
gpp.can_change_permissions = True
gpp.save()
# Ensure no advanced settings fields are shown without proper permissions
with self.login_user_context(staff_user):
response = self.client.get(path)
self.assertNotContains(response, 'name="reverse_id"')
self.assertNotContains(response, 'name="application_urls"')
def test_advanced_settings_toolbar_entry(self):
"""
Test that the advanced settings toolbar entry is only shown to users with appropriate permissions
and offers the correct content
"""
admin_user = self.get_superuser()
staff_user = self._get_staff_user(use_global_permissions=False)
page = create_page("Test Page", "nav_playground.html", "en", created_by=admin_user)
page_url = get_object_edit_url(page.get_admin_content("en"))
advanced_settings_url = admin_reverse("cms_page_advanced", args=(page.pk,))
snippet = """
"""
disabled_snippet = snippet.format("cms-toolbar-item-navigation-disabled", 'tabindex="-1" ', advanced_settings_url)
enabled_snippet = snippet.format("", "", advanced_settings_url)
# Test with admin user - should see advanced settings
with self.login_user_context(admin_user):
response = self.client.get(page_url)
self.assertEqual(response.status_code, 200)
# Check for advanced settings in toolbar
self.assertContains(response, enabled_snippet, html=True)
# Test with staff user with no permissions
with self.login_user_context(staff_user):
response = self.client.get(page_url)
# Should not contain advanced settings link
self.assertContains(response, disabled_snippet, html=True)
# Test with change permission but no advanced settings permission
gpp = GlobalPagePermission.objects.create(
user=staff_user,
can_change_permissions=True,
can_change_advanced_settings=False,
)
gpp.sites.set(Site.objects.all())
with self.login_user_context(staff_user):
response = self.client.get(page_url)
self.assertContains(response, enabled_snippet, html=True)
# Test with permissions change permissions only
gpp.can_change_permissions = False
gpp.can_change_advanced_settings = True
gpp.save()
with self.login_user_context(staff_user):
response = self.client.get(page_url)
self.assertContains(response, enabled_snippet, html=True)
def test_advanced_settings_returns_404(self):
invalid_page_pk = 0
path = admin_reverse("cms_page_advanced", args=(invalid_page_pk,))
with self.login_user_context(self.get_superuser()):
response = self.client.get(path)
self.assertEqual(response.status_code, 404)
def test_render_edit_mode(self):
from django.core.cache import cache
cache.clear()
homepage = create_page("Test", "static.html", "en")
homepage.set_as_homepage()
for placeholder in homepage.get_placeholders("en"):
add_plugin(placeholder, TextPlugin, "en", body="Test")
user = self.get_superuser()
self.assertEqual(homepage.get_placeholders("en").count(), 2)
with self.login_user_context(user):
output = force_str(self.client.get("/en/").content)
self.assertIn("Test", output)
for placeholder in homepage.get_placeholders("en"):
add_plugin(placeholder, TextPlugin, "en", body="Test")
output = force_str(self.client.get("/en/").content)
self.assertIn("Test", output)
def test_tree_view_queries(self):
from django.core.cache import cache
cache.clear()
for i in range(10):
create_page("Test%s" % i, "col_two.html", "en")
for placeholder in Placeholder.objects.all():
add_plugin(placeholder, TextPlugin, "en", body="Test")
user = self.get_superuser()
with self.login_user_context(user):
with self.assertNumQueries(8):
force_str(self.client.get(self.get_pages_admin_list_uri("en")))
def test_smart_link_pages(self):
admin, staff_guy = self._get_guys()
page_url = URL_CMS_PAGE_PUBLISHED # Not sure how to achieve this with reverse...
