Fixed django-cms#6002 -- Prevent users from moving homepage under another page (django-cms#6369)

vaquer · czpython · commit 68a2d0d27577 · 2018-06-09T18:51:12.000-04:00
diff --git a/CHANGELOG.txt b/CHANGELOG.txt
@@ -12,6 +12,7 @@
   operation was to move a plugin in the top level of same placeholder
 * Fixed a bug where xframe options were processed by clickjacking middleware
   when page was served from cache, rather then get this value from cache
+* Added form validation logic to prevent users from moving the home page under another page.
 
 
 === 3.5.2 (2018-04-11) ===
diff --git a/cms/admin/forms.py b/cms/admin/forms.py
@@ -825,6 +825,13 @@ def _get_tree_options_for_parent(self, parent_node, position):
 
 class MovePageForm(PageTreeForm):
 
+    def clean(self):
+        cleaned_data = super(MovePageForm, self).clean()
+
+        if self.page.is_home and cleaned_data.get('target'):
+            self.add_error('target', force_text(_('You can\'t move the home page inside another page')))
+        return cleaned_data
+
     def get_tree_options(self):
         options = super(MovePageForm, self).get_tree_options()
         target_node, target_node_position = options
diff --git a/cms/tests/test_page_admin.py b/cms/tests/test_page_admin.py
@@ -1144,6 +1144,24 @@ def test_move_page(self):
             page3 = Page.objects.get(pk=page3.pk)
             self.assertEqual(page3.get_path(), page_data2['slug'] + "/" + page_data3['slug'])
 
+    def test_user_cant_nest_home_page(self):
+        """
+        Users should not be able to move the home-page
+        inside another node of the tree.
+        """
+        homepage = create_page("home", "nav_playground.html", "en", published=True)
+        homepage.set_as_homepage()
+        home_sibling_1 = create_page("root-1", "nav_playground.html", "en", published=True)
+
+        payload = {'id': homepage.pk, 'position': 0, 'target': home_sibling_1}
+
+        with self.login_user_context(self.get_superuser()):
+            endpoint = self.get_admin_url(Page, 'move_page', homepage.pk)
+            response = self.client.post(endpoint, payload)
+
+            self.assertEqual(response.status_code, 200)
+            self.assertEqual(response.json().get('status', 400), 400)
+
     def test_move_home_page(self):
         """
         Users should be able to move the home-page
