bruks/dynamicweb
1
0
Fork 0
forked from ungleich-public/dynamicweb
Code Pull requests Activity
dynamicweb/cms/tests/test_menu_page_viewperm.py

649 lines
23 KiB
Python
Raw Blame History

from django.contrib.auth import get_user_model
from django.contrib.auth.models import AnonymousUser, Group
from django.contrib.sites.models import Site
from django.test.utils import override_settings
from cms.api import create_page
from cms.cms_menus import get_visible_page_contents
from cms.models import (
ACCESS_CHILDREN,
ACCESS_DESCENDANTS,
ACCESS_PAGE,
ACCESS_PAGE_AND_CHILDREN,
ACCESS_PAGE_AND_DESCENDANTS,
Page,
)
from cms.models.permissionmodels import GlobalPagePermission, PagePermission
from cms.test_utils.testcases import CMSTestCase
from cms.utils.page_permissions import user_can_view_page
from menus.menu_pool import menu_pool
__all__ = ["ViewPermissionTreeBugTests", "ViewPermissionComplexMenuAllNodesTests"]
class ViewPermissionTests(CMSTestCase):
"""
Test various combinations of view permissions pages and menus
Focus on the different grant types and inheritance options of grant on
Given the tree:
|- Page_a
|- Page_b
| |- Page_b_a
| |- Page_b_b
| | |- Page_b_b_a
| | | |- Page_b_b_a_a
| | |- Page_b_b_b
| | |- Page_b_b_c
| |- Page_b_c
| |- Page_b_d
| | |- Page_b_d_a
| | |- Page_b_d_b
| | |- Page_b_d_c
|- Page_c
| |- Page_c_a
| |- Page_c_b
|- Page_d
| |- Page_d_a
| |- Page_d_b
| |- Page_d_c
"""
GROUPNAME_1 = "group_b_ACCESS_PAGE_AND_CHILDREN"
GROUPNAME_2 = "group_b_b_ACCESS_CHILDREN"
GROUPNAME_3 = "group_b_ACCESS_PAGE_AND_DESCENDANTS"
GROUPNAME_4 = "group_b_b_ACCESS_DESCENDANTS"
GROUPNAME_5 = "group_d_ACCESS_PAGE"
def setUp(self):
self.site = Site()
self.site.pk = 1
super().setUp()
def tearDown(self):
super().tearDown()
def _setup_tree_pages(self):
stdkwargs = {
"template": "nav_playground.html",
"language": "en",
"in_navigation": True,
}
homepage = create_page("page_a", **stdkwargs)
homepage.set_as_homepage()
page_b = create_page("page_b", **stdkwargs)
page_c = create_page("page_c", **stdkwargs)
page_d = create_page("page_d", **stdkwargs)
page_b_a = create_page("page_b_a", parent=page_b, **stdkwargs)
page_b_b = create_page("page_b_b", parent=page_b, **stdkwargs)
page_b_b_a = create_page("page_b_b_a", parent=page_b_b, **stdkwargs)
page_b_b_b = create_page("page_b_b_b", parent=page_b_b, **stdkwargs)
page_b_b_c = create_page("page_b_b_c", parent=page_b_b, **stdkwargs)
page_b_b_a_a = create_page("page_b_b_a_a", parent=page_b_b_a, **stdkwargs)
page_b_c = create_page("page_b_c", parent=page_b, **stdkwargs)
page_b_d = create_page("page_b_d", parent=page_b, **stdkwargs)
page_b_d_a = create_page("page_b_d_a", parent=page_b_d, **stdkwargs)
page_b_d_b = create_page("page_b_d_b", parent=page_b_d, **stdkwargs)
page_b_d_c = create_page("page_b_d_c", parent=page_b_d, **stdkwargs)
page_c_a = create_page("page_c_a", parent=page_c, **stdkwargs)
page_c_b = create_page("page_c_b", parent=page_c, **stdkwargs)
page_d_a = create_page("page_d_a", parent=page_d, **stdkwargs)
page_d_b = create_page("page_d_b", parent=page_d, **stdkwargs)
page_d_c = create_page("page_d_c", parent=page_d, **stdkwargs)
page_d_d = create_page("page_d_d", parent=page_d, **stdkwargs)
pages = [
homepage,
page_b,
page_b_a,
page_b_b,
page_b_b_a,
page_b_b_a_a,
page_b_b_b,
page_b_b_c,
page_b_c,
page_b_d,
page_b_d_a,
page_b_d_b,
page_b_d_c,
page_c,
page_c_a,
page_c_b,
page_d,
page_d_a,
page_d_b,
page_d_c,
page_d_d,
]
new_pages = []
for page in pages:
new_pages.append(page.reload())
return new_pages
def _setup_user_groups(self):
"""
Setup a group for every grant on ACCESS TYPE
"""
userdata = [
("user_1", True, self.GROUPNAME_1),
("user_1_nostaff", False, self.GROUPNAME_1),
("user_2", True, self.GROUPNAME_2),
("user_2_nostaff", False, self.GROUPNAME_2),
("user_3", True, self.GROUPNAME_3),
("user_3_nostaff", False, self.GROUPNAME_3),
("user_4", True, self.GROUPNAME_4),
