Fixed #7776: Ensured that the test cookie is always deleted once a lo…

…gin has succeeded. Thanks for the report and fix, Mnewman.

git-svn-id: http://code.djangoproject.com/svn/django/trunk@8484 bcc190cf-cafb-0310-a4f2-bffc1f526a37

django/contrib/admin/sites.py

@@ -274,13 +274,13 @@ def login(self, request):
                 login(request, user)
                 if request.POST.has_key('post_data'):
                     post_data = _decode_post_data(request.POST['post_data'])
+                    request.session.delete_test_cookie()
                     if post_data and not post_data.has_key(LOGIN_FORM_KEY):
                         # overwrite request.POST with the saved post_data, and continue
                         request.POST = post_data
                         request.user = user
                         return self.root(request, request.path.split(self.root_path)[-1])
                     else:
-                        request.session.delete_test_cookie()
                         return http.HttpResponseRedirect(request.get_full_path())
             else:
                 return self.display_login_form(request, ERROR_MESSAGE)

tests/regressiontests/admin_views/tests.py

@@ -237,6 +237,8 @@ def testAddView(self):
         # Change User should not have access to add articles
         self.client.get('/test_admin/admin/')
         self.client.post('/test_admin/admin/', self.changeuser_login)
+        # make sure the view removes test cookie
+        self.failUnlessEqual(self.client.session.test_cookie_worked(), False)
         request = self.client.get('/test_admin/admin/admin_views/article/add/')
         self.failUnlessEqual(request.status_code, 403)
         # Try POST just to make sure
@@ -266,6 +268,8 @@ def testAddView(self):
         self.assertContains(post, 'Please log in again, because your session has expired.')
         self.super_login['post_data'] = _encode_post_data(add_dict)
         post = self.client.post('/test_admin/admin/admin_views/article/add/', self.super_login)
+        # make sure the view removes test cookie
+        self.failUnlessEqual(self.client.session.test_cookie_worked(), False)
         self.assertRedirects(post, '/test_admin/admin/admin_views/article/')
         self.failUnlessEqual(Article.objects.all().count(), 4)
         self.client.get('/test_admin/admin/logout/')