72 lines
3.3 KiB
Python
72 lines
3.3 KiB
Python
from itertools import product
|
|
from werkzeug.urls import url_encode
|
|
|
|
from odoo import http
|
|
from odoo.tests import tagged
|
|
|
|
from .test_appointment_ui import AppointmentUICommon
|
|
|
|
|
|
@tagged("appointment_ui", "security", "-at_install", "post_install")
|
|
class AppointmentControllerSecurity(AppointmentUICommon):
|
|
def test_appointment_submit_no_csrf(self):
|
|
"""Check that the form does not require a CSRF token when logged out.
|
|
|
|
When logged out we should always create a new partner regardless of whether one exists
|
|
with similar contact info, so it is ok to not check CSRF as we do not use any session-related
|
|
information during form submission.
|
|
"""
|
|
invite = self.env["appointment.invite"].create({
|
|
"appointment_type_ids": self.apt_type_bxls_2days.ids,
|
|
"resources_choice": "all_assigned_resources",
|
|
})
|
|
appointment_url = (
|
|
f"/appointment/{self.apt_type_bxls_2days.id}/submit?{url_encode(invite._get_redirect_url_parameters())}"
|
|
)
|
|
phone_question = self.apt_type_bxls_2days._get_main_phone_question()
|
|
self.assertTrue(phone_question)
|
|
|
|
base_appointment_data = {
|
|
"allday": 0,
|
|
"csrf_token": False,
|
|
"duration_str": "1.0",
|
|
"datetime_str": "2022-07-04 12:30:00",
|
|
"email": self.apt_manager.email,
|
|
"name": "logged-out Apt Manager",
|
|
f"question_{phone_question.id}": self.apt_manager.phone,
|
|
"staff_user_id": self.staff_user_bxls.id,
|
|
}
|
|
existing_partners = self.staff_user_bxls.partner_id + self.apt_manager.partner_id
|
|
for login, with_csrf in product((None, self.apt_manager.login), (False, True)):
|
|
with self.subTest(login=login, with_csrf=with_csrf):
|
|
self.authenticate(login, login)
|
|
res = self.url_open(
|
|
appointment_url,
|
|
data=base_appointment_data | ({"csrf_token": http.Request.csrf_token(self)} if with_csrf else {}),
|
|
)
|
|
|
|
if not login or with_csrf:
|
|
self.assertTrue(res.ok)
|
|
self.assertIn("/calendar/view/", res.url)
|
|
else:
|
|
self.assertFalse(res.ok)
|
|
continue
|
|
|
|
latest_partner = self.env["res.partner"].search([], order="id DESC", limit=1)
|
|
latest_appointment = self.env["calendar.event"].search([], order="id DESC", limit=1)
|
|
|
|
if not login:
|
|
self.assertNotIn(latest_partner, existing_partners)
|
|
|
|
self.assertEqual(latest_partner.email, self.apt_manager.email)
|
|
self.assertEqual(latest_partner.name, "logged-out Apt Manager")
|
|
self.assertEqual(latest_appointment.partner_ids, latest_partner + self.staff_user_bxls.partner_id)
|
|
self.assertNotEqual(latest_partner, self.apt_manager.partner_id)
|
|
elif login and with_csrf:
|
|
self.assertEqual(
|
|
latest_appointment.partner_ids, self.apt_manager.partner_id + self.staff_user_bxls.partner_id
|
|
)
|
|
existing_partners |= latest_partner
|
|
# avoid using up a slot for following tests
|
|
latest_appointment.unlink()
|