("user_4_nostaff", False, self.GROUPNAME_4),
("user_5", True, self.GROUPNAME_5),
("user_5_nostaff", False, self.GROUPNAME_5),
("user_staff", True, None),
]
default_users_count = get_user_model().objects.all().count()
for username, is_staff, groupname in userdata:
user = self._create_user(username, is_staff)
if groupname:
group, _ = Group.objects.get_or_create(name=groupname)
user_set = group.user_set
user_set.add(user)
group.save()
self.assertEqual(11, get_user_model().objects.all().count() - default_users_count)
def _setup_view_restrictions(self):
"""
Setup a view restriction with every type of the grant_on ACCESS_*
"""
data = [
("page_b", self.GROUPNAME_1, ACCESS_PAGE_AND_CHILDREN),
("page_b_b", self.GROUPNAME_2, ACCESS_CHILDREN),
("page_b", self.GROUPNAME_3, ACCESS_PAGE_AND_DESCENDANTS),
("page_b_b", self.GROUPNAME_4, ACCESS_DESCENDANTS),
("page_d", self.GROUPNAME_5, ACCESS_PAGE),
]
for title, groupname, inherit in data:
page = Page.objects.get(pagecontent_set__title=title)
group = Group.objects.get(name__iexact=groupname)
PagePermission.objects.create(can_view=True, group=group, page=page, grant_on=inherit)
self.assertEqual(5, PagePermission.objects.all().count())
self.assertEqual(0, GlobalPagePermission.objects.all().count())
def assertPageFound(self, url, client=None):
if not client:
client = self.client
response = client.get(url)
self.assertEqual(response.status_code, 200)
def assertPageNotFound(self, url, client=None):
if not client:
client = self.client
response = client.get(url)
self.assertEqual(response.status_code, 404)
def assertViewAllowed(self, page, user):
self.assertTrue(user_can_view_page(user, page))
def assertViewNotAllowed(self, page, user):
self.assertFalse(user_can_view_page(user, page))
def assertInMenu(self, page, user):
request = self.get_request(user, page)
menu_renderer = menu_pool.get_renderer(request)
nodes = menu_renderer.get_nodes()
target_url = page.get_absolute_url()
found_in_menu = False
for node in nodes:
if node.get_absolute_url() == target_url:
found_in_menu = True
break
self.assertTrue(found_in_menu)
def assertNotInMenu(self, page, user):
request = self.get_request(user, page)
menu_renderer = menu_pool.get_renderer(request)
nodes = menu_renderer.get_nodes()
target_url = page.get_absolute_url()
found_in_menu = False
for node in nodes:
if node.get_absolute_url() == target_url:
found_in_menu = True
break
self.assertFalse(found_in_menu)
def assertNodeMemberships(self, visible_page_ids, restricted_pages, public_page_ids):
"""
test all visible page ids are either in_public and not in_restricted
or not in_public and in_restricted
"""
for page_id in visible_page_ids:
in_restricted = False
in_public = False
if page_id in restricted_pages:
in_restricted = True
if page_id in public_page_ids:
in_public = True
self.assertTrue(
(in_public and not in_restricted) or (not in_public and in_restricted),
msg=f"page_id {page_id} in_public: {in_public}, in_restricted: {in_restricted}",
)
def assertGrantedVisibility(self, all_pages, expected_granted_pages, username=None):
"""
helper function to check the expected_granted_pages are
not in the restricted_pages list and
all visible pages are in the expected_granted_pages
"""
# log the user in if present
user = None
if username is not None:
if get_user_model().USERNAME_FIELD == "email":
username = username + "@django-cms.org"
query = dict()
query[get_user_model().USERNAME_FIELD + "__iexact"] = username
user = get_user_model().objects.get(**query)
request = self.get_request(user)
all_content = [page.get_content_obj() for page in all_pages]
visible_page_ids = [
page_content.page.pk for page_content in get_visible_page_contents(request, all_content, self.site)
]
public_page_ids = Page.objects.filter(pagecontent_set__title__in=expected_granted_pages).values_list(
"id", flat=True
)
self.assertEqual(len(visible_page_ids), len(expected_granted_pages))
