wagtail 6.1.2__py3-none-any.whl → 6.2__py3-none-any.whl

wagtail/admin/tests/viewsets/test_model_viewset.py

@@ -13,6 +13,7 @@ from django.utils.html import escape
 from django.utils.timezone import make_aware
 from openpyxl import load_workbook
 
+from wagtail import hooks
 from wagtail.admin.admin_url_finder import AdminURLFinder
 from wagtail.log_actions import log
 from wagtail.models import ModelLogEntry
@@ -58,6 +59,38 @@ class TestModelViewSetGroup(WagtailTestUtils, TestCase):
             "/admin/blockcounts/streammodel/",
         )
 
+    def test_menu_item_with_only_view_permission(self):
+        self.user.is_superuser = False
+        self.user.save()
+        admin_permission = Permission.objects.get(
+            content_type__app_label="wagtailadmin",
+            codename="access_admin",
+        )
+        view_permission = Permission.objects.get(
+            content_type=ContentType.objects.get_for_model(JSONStreamModel),
+            codename=get_permission_codename("view", JSONStreamModel._meta),
+        )
+        self.user.user_permissions.add(admin_permission, view_permission)
+
+        response = self.client.get(reverse("wagtailadmin_home"))
+
+        # The group menu item is still shown
+        self.assertContains(
+            response,
+            '"name": "tests", "label": "Tests", "icon_name": "folder-open-inverse"',
+        )
+
+        # The menu item for the model is shown
+        self.assertContains(response, "Json Stream Models")
+        self.assertContains(response, reverse("streammodel:index"))
+        self.assertEqual(reverse("streammodel:index"), "/admin/streammodel/")
+
+        # The other items in the group are not shown as the user doesn't have permission
+        self.assertNotContains(response, "JSON MinMaxCount StreamModel")
+        self.assertNotContains(response, reverse("minmaxcount_streammodel:index"))
+        self.assertNotContains(response, "JSON BlockCounts StreamModel")
+        self.assertNotContains(response, reverse("blockcounts_streammodel:index"))
+
 
 class TestTemplateConfiguration(WagtailTestUtils, TestCase):
     def setUp(self):
@@ -1358,6 +1391,25 @@ class TestInspectView(WagtailTestUtils, TestCase):
         self.assertEqual(fields, expected_fields)
         self.assertEqual(values, expected_values)
 
+    def test_view_permission_registered(self):
+        content_type = ContentType.objects.get_for_model(FeatureCompleteToy)
+        qs = Permission.objects.none()
+        for fn in hooks.get_hooks("register_permissions"):
+            qs |= fn()
+        registered_user_permissions = qs.filter(content_type=content_type)
+        self.assertEqual(
+            set(registered_user_permissions.values_list("codename", flat=True)),
+            {
+                "add_featurecompletetoy",
+                "change_featurecompletetoy",
+                "delete_featurecompletetoy",
+                # The "view" permission should be registered if inspect view is enabled
+                "view_featurecompletetoy",
+                # Any custom permissions should be registered too
+                "can_set_release_date",
+            },
+        )
+
     def test_disabled(self):
         # An alternate viewset for the same model without inspect_view_enabled = True
         with self.assertRaises(NoReverseMatch):
@@ -1375,7 +1427,7 @@ class TestInspectView(WagtailTestUtils, TestCase):
         self.assertEqual(response.status_code, 302)
         self.assertRedirects(response, reverse("wagtailadmin_home"))
 
-    def test_only_add_permission(self):
+    def assert_minimal_permission(self, permission):
         self.user.is_superuser = False
         self.user.user_permissions.add(
             Permission.objects.get(
@@ -1383,7 +1435,7 @@ class TestInspectView(WagtailTestUtils, TestCase):
             ),
             Permission.objects.get(
                 content_type__app_label=self.object._meta.app_label,
-                codename=get_permission_codename("add", self.object._meta),
+                codename=get_permission_codename(permission, self.object._meta),
             ),
         )
         self.user.save()
@@ -1406,6 +1458,12 @@ class TestInspectView(WagtailTestUtils, TestCase):
         self.assertEqual(len(soup.find_all("a", attrs={"href": self.edit_url})), 0)
         self.assertEqual(len(soup.find_all("a", attrs={"href": self.delete_url})), 0)
 
