Fixes to CMS failures in Django 1.11 tests

openedx/core/djangoapps/cors_csrf/authentication.py

@@ -8,7 +8,8 @@ from .helpers import is_cross_domain_request_allowed, skip_cross_domain_referer_
 
 
 class SessionAuthenticationCrossDomainCsrf(authentication.SessionAuthentication):
-    """Session authentication that skips the referer check over secure connections.
+    """
+    Session authentication that skips the referer check over secure connections.
 
     Django Rest Framework's `SessionAuthentication` class calls Django's
     CSRF middleware implementation directly, which bypasses the middleware
@@ -21,11 +22,12 @@ class SessionAuthenticationCrossDomainCsrf(authentication.SessionAuthentication)
 
     Since this subclass overrides only the `enforce_csrf()` method,
     it can be mixed in with other `SessionAuthentication` subclasses.
-
     """
 
     def enforce_csrf(self, request):
-        """Skip the referer check if the cross-domain request is allowed. """
+        """
+        Skip the referer check if the cross-domain request is allowed.
+        """
         if is_cross_domain_request_allowed(request):
             with skip_cross_domain_referer_check(request):
                 return super(SessionAuthenticationCrossDomainCsrf, self).enforce_csrf(request)

openedx/core/djangoapps/cors_csrf/tests/test_authentication.py

@@ -1,6 +1,7 @@
 """Tests for the CORS CSRF version of Django Rest Framework's SessionAuthentication."""
 from mock import patch
 
+from django.middleware.csrf import get_token
 from django.test import TestCase
 from django.test.utils import override_settings
 from django.test.client import RequestFactory
@@ -11,16 +12,21 @@ from rest_framework.exceptions import PermissionDenied
 from ..authentication import SessionAuthenticationCrossDomainCsrf
 
 
+# A class to pass into django.middleware.csrf.get_token() so we can easily get a valid CSRF token to use.
+class FakeRequest(object):
+    META = {}
+
+
 class CrossDomainAuthTest(TestCase):
     """Tests for the CORS CSRF version of Django Rest Framework's SessionAuthentication. """
 
     URL = "/dummy_url"
     REFERER = "https://www.edx.org"
-    CSRF_TOKEN = 'abcd1234'
 
     def setUp(self):
         super(CrossDomainAuthTest, self).setUp()
         self.auth = SessionAuthenticationCrossDomainCsrf()
+        self.csrf_token = get_token(FakeRequest())
 
     def test_perform_csrf_referer_check(self):
         request = self._fake_request()
@@ -45,12 +51,14 @@ class CrossDomainAuthTest(TestCase):
     def _fake_request(self):
         """Construct a fake request with a referer and CSRF token over a secure connection. """
         factory = RequestFactory()
-        factory.cookies[settings.CSRF_COOKIE_NAME] = self.CSRF_TOKEN
-
+        factory.cookies[settings.CSRF_COOKIE_NAME] = self.csrf_token
         request = factory.post(
             self.URL,
             HTTP_REFERER=self.REFERER,
-            HTTP_X_CSRFTOKEN=self.CSRF_TOKEN
+            HTTP_X_CSRFTOKEN=self.csrf_token
         )
         request.is_secure = lambda: True
+
+        # The way we're testing this skips django.middleware.csrf's process_request, which copies this from the cookie
+        request.META['CSRF_COOKIE'] = self.csrf_token
         return request

openedx/core/djangoapps/cors_csrf/tests/test_decorators.py

@@ -18,6 +18,7 @@ class TestEnsureCsrfCookieCrossDomain(TestCase):
     def test_ensure_csrf_cookie_cross_domain(self):
         request = mock.Mock()
         request.META = {}
+        request.COOKIES = {}
         wrapped_view = ensure_csrf_cookie_cross_domain(fake_view)
         response = wrapped_view(request)
         response_meta = json.loads(response.content)