restricted_pages = Page.objects.exclude(pagecontent_set__title__in=expected_granted_pages).values_list(
"id", flat=True
)
self.assertNodeMemberships(visible_page_ids, restricted_pages, public_page_ids)
def get_request(self, user=None, page=None):
# see tests/menu.py line 753
path = "/"
if page:
path = page.get_absolute_url()
attrs = {
"user": user or AnonymousUser(),
"REQUEST": {},
"COOKIES": {},
"META": {},
"POST": {},
"GET": {},
"path": path,
"path_info": path,
"session": {},
}
return type("Request", (object,), attrs)
def get_url_dict(self, pages, language="en"):
return {page.get_absolute_url(language=language): page for page in pages}
@override_settings(
CMS_PERMISSION=True,
CMS_PUBLIC_FOR="all",
)
class ViewPermissionComplexMenuAllNodesTests(ViewPermissionTests):
"""
Test CMS_PUBLIC_FOR=all group access and menu nodes rendering
"""
def test_public_pages_anonymous_norestrictions(self):
"""
All pages are visible to an anonymous user
"""
all_pages = self._setup_tree_pages()
request = self.get_request()
all = [page.get_content_obj() for page in all_pages]
visible = get_visible_page_contents(request, all, self.site)
self.assertEqual(len(all), len(visible))
menu_renderer = menu_pool.get_renderer(request)
nodes = menu_renderer.get_nodes()
self.assertEqual(len(nodes), len(all))
def test_public_menu_anonymous_user(self):
"""
Anonymous user should only see the pages in the rendered menu
that have no permissions assigned,directly or indirectly
"""
self._setup_user_groups()
all_pages = self._setup_tree_pages()
self._setup_view_restrictions()
granted = ["page_a", "page_c", "page_c_a", "page_c_b", "page_d_a", "page_d_b", "page_d_c", "page_d_d"]
self.assertGrantedVisibility(all_pages, granted)
urls = self.get_url_dict(all_pages)
user = AnonymousUser()
request = self.get_request(user, urls["/en/"])
menu_renderer = menu_pool.get_renderer(request)
nodes = menu_renderer.get_nodes()
self.assertEqual(len(nodes), 4)
self.assertInMenu(urls["/en/"], user)
self.assertInMenu(urls["/en/page_c/"], user)
self.assertInMenu(urls["/en/page_c/page_c_a/"], user)
self.assertInMenu(urls["/en/page_c/page_c_b/"], user)
self.assertViewNotAllowed(urls["/en/page_b/"], user)
self.assertNotInMenu(urls["/en/page_b/"], user)
self.assertViewNotAllowed(urls["/en/page_d/"], user)
self.assertNotInMenu(urls["/en/page_d/"], user)
def test_menu_access_page_and_children_group_1(self):
"""
simulate behaviour of group b member
group_b_ACCESS_PAGE_AND_CHILDREN to page_b
"""
self._setup_user_groups()
all_pages = self._setup_tree_pages()
self._setup_view_restrictions()
granted = [
"page_a",
"page_c",
"page_c_a",
"page_c_b",
# group_1
"page_b", # page_id b has page_id and children restricted - group 1
"page_b_a",
"page_b_b", # page_id b_b children restricted - group 2
"page_b_c",
"page_b_d",
# not restricted
"page_d_a",
"page_d_b",
"page_d_c",
"page_d_d",
]
urls = self.get_url_dict(all_pages)
if get_user_model().USERNAME_FIELD == "email":
user = get_user_model().objects.get(email="user_1@django-cms.org")
else:
user = get_user_model().objects.get(username="user_1")
self.assertGrantedVisibility(all_pages, granted, username="user_1")
self.assertViewAllowed(urls["/en/page_b/"], user)
self.assertInMenu(urls["/en/page_b/"], user)
self.assertViewAllowed(urls["/en/page_b/page_b_b/"], user)
self.assertInMenu(urls["/en/page_b/page_b_b/"], user)
# descendant
self.assertViewNotAllowed(urls["/en/page_b/page_b_b/page_b_b_a/"], user)
self.assertNotInMenu(urls["/en/page_b/page_b_b/page_b_b_a/"], user)
# group 5
self.assertViewNotAllowed(urls["/en/page_d/"], user)
self.assertNotInMenu(urls["/en/page_d/"], user)
# should be public as only page_d is restricted
self.assertViewAllowed(urls["/en/page_d/page_d_a/"], user)
self.assertNotInMenu(urls["/en/page_d/page_d_a/"], user)
def test_menu_access_children_group_2(self):
"""
simulate behaviour of group 2 member
GROUPNAME_2 = 'group_b_b_ACCESS_CHILDREN'
to page_b_b
"""