create_page("home", "col_two.html", "en")
with self.login_user_context(staff_guy):
multi_title_page = create_page(
"main_title", "col_two.html", "en", overwrite_url="overwritten_url", menu_title="menu_title"
)
title = multi_title_page.get_content_obj()
title.page_title = "page_title"
title.save()
multi_title_page.save()
# Non ajax call should return a 403 as this page shouldn't be accessed by anything else but ajax queries
self.assertEqual(403, self.client.get(page_url).status_code)
self.assertEqual(200, self.client.get(page_url, HTTP_X_REQUESTED_WITH="XMLHttpRequest").status_code)
# Test that the query param is working as expected.
self.assertEqual(
1,
len(
json.loads(
self.client.get(
page_url, {"q": "main_title"}, HTTP_X_REQUESTED_WITH="XMLHttpRequest"
).content.decode("utf-8")
)
),
)
self.assertEqual(
1,
len(
json.loads(
self.client.get(
page_url, {"q": "menu_title"}, HTTP_X_REQUESTED_WITH="XMLHttpRequest"
).content.decode("utf-8")
)
),
)
self.assertEqual(
1,
len(
json.loads(
self.client.get(
page_url, {"q": "overwritten_url"}, HTTP_X_REQUESTED_WITH="XMLHttpRequest"
).content.decode("utf-8")
)
),
)
self.assertEqual(
1,
len(
json.loads(
self.client.get(
page_url, {"q": "page_title"}, HTTP_X_REQUESTED_WITH="XMLHttpRequest"
).content.decode("utf-8")
)
),
)
class PagePropsMovedToPageContentTests(CMSTestCase):
def test_moved_fields(self):
non_editables = [
"id",
"changed_by",
"changed_date",
"created_by",
"creation_date",
"page_id",
"in_navigation",
"language",
]
change_page_form_fieldsets = flatten_fieldsets(ChangePageForm.fieldsets)
page_content_fields = [field.attname for field in PageContent._meta.fields]
# filter the non editables from PageContent fields
filtered_page_content_fields = list(set(page_content_fields) - set(non_editables))
for field in filtered_page_content_fields:
self.assertIn(field, change_page_form_fieldsets)
class AdminPageEditContentSizeTests(AdminTestsBase):
"""
System user count influences the size of the page edit page,
but the users are only 2 times present on the page
The test relates to extra=0
at PagePermissionInlineAdminForm and ViewRestrictionInlineAdmin
"""
def test_editpage_contentsize(self):
"""
Expected a username only 2 times in the content, but a relationship
between usercount and pagesize
"""
with self.settings(CMS_PERMISSION=True):
admin_user = self.get_superuser()
PAGE_NAME = "TestPage"
USER_NAME = "test_size_user_0"
current_site = Site.objects.get(pk=1)
page = create_page(PAGE_NAME, "nav_playground.html", "en", site=current_site, created_by=admin_user)
page.save()
self._page = page
with self.login_user_context(admin_user):
url = base.URL_CMS_PAGE_ADVANCED_CHANGE % self._page.pk
response = self.client.get(url)
self.assertEqual(response.status_code, 200)
old_response_size = len(response.content)
old_user_count = get_user_model().objects.count()
# create additional user and reload the page
get_user_model().objects.create_user(
username=USER_NAME, email=USER_NAME + "@django-cms.org", password=USER_NAME
)
user_count = get_user_model().objects.count()
more_users_in_db = old_user_count < user_count
# we have more users
self.assertTrue(more_users_in_db, "New users got NOT created")
response = self.client.get(url)
new_response_size = len(response.content)
page_size_grown = old_response_size < new_response_size
# expect that the pagesize gets influenced by the useramount of the system
self.assertTrue(page_size_grown, "Page size has not grown after user creation")
# usernames are only 2 times in content
text = smart_str(response.content, response.charset)
foundcount = text.count(USER_NAME)
# 2 forms contain usernames as options
self.assertEqual(
foundcount,
2,
f"Username {USER_NAME} appeared {foundcount} times in response.content, expected 2 times",
)
class AdminPageTreeTests(AdminTestsBase):
def test_move_node(self):
admin_user, staff = self._get_guys()
