web/test/unittest_views_json.py
author Katia Saurfelt <katia.saurfelt@logilab.fr>
Tue, 27 Nov 2012 11:38:03 +0100
branchstable
changeset 8601 1a6000ff2080
parent 7989 db76e8aaec29
child 8629 3ae893f9ec84
permissions -rw-r--r--
[web] add a ``anonymize-jsonp-queries`` option in file configuration (closes #2465388) This option controls connection anonymizing before executing any query for CSRF / safety reason.
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
8601
1a6000ff2080 [web] add a ``anonymize-jsonp-queries`` option in file configuration (closes #2465388)
Katia Saurfelt <katia.saurfelt@logilab.fr>
parents: 7989
diff changeset
     1
# -*- coding: utf-8 -*-
1a6000ff2080 [web] add a ``anonymize-jsonp-queries`` option in file configuration (closes #2465388)
Katia Saurfelt <katia.saurfelt@logilab.fr>
parents: 7989
diff changeset
     2
# copyright 2012 LOGILAB S.A. (Paris, FRANCE), all rights reserved.
1a6000ff2080 [web] add a ``anonymize-jsonp-queries`` option in file configuration (closes #2465388)
Katia Saurfelt <katia.saurfelt@logilab.fr>
parents: 7989
diff changeset
     3
# contact http://www.logilab.fr/ -- mailto:contact@logilab.fr
1a6000ff2080 [web] add a ``anonymize-jsonp-queries`` option in file configuration (closes #2465388)
Katia Saurfelt <katia.saurfelt@logilab.fr>
parents: 7989
diff changeset
     4
#
1a6000ff2080 [web] add a ``anonymize-jsonp-queries`` option in file configuration (closes #2465388)
Katia Saurfelt <katia.saurfelt@logilab.fr>
parents: 7989
diff changeset
     5
# This file is part of CubicWeb.
1a6000ff2080 [web] add a ``anonymize-jsonp-queries`` option in file configuration (closes #2465388)
Katia Saurfelt <katia.saurfelt@logilab.fr>
parents: 7989
diff changeset
     6
#
1a6000ff2080 [web] add a ``anonymize-jsonp-queries`` option in file configuration (closes #2465388)
Katia Saurfelt <katia.saurfelt@logilab.fr>
parents: 7989
diff changeset
     7
# CubicWeb is free software: you can redistribute it and/or modify it under the
1a6000ff2080 [web] add a ``anonymize-jsonp-queries`` option in file configuration (closes #2465388)
Katia Saurfelt <katia.saurfelt@logilab.fr>
parents: 7989
diff changeset
     8
# terms of the GNU Lesser General Public License as published by the Free
1a6000ff2080 [web] add a ``anonymize-jsonp-queries`` option in file configuration (closes #2465388)
Katia Saurfelt <katia.saurfelt@logilab.fr>
parents: 7989
diff changeset
     9
# Software Foundation, either version 2.1 of the License, or (at your option)
1a6000ff2080 [web] add a ``anonymize-jsonp-queries`` option in file configuration (closes #2465388)
Katia Saurfelt <katia.saurfelt@logilab.fr>
parents: 7989
diff changeset
    10
# any later version.
1a6000ff2080 [web] add a ``anonymize-jsonp-queries`` option in file configuration (closes #2465388)
Katia Saurfelt <katia.saurfelt@logilab.fr>
parents: 7989
diff changeset
    11
#
1a6000ff2080 [web] add a ``anonymize-jsonp-queries`` option in file configuration (closes #2465388)
Katia Saurfelt <katia.saurfelt@logilab.fr>
parents: 7989
diff changeset
    12
# CubicWeb is distributed in the hope that it will be useful, but WITHOUT
1a6000ff2080 [web] add a ``anonymize-jsonp-queries`` option in file configuration (closes #2465388)
Katia Saurfelt <katia.saurfelt@logilab.fr>
parents: 7989
diff changeset
    13
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
1a6000ff2080 [web] add a ``anonymize-jsonp-queries`` option in file configuration (closes #2465388)
Katia Saurfelt <katia.saurfelt@logilab.fr>
parents: 7989
diff changeset
    14
# FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
1a6000ff2080 [web] add a ``anonymize-jsonp-queries`` option in file configuration (closes #2465388)