self._setup_user_groups()
all_pages = self._setup_tree_pages()
self._setup_view_restrictions()
granted = [
"page_a",
"page_c",
"page_c_a",
"page_c_b",
"page_b_b_a",
"page_b_b_b",
"page_b_b_c",
# not restricted
"page_d_a",
"page_d_b",
"page_d_c",
"page_d_d",
]
self.assertGrantedVisibility(all_pages, granted, username="user_2")
urls = self.get_url_dict(all_pages)
if get_user_model().USERNAME_FIELD == "email":
user = get_user_model().objects.get(email="user_2@django-cms.org")
else:
user = get_user_model().objects.get(username="user_2")
self.assertViewNotAllowed(urls["/en/page_b/page_b_b/"], user)
self.assertViewAllowed(urls["/en/page_b/page_b_b/page_b_b_a/"], user)
self.assertViewNotAllowed(urls["/en/page_b/page_b_b/page_b_b_a/page_b_b_a_a/"], user)
self.assertViewNotAllowed(urls["/en/page_d/"], user)
self.assertViewAllowed(urls["/en/page_d/page_d_a/"], user)
def test_menu_access_page_and_descendants_group_3(self):
"""
simulate behaviour of group 3 member
group_b_ACCESS_PAGE_AND_DESCENDANTS to page_b
"""
self._setup_user_groups()
all_pages = self._setup_tree_pages()
self._setup_view_restrictions()
granted = [
"page_a",
"page_b",
"page_b_a",
"page_b_b",
"page_b_b_a",
"page_b_b_a_a",
"page_b_b_b",
"page_b_b_c",
"page_b_c",
"page_b_d",
"page_b_d_a",
"page_b_d_b",
"page_b_d_c",
"page_c",
"page_c_a",
"page_c_b",
"page_d_a",
"page_d_b",
"page_d_c",
"page_d_d",
]
self.assertGrantedVisibility(all_pages, granted, username="user_3")
urls = self.get_url_dict(all_pages)
if get_user_model().USERNAME_FIELD == "email":
user = get_user_model().objects.get(email="user_3@django-cms.org")
else:
user = get_user_model().objects.get(username="user_3")
self.assertViewAllowed(urls["/en/page_b/"], user)
self.assertViewAllowed(urls["/en/page_b/page_b_d/page_b_d_a/"], user)
self.assertViewNotAllowed(urls["/en/page_d/"], user)
self.assertViewAllowed(urls["/en/page_d/page_d_a/"], user)
def test_menu_access_descendants_group_4(self):
"""
simulate behaviour of group 4 member
group_b_b_ACCESS_DESCENDANTS to page_b_b
"""
self._setup_user_groups()
all_pages = self._setup_tree_pages()
self._setup_view_restrictions()
granted = [
"page_a",
"page_b_b_a",
"page_b_b_a_a",
"page_b_b_b",
"page_b_b_c",
"page_c",
"page_c_a",
"page_c_b",
"page_d_a",
"page_d_b",
"page_d_c",
"page_d_d",
]
self.assertGrantedVisibility(all_pages, granted, username="user_4")
urls = self.get_url_dict(all_pages)
if get_user_model().USERNAME_FIELD == "email":
user = get_user_model().objects.get(email="user_4@django-cms.org")
else:
user = get_user_model().objects.get(username="user_4")
self.assertViewNotAllowed(urls["/en/page_b/"], user)
self.assertViewNotAllowed(urls["/en/page_b/page_b_b/"], user)
self.assertViewAllowed(urls["/en/page_b/page_b_b/page_b_b_a/"], user)
self.assertViewNotAllowed(urls["/en/page_d/"], user)
self.assertViewAllowed(urls["/en/page_d/page_d_a/"], user)
def test_menu_access_page_group_5(self):
"""
simulate behaviour of group b member
group_d_ACCESS_PAGE to page_d
"""
self._setup_user_groups()
all_pages = self._setup_tree_pages()
self._setup_view_restrictions()
granted = [
"page_a",
"page_c",
"page_c_a",
"page_c_b",
"page_d",
"page_d_a",
"page_d_b",
"page_d_c",
"page_d_d",
]
self.assertGrantedVisibility(all_pages, granted, username="user_5")
urls = self.get_url_dict(all_pages)
if get_user_model().USERNAME_FIELD == "email":
user = get_user_model().objects.get(email="user_5@django-cms.org")
else:
user = get_user_model().objects.get(username="user_5")
# call /
self.assertViewNotAllowed(urls["/en/page_b/"], user)
self.assertViewNotAllowed(urls["/en/page_b/page_b_b/"], user)
self.assertViewNotAllowed(urls["/en/page_b/page_b_b/page_b_b_a/"], user)
self.assertViewAllowed(urls["/en/page_d/"], user)
self.assertViewAllowed(urls["/en/page_d/page_d_a/"], user)
def test_non_view_permission_doesnt_hide(self):
"""
PagePermissions with can_view=False shouldn't hide pages in the menu.
