def test_prevent_type_change(self):
"""Make sure a malicious user can't change content type."""
indexable = GrandchildIndexable(foo="AirWolf", bar=10, baz=date(1980, 1, 1))
indexable.save()
serializer_class = indexable.get_serializer_class()
serializer = serializer_class(indexable)
data = serializer.data
# change the polymorphic content type to something different
separate_ctype = ContentType.objects.get_for_model(SeparateIndexable, for_concrete_model=False)
data['polymorphic_ctype'] = separate_ctype.id
serializer = serializer_class(data=data)
self.assertTrue(serializer.is_valid())
serializer.save()
self.assertIsInstance(serializer.object, GrandchildIndexable)
# and check the ctype anyways:
grandchild_ctype = ContentType.objects.get_for_model(GrandchildIndexable, for_concrete_model=False)
self.assertEqual(indexable.polymorphic_ctype_id, grandchild_ctype.id)
def test_prevent_type_change(self):
"""Make sure a malicious user can't change content type."""
indexable = GrandchildIndexable(foo="AirWolf",
bar=10,
baz=date(1980, 1, 1))
indexable.save()
serializer_class = indexable.get_serializer_class()
serializer = serializer_class(indexable)
data = serializer.data
# change the polymorphic content type to something different
separate_ctype = ContentType.objects.get_for_model(
SeparateIndexable, for_concrete_model=False)
data['polymorphic_ctype'] = separate_ctype.id
serializer = serializer_class(data=data)
self.assertTrue(serializer.is_valid())
serializer.save()
self.assertIsInstance(serializer.object, GrandchildIndexable)
# and check the ctype anyways:
grandchild_ctype = ContentType.objects.get_for_model(
GrandchildIndexable, for_concrete_model=False)
self.assertEqual(indexable.polymorphic_ctype_id, grandchild_ctype.id)
def test_extract_document(self):
related = RelatedModel.objects.create(qux="qux")
test_obj = GrandchildIndexable(
foo="Testing",
bar=7,
baz=datetime.datetime(year=2014, month=4, day=23, hour=9).replace(tzinfo=timezone.utc),
related=related
)
test_obj.save(index=False)
reference_document = {
"id": test_obj.pk,
"parentindexable_ptr_id": test_obj.pk,
"childindexable_ptr_id": test_obj.pk,
"polymorphic_ctype_id": test_obj.polymorphic_ctype_id,
"foo": "Testing",
"bar": 7,
"baz": "2014-04-23T09:00:00+00:00",
"related_id": related.id
}
self.assertEqual(reference_document, test_obj.extract_document())