
    BhJ(                     f    d dl mZ d dlmZ d dlmZ d dlmZmZ d dl	m
Z
 d dlmZ  G d de      Zy	)
    )settings)get_user_model)	QueryDict)
add_plugincreate_page)	CMSPlugin)CMSTestCasec                   :    e Zd ZdZd Zd Zd Zd Zd Zd Z	d Z
y	)
SecurityTestszV
    Test security issues by trying some naive requests to add/alter/delete data.
    c                     t        ddd      }|j                  d      j                  d      }| j                         }| j	                         }||||fS )Npageznav_playground.htmlenbody)slot)r   get_placeholdersgetget_superuser"get_staff_user_with_no_permissions)selfr   placeholder	superuserstaffs        G/home/dcms/DCMS/lib/python3.12/site-packages/cms/tests/test_security.pyget_datazSecurityTests.get_data   sZ    6#8$?++D15565B&&(	779[)U22    c                    | j                         \  }}}}i }| j                  t        j                  j	                         d       | j
                  j                          | j                  |dt        j                  d   d         }| j
                  j                  ||      }| j                  |j                  d       t        dd      }||d<   dj                  t        j                  d   d   |j                  d	
            }	| j                  ||	       | j                  t        j                  j	                         d       | j
                  j!                  t#        |t%               j&                        t#        |t%               j&                               | j
                  j                  ||      }| j                  |j                  d       | j                  t        j                  j	                         d       y)z3
        Test adding a plugin to a *PAGE*.
        r   
TextPlugin.   Tmutablenext/{lang}/admin/login/?{next}/safelangr"   usernamepassword  N)r   assertEqualr   objectscountclientlogoutget_add_plugin_urir   	LANGUAGESpoststatus_coder   format	urlencodeassertRedirectslogingetattrr   USERNAME_FIELD
r   r   r   r   r   	post_dataendpointresponsequerystringexpected_urls
             r   test_addzSecurityTests.test_add   s    /3mmo+k9e	**002A6**q!!$

 ;;##Hi8--s3D1&F4;;##A&q)&&C&0 < 
 	X|4**002A675.2B2Q2Q#R#*5.2B2Q2Q#R 	 	T;;##Hi8--s3**002A6r   c                    | j                         \  }}}}t        |ddd      }|j                  dd}| j                  |j                  d       | j
                  j                          | j                  |      }| j
                  j                  ||      }| j                  |j                  d       t        dd	
      }	||	d<   dj                  t        j                  d   d   |	j                  d            }
| j                  ||
       | j!                  |      }| j                  |j                  d       | j
                  j#                  t%        |t'               j(                        t%        |t'               j(                               | j
                  j                  ||      }| j                  |j                  d       | j!                  |      }| j                  |j                  d       y)z.
        Test editing a *PAGE* plugin
        r   r   r   r   newbody)	plugin_idr   r   r   Tr    r"   r#   r   r$   r%   r'   r)   r,   N)r   r   pkr-   r   r0   r1   get_change_plugin_urir4   r5   r   r6   r   r3   r7   r8   reloadr9   r:   r   r;   r   r   r   r   r   pluginplugin_datar>   r?   r@   rA   s              r   	test_editzSecurityTests.test_edit7   s    /3mmo+k9eKt&I
 	f---f5;;##Hk:--s3D1&F4;;##A&q)&&C&0 < 
 	X|4V$f-75.2B2Q2Q#R#*5.2B2Q2Q#R 	 	T;;##Hk:--s3V$f-r   c                    | j                         \  }}}}t        |ddd      }d|j                  i}| j                  |      }| j	                  |j
                  d       | j                  j                          | j                  |      }| j                  j                  ||      }| j	                  |j                  d       t        dd	      }	||	d
<   dj                  t        j                  d   d   |	j                  d            }
| j!                  ||
       | j	                  t"        j$                  j'                         d       | j                  |      }| j	                  |j
                  d       | j                  j)                  t+        |t-               j.                        t+        |t-               j.                               | j                  j                  ||      }| j	                  |j                  d       | j	                  t"        j$                  j'                         d       | j                  |      }| j	                  |j
                  d       y)z/
        Test deleting a *PAGE* plugin
