diff --git a/cms/templates/widgets/header.html b/cms/templates/widgets/header.html index b190392073..763a75461a 100644 --- a/cms/templates/widgets/header.html +++ b/cms/templates/widgets/header.html @@ -230,9 +230,11 @@
  • ${_("Help")}
    • - + % if static.get_value('ALLOW_PUBLIC_ACCOUNT_CREATION', settings.FEATURES.get('ALLOW_PUBLIC_ACCOUNT_CREATION')): + + % endif diff --git a/common/djangoapps/student/tests/test_auto_auth.py b/common/djangoapps/student/tests/test_auto_auth.py index 484ddab13c..79c847e7e6 100644 --- a/common/djangoapps/student/tests/test_auto_auth.py +++ b/common/djangoapps/student/tests/test_auto_auth.py @@ -9,7 +9,7 @@ from student.models import anonymous_id_for_user, CourseEnrollment, UserProfile from util.testing import UrlResetMixin from opaque_keys.edx.locations import SlashSeparatedCourseKey from opaque_keys.edx.locator import CourseLocator -from mock import patch +from mock import patch, Mock import ddt import json @@ -261,6 +261,14 @@ class AutoAuthEnabledTestCase(AutoAuthTestCase): return response + @patch("openedx.core.djangoapps.site_configuration.helpers.get_value", Mock(return_value=False)) + def test_create_account_not_allowed(self): + """ + Test case to check user creation is forbidden when ALLOW_PUBLIC_ACCOUNT_CREATION feature flag is turned off + """ + response = self.client.get(self.url) + self.assertEqual(response.status_code, 403) + class AutoAuthDisabledTestCase(AutoAuthTestCase): """ diff --git a/common/djangoapps/student/tests/test_create_account.py b/common/djangoapps/student/tests/test_create_account.py index 86f812ab58..a3a354e1b9 100644 --- a/common/djangoapps/student/tests/test_create_account.py +++ b/common/djangoapps/student/tests/test_create_account.py @@ -4,6 +4,7 @@ import json import unittest import ddt +from mock import patch from django.conf import settings from django.contrib.auth.models import User, AnonymousUser from django.core.urlresolvers import reverse @@ -404,6 +405,14 @@ class TestCreateAccount(TestCase): UserAttribute.get_user_attribute(user, REGISTRATION_UTM_CREATED_AT) ) + @patch("openedx.core.djangoapps.site_configuration.helpers.get_value", mock.Mock(return_value=False)) + def test_create_account_not_allowed(self): + """ + Test case to check user creation is forbidden when ALLOW_PUBLIC_ACCOUNT_CREATION feature flag is turned off + """ + response = self.client.get(self.url) + self.assertEqual(response.status_code, 403) + @ddt.ddt class TestCreateAccountValidation(TestCase): diff --git a/common/djangoapps/student/views.py b/common/djangoapps/student/views.py index ca60f6fe7e..1711368197 100644 --- a/common/djangoapps/student/views.py +++ b/common/djangoapps/student/views.py @@ -23,6 +23,7 @@ from django.contrib.auth.views import password_reset_confirm from django.contrib import messages from django.core.context_processors import csrf from django.core import mail +from django.core.exceptions import PermissionDenied from django.core.urlresolvers import reverse, NoReverseMatch, reverse_lazy from django.core.validators import validate_email, ValidationError from django.db import IntegrityError, transaction @@ -1549,6 +1550,13 @@ def _do_create_account(form, custom_form=None): Note: this function is also used for creating test users. """ + # Check if ALLOW_PUBLIC_ACCOUNT_CREATION flag turned off to restrict user account creation + if not configuration_helpers.get_value( + 'ALLOW_PUBLIC_ACCOUNT_CREATION', + settings.FEATURES.get('ALLOW_PUBLIC_ACCOUNT_CREATION', True) + ): + raise PermissionDenied() + errors = {} errors.update(form.errors) if custom_form: @@ -1970,6 +1978,13 @@ def create_account(request, post_override=None): JSON call to create new edX account. Used by form in signup_modal.html, which is included into navigation.html """ + # Check if ALLOW_PUBLIC_ACCOUNT_CREATION flag turned off to restrict user account creation + if not configuration_helpers.get_value( + 'ALLOW_PUBLIC_ACCOUNT_CREATION', + settings.FEATURES.get('ALLOW_PUBLIC_ACCOUNT_CREATION', True) + ): + return HttpResponseForbidden(_("Account creation not allowed.")) + warnings.warn("Please use RegistrationView instead.", DeprecationWarning) try: @@ -2074,6 +2089,8 @@ def auto_auth(request): user.save() profile = UserProfile.objects.get(user=user) reg = Registration.objects.get(user=user) + except PermissionDenied: + return HttpResponseForbidden(_("Account creation not allowed.")) # Set the user's global staff bit if is_staff is not None: diff --git a/lms/djangoapps/student_account/test/test_views.py b/lms/djangoapps/student_account/test/test_views.py index 7b83c16398..5ae3d7de6c 100644 --- a/lms/djangoapps/student_account/test/test_views.py +++ b/lms/djangoapps/student_account/test/test_views.py @@ -40,6 +40,7 @@ from openedx.core.djangoapps.programs.tests.mixins import ProgramsApiConfigMixin from openedx.core.djangoapps.user_api.accounts.api import activate_account, create_account from openedx.core.djangoapps.user_api.accounts import EMAIL_MAX_LENGTH from openedx.core.djangolib.js_utils import dump_js_escaped_json +from openedx.core.djangoapps.site_configuration.tests.mixins import SiteMixin from openedx.core.djangolib.testing.utils import CacheIsolationTestCase from student.tests.factories import UserFactory from student_account.views import account_settings_context, get_user_orders @@ -735,3 +736,30 @@ class MicrositeLogistrationTests(TestCase): self.assertEqual(resp.status_code, 200) self.assertNotIn('