Merge pull request #17115 from edx/bmedx/django111_cms_test_failures

Fixes to CMS failures in Django 1.11 tests

openedx/core/djangoapps/cors_csrf/authentication.py

@@ -8,7 +8,8 @@ from .helpers import is_cross_domain_request_allowed, skip_cross_domain_referer_
 
 
 class SessionAuthenticationCrossDomainCsrf(authentication.SessionAuthentication):
-    """Session authentication that skips the referer check over secure connections.
+    """
+    Session authentication that skips the referer check over secure connections.
 
     Django Rest Framework's `SessionAuthentication` class calls Django's
     CSRF middleware implementation directly, which bypasses the middleware
@@ -21,11 +22,12 @@ class SessionAuthenticationCrossDomainCsrf(authentication.SessionAuthentication)
 
     Since this subclass overrides only the `enforce_csrf()` method,
     it can be mixed in with other `SessionAuthentication` subclasses.
-
     """
 
     def enforce_csrf(self, request):
-        """Skip the referer check if the cross-domain request is allowed. """
+        """
+        Skip the referer check if the cross-domain request is allowed.
+        """
         if is_cross_domain_request_allowed(request):
             with skip_cross_domain_referer_check(request):
                 return super(SessionAuthenticationCrossDomainCsrf, self).enforce_csrf(request)

openedx/core/djangoapps/cors_csrf/tests/test_authentication.py

@@ -1,6 +1,7 @@
 """Tests for the CORS CSRF version of Django Rest Framework's SessionAuthentication."""
 from mock import patch
 
+from django.middleware.csrf import get_token
 from django.test import TestCase
 from django.test.utils import override_settings
 from django.test.client import RequestFactory
@@ -11,16 +12,21 @@ from rest_framework.exceptions import PermissionDenied
 from ..authentication import SessionAuthenticationCrossDomainCsrf
 
 
+# A class to pass into django.middleware.csrf.get_token() so we can easily get a valid CSRF token to use.
+class FakeRequest(object):
+    META = {}
+
+
 class CrossDomainAuthTest(TestCase):
     """Tests for the CORS CSRF version of Django Rest Framework's SessionAuthentication. """
 
     URL = "/dummy_url"
     REFERER = "https://www.edx.org"
-    CSRF_TOKEN = 'abcd1234'
 
     def setUp(self):
         super(CrossDomainAuthTest, self).setUp()
         self.auth = SessionAuthenticationCrossDomainCsrf()
+        self.csrf_token = get_token(FakeRequest())
 
     def test_perform_csrf_referer_check(self):
         request = self._fake_request()
@@ -45,12 +51,14 @@ class CrossDomainAuthTest(TestCase):
     def _fake_request(self):
         """Construct a fake request with a referer and CSRF token over a secure connection. """
         factory = RequestFactory()
-        factory.cookies[settings.CSRF_COOKIE_NAME] = self.CSRF_TOKEN
-
+        factory.cookies[settings.CSRF_COOKIE_NAME] = self.csrf_token
         request = factory.post(
             self.URL,
             HTTP_REFERER=self.REFERER,
-            HTTP_X_CSRFTOKEN=self.CSRF_TOKEN
+            HTTP_X_CSRFTOKEN=self.csrf_token
         )
         request.is_secure = lambda: True
+
+        # The way we're testing this skips django.middleware.csrf's process_request, which copies this from the cookie
+        request.META['CSRF_COOKIE'] = self.csrf_token
         return request

openedx/core/djangoapps/cors_csrf/tests/test_decorators.py

@@ -18,6 +18,7 @@ class TestEnsureCsrfCookieCrossDomain(TestCase):
     def test_ensure_csrf_cookie_cross_domain(self):
         request = mock.Mock()
         request.META = {}
+        request.COOKIES = {}
         wrapped_view = ensure_csrf_cookie_cross_domain(fake_view)
         response = wrapped_view(request)
         response_meta = json.loads(response.content)

openedx/core/djangoapps/external_auth/tests/test_shib.py

@@ -322,7 +322,7 @@ class ShibSPTest(CacheIsolationTestCase):
                     'terms_of_service': u'true',
                     'honor_code': u'true'}
 
-        with patch('student.views.AUDIT_LOG') as mock_audit_log:
+        with patch('student.views.management.AUDIT_LOG') as mock_audit_log:
             self.client.post('/create_account', data=postvars)
 
         mail = identity.get('mail')

openedx/core/djangoapps/user_api/accounts/tests/test_api.py

@@ -200,7 +200,7 @@ class TestAccountApi(UserSettingsEventTestMixin, TestCase):
         self.assertIn("Full Name cannot contain the following characters: < >", field_errors["name"]["user_message"])
 
     @patch('django.core.mail.send_mail')
-    @patch('student.views.render_to_string', Mock(side_effect=mock_render_to_string, autospec=True))
+    @patch('student.views.management.render_to_string', Mock(side_effect=mock_render_to_string, autospec=True))
     def test_update_sending_email_fails(self, send_mail):
         """Test what happens if all validation checks pass, but sending the email for email change fails."""
         send_mail.side_effect = [Exception, None]