Merge pull request #17130 from edx/jeskew/fix_lms_shard_4_tests_django_111

LMS shard 4 tests Django 1.11

openedx/core/djangoapps/cors_csrf/authentication.py

@@ -1,7 +1,8 @@
 """
 Django Rest Framework Authentication classes for cross-domain end-points.
 """
-
+import django
+from django.middleware.csrf import CsrfViewMiddleware
 from rest_framework import authentication
 
 from .helpers import is_cross_domain_request_allowed, skip_cross_domain_referer_check
@@ -23,6 +24,12 @@ class SessionAuthenticationCrossDomainCsrf(authentication.SessionAuthentication)
     Since this subclass overrides only the `enforce_csrf()` method,
     it can be mixed in with other `SessionAuthentication` subclasses.
     """
+    # TODO: Remove Django 1.11 upgrade shim
+    # SHIM: Call new process_request in Django 1.11 to process CSRF token in cookie.
+    def _process_enforce_csrf(self, request):
+        if django.VERSION >= (1, 11):
+            CsrfViewMiddleware().process_request(request)
+        return super(SessionAuthenticationCrossDomainCsrf, self).enforce_csrf(request)
 
     def enforce_csrf(self, request):
         """
@@ -30,6 +37,6 @@ class SessionAuthenticationCrossDomainCsrf(authentication.SessionAuthentication)
         """
         if is_cross_domain_request_allowed(request):
             with skip_cross_domain_referer_check(request):
-                return super(SessionAuthenticationCrossDomainCsrf, self).enforce_csrf(request)
+                return self._process_enforce_csrf(request)
         else:
-            return super(SessionAuthenticationCrossDomainCsrf, self).enforce_csrf(request)
+            return self._process_enforce_csrf(request)

openedx/core/djangoapps/external_auth/tests/test_shib.py

@@ -526,10 +526,10 @@ class ShibSPTestModifiedCourseware(ModuleStoreTestCase):
         # Tests the two case for courses, limited and not
         for course in [shib_course, open_enroll_course]:
             for student in [shib_student, other_ext_student, int_student]:
-                request = self.request_factory.post('/change_enrollment')
-
-                request.POST.update({'enrollment_action': 'enroll',
-                                     'course_id': text_type(course.id)})
+                request = self.request_factory.post(
+                    '/change_enrollment',
+                    data={'enrollment_action': 'enroll', 'course_id': text_type(course.id)}
+                )
                 request.user = student
                 response = change_enrollment(request)
                 # If course is not limited or student has correct shib extauth then enrollment should be allowed

openedx/core/djangoapps/oauth_dispatch/dot_overrides/validators.py

@@ -5,12 +5,14 @@ from __future__ import unicode_literals
 
 from datetime import datetime
 
+import django
 from django.contrib.auth import authenticate, get_user_model
 from django.db.models.signals import pre_save
 from django.dispatch import receiver
 from oauth2_provider.models import AccessToken
 from oauth2_provider.oauth2_validators import OAuth2Validator
 from pytz import utc
+from ratelimitbackend.backends import RateLimitMixin
 
 from ..models import RestrictedApplication
 
@@ -29,6 +31,30 @@ def on_access_token_presave(sender, instance, *args, **kwargs):  # pylint: disab
         RestrictedApplication.set_access_token_as_expired(instance)
 
 
+# TODO: Remove Django 1.11 upgrade shim
+# SHIM: Allow users that are inactive to still authenticate while keeping rate-limiting functionality.
+if django.VERSION < (1, 10):
+    # Old backend which allowed inactive users to authenticate prior to Django 1.10.
+    from django.contrib.auth.backends import ModelBackend as UserModelBackend
+else:
+    # Django 1.10+ ModelBackend disallows inactive users from authenticating, so instead we use
+    # AllowAllUsersModelBackend which is the closest alternative.
+    from django.contrib.auth.backends import AllowAllUsersModelBackend as UserModelBackend
+
+
+class EdxRateLimitedAllowAllUsersModelBackend(RateLimitMixin, UserModelBackend):
+    """
+    Authentication backend needed to incorporate rate limiting of login attempts - but also
+    enabling users with is_active of False in the Django auth_user model to still authenticate.
+    This is necessary for mobile users using 3rd party auth who have not activated their accounts,
+    Inactive users who use 1st party auth (username/password auth) will still fail login attempts,
+    just at a higher layer, in the login_user view.
+
+    See: https://openedx.atlassian.net/browse/TNL-4516
+    """
+    pass
+
+
 class EdxOAuth2Validator(OAuth2Validator):
     """
     Validator class that implements edX-specific custom behavior:

openedx/core/djangoapps/video_config/forms.py

@@ -11,6 +11,7 @@ from openedx.core.djangoapps.video_config.models import (
     CourseHLSPlaybackEnabledFlag,
     CourseVideoTranscriptEnabledFlag,
 )
+from openedx.core.lib.courses import clean_course_id
 from xmodule.modulestore.django import modulestore
 
 log = logging.getLogger(__name__)
@@ -29,22 +30,7 @@ class CourseSpecificFlagAdminBaseForm(forms.ModelForm):
         """
         Validate the course id
         """
-        cleaned_id = self.cleaned_data["course_id"]
-        try:
-            course_key = CourseLocator.from_string(cleaned_id)
-        except InvalidKeyError:
-            msg = u'Course id invalid. Entered course id was: "{course_id}."'.format(
-                course_id=cleaned_id
-            )
-            raise forms.ValidationError(msg)
-
-        if not modulestore().has_course(course_key):
-            msg = u'Course not found. Entered course id was: "{course_key}". '.format(
-                course_key=unicode(course_key)
-            )
-            raise forms.ValidationError(msg)
-
-        return course_key
+        return clean_course_id(self)
 
 
 class CourseHLSPlaybackFlagAdminForm(CourseSpecificFlagAdminBaseForm):