"""
self._setup_user_groups()
all_pages = self._setup_tree_pages()
page = Page.objects.get(pagecontent_set__title="page_b")
group = Group.objects.get(name=self.GROUPNAME_1)
PagePermission.objects.create(can_view=False, group=group, page=page)
urls = self.get_url_dict(all_pages)
self.assertInMenu(urls["/en/page_b/"], AnonymousUser())
@override_settings(
CMS_PERMISSION=True,
CMS_PUBLIC_FOR="all",
)
class ViewPermissionTreeBugTests(ViewPermissionTests):
"""Test issue 1113
https://github.com/divio/django-cms/issues/1113
Wrong view permission calculation in PagePermission.objects.for_page
grant_on=ACCESS_PAGE_AND_CHILDREN or ACCESS_PAGE_AND_DESCENDANTS to page 6
Test if this affects the menu entries and page visibility
"""
GROUPNAME_6 = "group_6_ACCESS_PAGE"
def _setup_pages(self):
"""
Tree Structure
|- Page_1
| |- Page_2
| |- Page_3
| |- Page_4 (false positive)
| |- Page_5
| | |- Page_6 (group 6 page access)
"""
stdkwargs = {
"template": "nav_playground.html",
"language": "en",
"in_navigation": True,
}
homepage = create_page("page_1", **stdkwargs)
homepage.set_as_homepage()
page_2 = create_page("page_2", parent=homepage, **stdkwargs)
page_3 = create_page("page_3", parent=page_2, **stdkwargs)
page_4 = create_page("page_4", parent=page_3, **stdkwargs)
page_5 = create_page("page_5", parent=homepage, **stdkwargs)
page_6 = create_page("page_6", parent=page_5, **stdkwargs)
return [
homepage,
page_2,
page_3,
page_4,
page_5,
page_6,
]
def _setup_user(self):
user = self._create_user("user_6", True)
group = Group.objects.create(name=self.GROUPNAME_6)
user_set = group.user_set
user_set.add(user)
group.save()
def _setup_permviewbug(self):
"""
Setup group_6_ACCESS_PAGE view restriction
"""
page = Page.objects.get(pagecontent_set__title="page_6")
group = Group.objects.get(name__iexact=self.GROUPNAME_6)
PagePermission.objects.create(can_view=True, group=group, page=page, grant_on=ACCESS_PAGE_AND_CHILDREN)
PagePermission.objects.create(can_view=True, group=group, page=page, grant_on=ACCESS_PAGE_AND_DESCENDANTS)
def test_pageforbug(self):
all_pages = self._setup_pages()
self._setup_user()
self._setup_permviewbug()
for page in all_pages:
perm = PagePermission.objects.for_page(page=page)
# only page_6 has a permission assigned
if page.get_title() == "page_6":
self.assertEqual(len(perm), 2)
else:
msg = "Permission wrong at page %s" % (page.get_title())
self.assertEqual(len(perm), 0, msg)
granted = [
"page_1",
"page_2",
"page_3",
"page_4",
"page_5",
]
urls = self.get_url_dict(all_pages)
user = AnonymousUser()
# anonymous doesn't see page_6
self.assertGrantedVisibility(all_pages, granted)
self.assertViewAllowed(urls["/en/page_2/page_3/page_4/"], user)
self.assertViewAllowed(urls["/en/page_5/"], user)
self.assertViewNotAllowed(urls["/en/page_5/page_6/"], user)
# group member
granted = [
"page_1",
"page_2",
"page_3",
"page_4",
"page_5",
"page_6",
]
self.assertGrantedVisibility(all_pages, granted, username="user_6")
if get_user_model().USERNAME_FIELD == "email":
user = get_user_model().objects.get(email="user_6@django-cms.org")
else:
user = get_user_model().objects.get(username="user_6")
url = "/en/page_2/page_3/page_4/"
self.assertViewAllowed(urls[url], user)
url = "/en/page_5/page_6/"
self.assertViewAllowed(urls[url], user)
View git blame Copy permalink