        r   r   r   rD   rF   r   r   Tr    r"   r#   r   r$   r%   r'      r)   r,   N)r   r   rG   rI   r-   r   r0   r1   get_delete_plugin_urir4   r5   r   r6   r   r3   r7   r8   r   r.   r/   r9   r:   r   r;   rJ   s              r   test_deletezSecurityTests.test_delete[   s    /3mmo+k9eKt&I
 V$f---f5;;##Hk:--s3D1&F4;;##A&q)&&C&0 < 
 	X|4**002A6V$f-75.2B2Q2Q#R#*5.2B2Q2Q#R 	 	T;;##Hk:--s3**002A6V$f-r   c                    | j                         \  }}}}i }| j                  |dt        j                  d   d         }| j	                  t
        j                  j                         d       | j                  j                          | j                  j                  ||      }| j	                  |j                  d       t        dd      }||d<   dj                  t        j                  d   d   |j                  d	
            }	| j                  ||	       | j	                  t
        j                  j                         d       | j                  j!                  t#        |t%               j&                        t#        |t%               j&                               | j                  j                  ||      }| j	                  |j                  d       | j	                  t
        j                  j                         d       y)z1
        Test adding a *NON PAGE* plugin
        r   r   r   r   Tr    r"   r#   r$   r%   r'   r)   r,   N)r   r2   r   r3   r-   r   r.   r/   r0   r1   r4   r5   r   r6   r7   r8   r9   r:   r   r;   r<   s
             r   test_add_phzSecurityTests.test_add_ph   s    /3mmo+k9e	**;hFXFXYZF[\]F^_**002A6;;##Hi8--s3D1&F4;;##A&q)&&C&0 < 
 	X|4**002A675.2B2Q2Q#R#*5.2B2Q2Q#R 	 	T;;##Hi8--s3**002A6r   c                    | j                         \  }}}}t        |ddd      }| j                  |      }dd|j                  d}| j	                  |      }| j                  |j                  d       | j                  j                          | j                  j                  ||      }| j                  |j                  d       t        dd	
      }	||	d<   dj                  t        j                  d   d   |	j                  d            }
| j!                  ||
       | j	                  |      }| j                  |j                  d       | j                  j#                  t%        |t'               j(                        t%        |t'               j(                               | j                  j                  ||      }| j                  |j                  d       | j	                  |      }| j                  |j                  d       y)z2
        Test editing a *NON PAGE* plugin
        r   r   r   rD   rE   )r   languagerF   r   r   Tr    r"   r#   r   r$   r%   r'   r)   r,   N)r   r   rH   rG   rI   r-   r   r0   r1   r4   r5   r   r6   r   r3   r7   r8   r9   r:   r   r;   )r   r   r   r   r   rK   r>   rL   r?   r@   rA   s              r   test_edit_phzSecurityTests.test_edit_ph   s    /3mmo+k9eKt&I--f5

 V$f-;;##Hk:--s3D1&F4;;##A&q)&&C&0 < 
 	X|4V$f-75.2B2Q2Q#R#*5.2B2Q2Q#R 	 	T;;##Hk:--s3V$f-r   c                    | j                         \  }}}}t        |ddd      }d|j                  i}| j                  |      }| j	                  |j
                  d       | j                  |      }| j                  j                          | j                  j                  ||      }| j	                  |j                  d       t        dd	      }	||	d
<   dj                  t        j                  d   d   |	j                  d            }
| j!                  ||
       | j	                  t"        j$                  j'                         d       | j                  j)                  t+        |t-               j.                        t+        |t-               j.                               | j                  j                  ||      }| j	                  |j                  d       | j	                  t"        j$                  j'                         d       y )Nr   r   r   rD   rF   r   r   Tr    r"   r#   r   r$   r%   r'   rO   r)   r,   )r   r   rG   rI   r-   r   rP   r0   r1   r4   r5   r   r6   r   r3   r7   r8   r   r.   r/   r9   r:   r   r;   rJ   s              r   test_delete_phzSecurityTests.test_delete_ph   s   .2mmo+k9eKt&I
 V$f---f5;;##Hk:--s3D1&F4;;##A&q)&&C&0 < 
 	X|4**002A675.2B2Q2Q#R#*5.2B2Q2Q#R 	 	T;;##Hk:--s3**002A6r   N)__name__
__module____qualname____doc__r   rB   rM   rQ   rS   rV   rX    r   r   r   r   
   s.    37B".H#.J7:#.J7r   r   N)django.confr   django.contrib.authr   django.httpr   cms.apir   r   cms.models.pluginmodelr   cms.test_utils.testcasesr	   r   r]   r   r   <module>rd      s%      . ! + , 0T7K T7r   