Commit aeed2cf3 authored by Tim Graham's avatar Tim Graham
Browse files

Added a test to show that the user.is_staff check in admin base.html is necessary. 

refs #21067
parent 28a57134

tests/admin_views/tests.py

+13 −0
Original line number Diff line number Diff line
@@ -1296,6 +1296,19 @@ class AdminViewPermissionsTest(TestCase): 
        response = self.client.get('/test_admin/admin/secure-view/')

        self.assertContains(response, 'id="login-form"')



    def testDisabledStaffPermissionsWhenLoggedIn(self):

        self.client.login(username='super', password='secret')

        superuser = User.objects.get(username='super')

        superuser.is_staff = False

        superuser.save()



        response = self.client.get('/test_admin/admin/')

        self.assertContains(response, 'id="login-form"')

        self.assertNotContains(response, 'Log out')



        response = self.client.get('/test_admin/admin/secure-view/')

        self.assertContains(response, 'id="login-form"')





@override_settings(PASSWORD_HASHERS=('django.contrib.auth.hashers.SHA1PasswordHasher',))

class AdminViewsNoUrlTest(TestCase):