Katia Saurfelt <katia.saurfelt@logilab.fr>
parents: 7989
diff changeset
    15
# details.
1a6000ff2080 [web] add a ``anonymize-jsonp-queries`` option in file configuration (closes #2465388)
Katia Saurfelt <katia.saurfelt@logilab.fr>
parents: 7989
diff changeset
    16
#
1a6000ff2080 [web] add a ``anonymize-jsonp-queries`` option in file configuration (closes #2465388)
Katia Saurfelt <katia.saurfelt@logilab.fr>
parents: 7989
diff changeset
    17
# You should have received a copy of the GNU Lesser General Public License along
1a6000ff2080 [web] add a ``anonymize-jsonp-queries`` option in file configuration (closes #2465388)
Katia Saurfelt <katia.saurfelt@logilab.fr>
parents: 7989
diff changeset
    18
# with CubicWeb.  If not, see <http://www.gnu.org/licenses/>.
7876
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    19
from cubicweb.devtools.testlib import CubicWebTC
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    20
7989
db76e8aaec29 [test] restore support for python < 2.6
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 7876
diff changeset
    21
from cubicweb.utils import json
7876
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    22
8601
1a6000ff2080 [web] add a ``anonymize-jsonp-queries`` option in file configuration (closes #2465388)
Katia Saurfelt <katia.saurfelt@logilab.fr>
parents: 7989
diff changeset
    23
from cubicweb.web.application import anonymized_request
1a6000ff2080 [web] add a ``anonymize-jsonp-queries`` option in file configuration (closes #2465388)
Katia Saurfelt <katia.saurfelt@logilab.fr>
parents: 7989
diff changeset
    24
7876
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    25
class JsonViewsTC(CubicWebTC):
8601
1a6000ff2080 [web] add a ``anonymize-jsonp-queries`` option in file configuration (closes #2465388)
Katia Saurfelt <katia.saurfelt@logilab.fr>
parents: 7989
diff changeset
    26
    anonymize = True
1a6000ff2080 [web] add a ``anonymize-jsonp-queries`` option in file configuration (closes #2465388)
Katia Saurfelt <katia.saurfelt@logilab.fr>
parents: 7989
diff changeset
    27
    res_jsonp_data = '[["guests", 1]]'
1a6000ff2080 [web] add a ``anonymize-jsonp-queries`` option in file configuration (closes #2465388)
Katia Saurfelt <katia.saurfelt@logilab.fr>
parents: 7989
diff changeset
    28
1a6000ff2080 [web] add a ``anonymize-jsonp-queries`` option in file configuration (closes #2465388)
Katia Saurfelt <katia.saurfelt@logilab.fr>
parents: 7989
diff changeset
    29
    def setUp(self):
1a6000ff2080 [web] add a ``anonymize-jsonp-queries`` option in file configuration (closes #2465388)
Katia Saurfelt <katia.saurfelt@logilab.fr>
parents: 7989
diff changeset
    30
        super(JsonViewsTC, self).setUp()
1a6000ff2080 [web] add a ``anonymize-jsonp-queries`` option in file configuration (closes #2465388)
Katia Saurfelt <katia.saurfelt@logilab.fr>
parents: 7989
diff changeset
    31
        self.config.global_set_option('anonymize-jsonp-queries', self.anonymize)
7876
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    32
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    33
    def test_json_rsetexport(self):
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    34
        req = self.request()
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    35
        rset = req.execute('Any GN,COUNT(X) GROUPBY GN ORDERBY GN WHERE X in_group G, G name GN')
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    36
        data = self.view('jsonexport', rset)
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    37
        self.assertEqual(req.headers_out.getRawHeaders('content-type'), ['application/json'])
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    38
        self.assertEqual(data, '[["guests", 1], ["managers", 1]]')
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    39
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    40
    def test_json_rsetexport_with_jsonp(self):
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    41
        req = self.request()
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    42
        req.form.update({'callback': 'foo',
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    43
                         'rql': 'Any GN,COUNT(X) GROUPBY GN ORDERBY GN WHERE X in_group G, G name GN',
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    44
                         })