page_admin = self.page_admin_class
alpha = create_page("Alpha", "nav_playground.html", "en")
beta = create_page("Beta", TEMPLATE_INHERITANCE_MAGIC, "en")
gamma = create_page("Gamma", TEMPLATE_INHERITANCE_MAGIC, "en")
delta = create_page("Delta", TEMPLATE_INHERITANCE_MAGIC, "en")
# Current structure:
#
# ⊢ Alpha
# ⊢ Beta
# ⊢ Gamma
# ⊢ Delta
# Move Beta to be a child of Alpha
data = {
"id": beta.pk,
"position": 0,
"target": alpha.pk,
}
with self.login_user_context(admin_user):
request = self.get_request(post_data=data)
response = page_admin.move_page(request, page_id=beta.pk)
data = json.loads(response.content.decode("utf8"))
self.assertEqual(response.status_code, 200)
self.assertEqual(data["status"], 200)
alpha.refresh_from_db()
self.assertEqual(alpha.get_descendants().count(), 1)
# Current structure:
#
# ⊢ Alpha
# ⊢ Beta
# ⊢ Gamma
# ⊢ Delta
# Move Gamma to be a child of Beta
data = {
"id": gamma.pk,
"position": 0,
"target": beta.pk,
}
with self.login_user_context(admin_user):
request = self.get_request(post_data=data)
response = page_admin.move_page(request, page_id=gamma.pk)
data = json.loads(response.content.decode("utf8"))
self.assertEqual(response.status_code, 200)
self.assertEqual(data["status"], 200)
alpha.refresh_from_db()
self.assertEqual(alpha.get_descendants().count(), 2)
beta.refresh_from_db()
self.assertEqual(beta.get_descendants().count(), 1)
# Current structure:
#
# ⊢ Alpha
# ⊢ Beta
# ⊢ Gamma
# ⊢ Delta
# Move Delta to be a child of Beta
data = {
"id": delta.pk,
"position": 0,
"target": gamma.pk,
}
with self.login_user_context(admin_user):
request = self.get_request(post_data=data)
response = page_admin.move_page(request, page_id=delta.pk)
data = json.loads(response.content.decode("utf8"))
self.assertEqual(response.status_code, 200)
self.assertEqual(data["status"], 200)
alpha.refresh_from_db()
self.assertEqual(alpha.get_descendants().count(), 3)
beta.refresh_from_db()
self.assertEqual(beta.get_descendants().count(), 2)
gamma.refresh_from_db()
self.assertEqual(gamma.get_descendants().count(), 1)
# Current structure:
#
# ⊢ Alpha
# ⊢ Beta
# ⊢ Gamma
# ⊢ Delta
# Move Beta to the root as node #1 (positions are 0-indexed)
data = {
"id": beta.pk,
"position": 1,
}
with self.login_user_context(admin_user):
request = self.get_request(post_data=data)
response = page_admin.move_page(request, page_id=beta.pk)
data = json.loads(response.content.decode("utf8"))
self.assertEqual(response.status_code, 200)
self.assertEqual(data["status"], 200)
alpha.refresh_from_db()
self.assertEqual(alpha.get_descendants().count(), 0)
beta.refresh_from_db()
self.assertEqual(beta.get_descendants().count(), 2)
gamma.refresh_from_db()
self.assertEqual(gamma.get_descendants().count(), 1)
# Current structure:
#
# ⊢ Alpha
# ⊢ Beta
# ⊢ Gamma
# ⊢ Delta
# Move Beta to be a child of Alpha again
data = {
"id": beta.pk,
"position": 0,
"target": alpha.pk,
}
with self.login_user_context(admin_user):
request = self.get_request(post_data=data)
response = page_admin.move_page(request, page_id=beta.pk)
data = json.loads(response.content.decode("utf8"))
self.assertEqual(response.status_code, 200)
self.assertEqual(data["status"], 200)
alpha.refresh_from_db()
self.assertEqual(alpha.get_descendants().count(), 3)
beta.refresh_from_db()
self.assertEqual(beta.get_descendants().count(), 2)
gamma.refresh_from_db()
self.assertEqual(gamma.get_descendants().count(), 1)
# Current structure:
#
# ⊢ Alpha
# ⊢ Beta
# ⊢ Gamma
# ⊢ Delta
# Move Gamma to the root as node #1 (positions are 0-indexed)
data = {
"id": gamma.pk,
"position": 1,
}
with self.login_user_context(admin_user):
request = self.get_request(post_data=data)
response = page_admin.move_page(request, page_id=gamma.pk)
data = json.loads(response.content.decode("utf8"))
self.assertEqual(response.status_code, 200)
self.assertEqual(data["status"], 200)
alpha.refresh_from_db()
