Merge lp:~fgallina/rnr-server/csrf-fix into lp:rnr-server

[Fabián Ezequiel Gallina]

Add csrftoken input to moderation forms

[Ricardo Kirkner (ricardokirkner)]

LGTM

review: Approve

=== modified file 'src/reviewsapp/templates/reviewsapp/reviewmoderation_form.html'
--- src/reviewsapp/templates/reviewsapp/reviewmoderation_form.html	2013-04-10 13:15:09 +0000
+++ src/reviewsapp/templates/reviewsapp/reviewmoderation_form.html	2014-07-28 17:40:56 +0000
@@ -16,6 +16,7 @@
   <p>Perhaps with previous/later moderations in the footer.</p>
 
   <form method="post" action="{% url 'rnr-reviewmoderation-moderate' review_moderation.id %}">
+    {% csrf_token %}
     {{ form }}
   </form>
 

=== modified file 'src/reviewsapp/templates/reviewsapp/reviewmoderation_list.html'
--- src/reviewsapp/templates/reviewsapp/reviewmoderation_list.html	2013-04-10 13:15:09 +0000
+++ src/reviewsapp/templates/reviewsapp/reviewmoderation_list.html	2014-07-28 17:40:56 +0000
@@ -74,6 +74,7 @@
          <td>
           {% if review_moderation|can_moderate_item:user %}
           <form method="post" action="{% url 'rnr-reviewmoderation-moderate' review_moderation.id %}">
+              {% csrf_token %}
               <p><button type="submit" name="status"
                   value="1">{% trans "Keep Review" %}</button></p>
               <p><button type="submit" name="status"

=== modified file 'src/reviewsapp/tests/test_views.py'
--- src/reviewsapp/tests/test_views.py	2013-04-10 15:01:13 +0000
+++ src/reviewsapp/tests/test_views.py	2014-07-28 17:40:56 +0000
@@ -276,6 +276,19 @@
             response,
             '<form method="post" action="{0}"'.format(action_url))
 
+    def test_csrftoken_is_included(self):
+        self.factory.makeReviewModeration()
+
+        response = self._request_url_as_moderator()
+
+        self.assertIn('csrftoken', response.cookies)
+
+        csrftoken = response.cookies['csrftoken'].value
+        tag = ("<input type='hidden' "
+               "name='csrfmiddlewaretoken' value='%s' />") % csrftoken
+
+        self.assertContains(response, tag)
+
 
 class ReviewModerationModerateViewTestCase(TestCaseWithFactory):
     """Tests for the moderate view methed."""
@@ -475,6 +488,19 @@
 
         self.assertEqual(403, response.status_code)
 
+    def test_csrftoken_is_included(self):
+        review_moderation = self.factory.makeReviewModeration()
+
+        response = self._request_moderation_url(review_moderation.id)
+
+        self.assertIn('csrftoken', response.cookies)
+
+        csrftoken = response.cookies['csrftoken'].value
+        tag = ("<input type='hidden' "
+               "name='csrfmiddlewaretoken' value='%s' />") % csrftoken
+
+        self.assertContains(response, tag)
+
 
 class ReviewModerationDetailsTestCase(TestCaseWithFactory):
     """Tests for the show_moderation_details view method."""

=== modified file 'src/reviewsapp/views/moderation.py'
--- src/reviewsapp/views/moderation.py	2014-06-23 20:19:03 +0000
+++ src/reviewsapp/views/moderation.py	2014-07-28 17:40:56 +0000
@@ -162,7 +162,7 @@
     }
     return render_to_response(
         'reviewsapp/reviewmoderation_form.html',
-        context)
+        context, RequestContext(request))
 
 
 @timed_call