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    45
        data = self.ctrl_publish(req, ctrl='jsonp')
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    46
        self.assertEqual(req.headers_out.getRawHeaders('content-type'), ['application/javascript'])
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    47
        # because jsonp anonymizes data, only 'guests' group should be found
8601
1a6000ff2080 [web] add a ``anonymize-jsonp-queries`` option in file configuration (closes #2465388)
Katia Saurfelt <katia.saurfelt@logilab.fr>
parents: 7989
diff changeset
    48
        self.assertEqual(data, 'foo(%s)' % self.res_jsonp_data)
7876
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    49
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    50
    def test_json_rsetexport_with_jsonp_and_bad_vid(self):
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    51
        req = self.request()
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    52
        req.form.update({'callback': 'foo',
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    53
                         'vid': 'table', # <-- this parameter should be ignored by jsonp controller
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    54
                         'rql': 'Any GN,COUNT(X) GROUPBY GN ORDERBY GN WHERE X in_group G, G name GN',
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    55
                         })
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    56
        data = self.ctrl_publish(req, ctrl='jsonp')
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    57
        self.assertEqual(req.headers_out.getRawHeaders('content-type'), ['application/javascript'])
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    58
        # result should be plain json, not the table view
8601
1a6000ff2080 [web] add a ``anonymize-jsonp-queries`` option in file configuration (closes #2465388)
Katia Saurfelt <katia.saurfelt@logilab.fr>
parents: 7989
diff changeset
    59
        self.assertEqual(data, 'foo(%s)' % self.res_jsonp_data)
7876
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    60
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    61
    def test_json_ersetexport(self):
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    62
        req = self.request()
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    63
        rset = req.execute('Any G ORDERBY GN WHERE G is CWGroup, G name GN')
7989
db76e8aaec29 [test] restore support for python < 2.6
Sylvain Thénault <sylvain.thenault@logilab.fr>
parents: 7876
diff changeset
    64
        data = json.loads(self.view('ejsonexport', rset))
7876
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    65
        self.assertEqual(req.headers_out.getRawHeaders('content-type'), ['application/json'])
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    66
        self.assertEqual(data[0]['name'], 'guests')
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    67
        self.assertEqual(data[1]['name'], 'managers')
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    68
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    69
8601
1a6000ff2080 [web] add a ``anonymize-jsonp-queries`` option in file configuration (closes #2465388)
Katia Saurfelt <katia.saurfelt@logilab.fr>
parents: 7989
diff changeset
    70
class NotAnonymousJsonViewsTC(JsonViewsTC):
1a6000ff2080 [web] add a ``anonymize-jsonp-queries`` option in file configuration (closes #2465388)
Katia Saurfelt <katia.saurfelt@logilab.fr>
parents: 7989
diff changeset
    71
    anonymize = False
1a6000ff2080 [web] add a ``anonymize-jsonp-queries`` option in file configuration (closes #2465388)
Katia Saurfelt <katia.saurfelt@logilab.fr>
parents: 7989
diff changeset
    72
    res_jsonp_data = '[["guests", 1], ["managers", 1]]'
1a6000ff2080 [web] add a ``anonymize-jsonp-queries`` option in file configuration (closes #2465388)
Katia Saurfelt <katia.saurfelt@logilab.fr>
parents: 7989
diff changeset
    73
7876
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    74
if __name__ == '__main__':
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    75
    from logilab.common.testlib import unittest_main
df15d194a134 [views] implement json / jsonp export views (closes #1942658)
Adrien Di Mascio <Adrien.DiMascio@logilab.fr>
parents:
diff changeset
    76
    unittest_main()