Add a few tests demonstrating the CSRF protection intergration in

zope.formlib.
zopefoundation · Nov 18, 2013 · 994e2b8 · 994e2b8
1 parent a5eda97
commit 994e2b8
Show file tree

Hide file tree

Showing 4 changed files with 50 additions and 6 deletions.
diff --git a/buildout.cfg b/buildout.cfg
@@ -7,7 +7,6 @@ extends = https://raw.github.com/zopefoundation/groktoolkit/master/grok.cfg
 versions = versions
 extensions = buildout.dumppickedversions
 
-
 [versions]
 grokcore.formlib =
 zope.formlib =

diff --git a/src/grokcore/formlib/ftests/form/form.py b/src/grokcore/formlib/ftests/form/form.py
@@ -25,6 +25,45 @@
   ...Really big...
   ...
 
+"Protected" forms only validate and process request data for the given
+HTTP verb - usually POST. In addition, CSRF protection can be enabled.
+
+"Submitting" the form over GET parameters should result in an
+MethodNotAllowed error as the form is configured to only allow submits
+over POST requests::
+
+  >>> browser.open(
+  ...    "http://localhost/manfred/@@editprotected?"
+  ...    "form.name=Manfred&form.size=Big&form.actions.apply=Apply")
+  Traceback (most recent call last):
+  ...
+  MethodNotAllowed: <grokcore.formlib.ftests.form.form.Mammoth object at ...>,
+  <zope.publisher.browser.BrowserRequest
+  instance URL=http://localhost/manfred/@@editprotected>
+
+When CSRF protection is enabled, the corresponding hidden form field is
+rendered by the form templates::
+
+  >>> browser.open("http://localhost/manfred/@@editcsrfprotected")
+  >>> print browser.contents
+  <html>...
+  <input type="hidden" name="__csrftoken__" value="..." />...
+
+  >>> browser.cookies['__csrftoken__'] in browser.contents
+  True
+
+Submitting the form with a wrong token or a missing token, will raise an
+InvalidForm error::
+
+  >>> browser.open("http://localhost/manfred/@@editcsrfprotected")
+  >>> browser.getControl(name="form.name").value = "Manfred the Mammoth"
+  >>> browser.getControl(name="form.size").value = "Really big"
+  >>> browser.getControl(name="__csrftoken__").value = "invalid value"
+  >>> browser.getControl("Apply").click()
+  Traceback (most recent call last):
+  ...
+  InvalidCSRFTokenError: Invalid CSRF token
+
 """
 import grokcore.formlib as grok
 from zope import schema
@@ -39,12 +78,18 @@ class Mammoth(grok.testing.Model):
     implements(IMammoth)
     grok.testing.protect_get(grok.Public, 'name', 'size')
     grok.testing.protect_set(grok.Public, 'name', 'size')
-    
-    name = FieldProperty(IMammoth['name'])    
-    size = FieldProperty(IMammoth['size'])    
+
+    name = FieldProperty(IMammoth['name'])
+    size = FieldProperty(IMammoth['size'])
 
 class Edit(grok.EditForm):
     pass
 
 class Display(grok.DisplayForm):
     pass
+
+class EditProtected(grok.EditForm):
+    method = 'POST'  # only allow submits over POST requests.
+
+class EditCsrfProtected(EditProtected):
+    protected = True  # enables CSRF protection.
diff --git a/src/grokcore/formlib/templates/default_display_form.pt b/src/grokcore/formlib/templates/default_display_form.pt
@@ -27,7 +27,7 @@
       <tr class="controls">
         <td colspan="2" class="align-right">
           <input type="hidden"
-            name="___csrftoken__"
+            name="__csrftoken__"
             tal:condition="view/protected"
             tal:attributes="value view/csrftoken"
           />

diff --git a/src/grokcore/formlib/templates/default_edit_form.pt b/src/grokcore/formlib/templates/default_edit_form.pt
@@ -58,7 +58,7 @@
 
   <div id="actionsView">
     <input type="hidden"
-      name="___csrftoken__"
+      name="__csrftoken__"
       tal:condition="view/protected"
       tal:attributes="value view/csrftoken"
     />