def process_view(self, request, view_func, view_args, view_kwargs):
logout = LogoutView.as_view().__name__
is_logout = view_func.__name__ == logout
is_login = view_func.__name__ == LoginView.as_view().__name__
if is_login or is_logout:
return None
if view_func.__name__ == CasLogin.__name__:
return CasLogin(request, *view_args, **view_kwargs)
elif is_logout:
return CasLogout.as_view(request, *view_args, **view_kwargs)
if settings.CAS_ADMIN_PREFIX:
if not request.path.startswith(settings.CAS_ADMIN_PREFIX):
return None
elif not view_func.__module__.startswith('django.contrib.admin.'):
return None
if request.user.is_authenticated:
if request.user.has_perm('wagtailadmin.access_admin'):
"""
Implemented using wagtails permissions model
https://github.com/torchbox/wagtail/blob/master/wagtail/wagtailadmin/views/account.py#L112 # noqa
"""
return None
else:
return permission_denied(request, HttpResponseForbidden)
return super(MoloCASMiddleware, self).process_view(
request, view_func, view_args, view_kwargs)
def test_signal_when_user_logout_manual(monkeypatch, django_user_model):
session = SessionStore()
session['fake_session_key'] = 'fake-session_value'
session.save()
assert SessionStore(session_key=session.session_key) is not None
factory = RequestFactory()
request = factory.get('/logout')
request.session = session
# Create a fake session ticket and make sure it exists in the db
session_ticket = SessionTicket.objects.create(
session_key=session.session_key, ticket='fake-ticket')
user = django_user_model.objects.create_user('*****@*****.**', '')
assert user is not None
request.user = user
callback_values = {}
@receiver(cas_user_logout)
def callback(sender, session, **kwargs):
callback_values.update(kwargs)
callback_values['session'] = dict(session)
response = LogoutView().get(request)
assert request.user.is_anonymous is True
assert 'user' in callback_values
assert callback_values['user'] == user
assert 'session' in callback_values
assert callback_values['session'].get(
'fake_session_key') == 'fake-session_value'
assert 'ticket' in callback_values
assert callback_values['ticket'] == 'fake-ticket'
def test_logout_completely(django_user_model, settings):
"""
Test the case where the user logs out.
"""
settings.CAS_LOGOUT_COMPLETELY = True
factory = RequestFactory()
request = factory.get('/logout/')
# Create a session object from the middleware
process_request_for_middleware(request, SessionMiddleware)
user = django_user_model.objects.create_user('*****@*****.**', '')
assert user is not None
request.user = user
response = LogoutView().get(request)
assert response.status_code == 302
assert request.user.is_anonymous is True
from django.conf.urls import url
from django_cas_ng.views import LoginView, LogoutView, CallbackView
urlpatterns = [
url(r'^login/$', LoginView.as_view(), name='cas_ng_login'),
url(r'^logout/$', LogoutView.as_view(), name='cas_ng_logout'),
url(r'^callback/$', CallbackView.as_view(), name='cas_ng_proxy_callback'),
]
admin.site.site_header = 'CCA Libraries Administration'
admin.autodiscover()
urlpatterns = [
path('django-admin/', admin.site.urls),
# override Wagtail document handling — send file, not a forced download
path('documents/<int:document_id>/<document_filename>',
serve_wagtail_doc,
name='wagtaildocs_serve'),
# CAS login urls
# NOTE: ^admin/logout/$ must appear before ^admin/ or it's impossible to logout
path('login/', LoginView.as_view(), name='cas_ng_login'),
path('admin/login/', LoginView.as_view()),
path('admin/logout/', LogoutView.as_view(), name='cas_ng_logout'),
path('admin/', include(wagtailadmin_urls)),
# @TODO can we do this using just Wagtail REST APIs instead of Django REST framework?
path('api/v2/', api_router.urls),
path('api/v1/', include('alerts.urls')),
path('search/', search_views.search, name='search'),
path('hours/', hours_views.hours, name='hours'),
# Summon "broken links" app
path('brokenlinks/', brokenlinks_views.brokenlinks, name='brokenlinks'),
# Serials Solution API proxy
path('sersol/', sersol_views.sersol, name='sersol_api'),
# Favicon
path(