self.assertEqual(alpha.get_descendants().count(), 1)
beta.refresh_from_db()
self.assertEqual(beta.get_descendants().count(), 0)
gamma.refresh_from_db()
self.assertEqual(gamma.get_descendants().count(), 1)
# Current structure:
#
# ⊢ Alpha
# ⊢ Beta
# ⊢ Gamma
# ⊢ Delta
# Move Delta to the root as node #1 (positions are 0-indexed)
data = {
"id": delta.pk,
"position": 1,
}
with self.login_user_context(admin_user):
request = self.get_request(post_data=data)
response = page_admin.move_page(request, page_id=delta.pk)
data = json.loads(response.content.decode("utf8"))
self.assertEqual(response.status_code, 200)
self.assertEqual(data["status"], 200)
alpha.refresh_from_db()
self.assertEqual(alpha.get_descendants().count(), 1)
beta.refresh_from_db()
self.assertEqual(beta.get_descendants().count(), 0)
gamma.refresh_from_db()
self.assertEqual(gamma.get_descendants().count(), 0)
# Current structure:
#
# ⊢ Alpha
# ⊢ Beta
# ⊢ Delta
# ⊢ Gamma
# Move Gamma to be a child of Delta
data = {
"id": gamma.pk,
"position": 1,
"target": delta.pk,
}
with self.login_user_context(admin_user):
request = self.get_request(post_data=data)
response = page_admin.move_page(request, page_id=gamma.pk)
data = json.loads(response.content.decode("utf8"))
self.assertEqual(response.status_code, 200)
self.assertEqual(data["status"], 200)
alpha.refresh_from_db()
self.assertEqual(alpha.get_descendants().count(), 1)
beta.refresh_from_db()
self.assertEqual(beta.get_descendants().count(), 0)
gamma.refresh_from_db()
self.assertEqual(gamma.get_descendants().count(), 0)
delta.refresh_from_db()
self.assertEqual(delta.get_descendants().count(), 1)
# Final structure:
#
# ⊢ Alpha
# ⊢ Beta
# ⊢ Delta
# ⊢ Gamma
def test_create_page_language(self):
"""tests if the New Page button creates a page content object in the language specified
by the language selectors. The creates pages in all languages and checks if the "+" button
creates a child in the same language"""
admin_user, staff = self._get_guys()
pagecontent_admin = self.pagecontent_admin_class
languages = get_language_list(site_id=settings.SITE_ID) # Run through all languages
url = admin_reverse("cms_pagecontent_changelist")
add_url = admin_reverse("cms_pagecontent_add") # "Add page" button
self.assertIn("/en/", add_url + "?language=en") # English admin (default in tests)
with self.login_user_context(admin_user):
request = self.get_request(url)
response = pagecontent_admin.changelist_view(request)
self.assertContains(response, f"{add_url}?language=en")
for language in languages: # Now check all language with the languages selector defined
request = self.get_request(path=f"{url}?language={language}") # Language of the page tree
response = pagecontent_admin.changelist_view(request)
self.assertContains(response, f'href="{add_url}?language={language}&site=1"')
# Create pages in all languages
page = {}
for language in languages:
page[language] = create_page("Alpha", "nav_playground.html", language)
# Get the page tree and see if the href triggers an add page content for the
# selected language
url = admin_reverse("cms_pagecontent_get_tree")
for language in languages:
request = self.get_request(path=f"{url}?language={language}")
response = pagecontent_admin.get_tree(request)
self.assertContains(response, f'href="{add_url}?parent_page={page[language].id}&language={language}"')
class AdminInputSanitationTests(AdminTestsBase):
@property
def settings_admin_class(self):
return site._registry[UserSettings]
def test_admin_session_store(self):
"""
Settings added to admin through session store should be escaped
"""
admin_user, staff = self._get_guys()
with self.login_user_context(admin_user):
request = self.get_request(
self.settings_admin_class.urls[0],
post_data={
"settings": '',
},
)
response = self.settings_admin_class.session_store(request)
self.assertEqual(response.content, b'"<script>alert("hello world")</script>"')