+    def test_only_add_permission(self):
+        self.assert_minimal_permission("add")
+
+    def test_only_view_permission(self):
+        self.assert_minimal_permission("view")
+
 
 class TestListingButtons(WagtailTestUtils, TestCase):
     def setUp(self):
@@ -1464,6 +1522,76 @@ class TestListingButtons(WagtailTestUtils, TestCase):
             self.assertEqual(rendered_button.attrs.get("aria-label"), aria_label)
             self.assertEqual(rendered_button.attrs.get("href"), url)
 
+    def test_title_cell_not_link_to_edit_view_when_no_edit_permission(self):
+        self.user.is_superuser = False
+        self.user.save()
+        admin_permission = Permission.objects.get(
+            content_type__app_label="wagtailadmin",
+            codename="access_admin",
+        )
+        add_permission = Permission.objects.get(
+            content_type__app_label=self.object._meta.app_label,
+            codename=get_permission_codename("add", self.object._meta),
+        )
+        self.user.user_permissions.add(admin_permission, add_permission)
+
+        response = self.client.get(reverse("fctoy-alt2:index"))
+        self.assertEqual(response.status_code, 200)
+        soup = self.get_soup(response.content)
+        title_wrapper = soup.select_one("#listing-results td.title .title-wrapper")
+        self.assertIsNotNone(title_wrapper)
+
+        # fctoy-alt2 doesn't have inspect view enabled, so the title cell should
+        # not link anywhere
+        self.assertIsNone(title_wrapper.select_one("a"))
+        self.assertEqual(title_wrapper.text.strip(), str(self.object))
+
+        # There should be no edit link at all on the page
+        self.assertNotContains(
+            response,
+            reverse("fctoy-alt2:edit", args=[quote(self.object.pk)]),
+        )
+
+    def test_title_cell_links_to_inspect_view_when_no_edit_permission(self):
+        self.user.is_superuser = False
+        self.user.save()
+        admin_permission = Permission.objects.get(
+            content_type__app_label="wagtailadmin",
+            codename="access_admin",
+        )
+        view_permission = Permission.objects.get(
+            content_type__app_label=self.object._meta.app_label,
+            codename=get_permission_codename("view", self.object._meta),
+        )
+        self.user.user_permissions.add(admin_permission, view_permission)
+
+        response = self.client.get(reverse("feature_complete_toy:index"))
+        self.assertEqual(response.status_code, 200)
+        soup = self.get_soup(response.content)
+        title_wrapper = soup.select_one("#listing-results td.title .title-wrapper")
+        self.assertIsNotNone(title_wrapper)
+        link = title_wrapper.select_one("a")
+        self.assertIsNotNone(link)
+        self.assertEqual(link.text.strip(), self.object.name)
+        self.assertEqual(
+            link.get("href"),
+            reverse("feature_complete_toy:inspect", args=[quote(self.object.pk)]),
+        )
+
+        # Should contain the inspect link twice:
+        # once in the title cell and once in the dropdown
+        self.assertContains(
+            response,
+            reverse("feature_complete_toy:inspect", args=[quote(self.object.pk)]),
+            count=2,
+        )
+
+        # There should be no edit link at all on the page
+        self.assertNotContains(
+            response,
+            reverse("feature_complete_toy:edit", args=[quote(self.object.pk)]),
+        )
+
     def test_copy_disabled(self):
         response = self.client.get(reverse("fctoy_alt1:index"))
 
@@ -1508,6 +1636,27 @@ class TestListingButtons(WagtailTestUtils, TestCase):
             self.assertEqual(rendered_button.attrs.get("aria-label"), aria_label)
             self.assertEqual(rendered_button.attrs.get("href"), url)
 
+    def test_dropdown_not_rendered_when_no_child_buttons_exist(self):
+        self.user.is_superuser = False
+        self.user.save()
+        admin_permission = Permission.objects.get(
+            content_type__app_label="wagtailadmin",
+            codename="access_admin",
+        )
+        add_permission = Permission.objects.get(
+            content_type__app_label=self.object._meta.app_label,
+            codename=get_permission_codename("add", self.object._meta),
+        )
+        self.user.user_permissions.add(admin_permission, add_permission)
+
+        # The alt3 viewset doesn't have "copy" and "inspect" views enabled,
+        # so when only "add" permission is granted, the dropdown should have
+        # no items and thus not be rendered at all
+        response = self.client.get(reverse("fctoy-alt3:index"))
+        soup = self.get_soup(response.content)
+        actions = soup.select_one("tbody tr td ul.actions")
+        self.assertIsNone(actions)
+
 
 class TestCopyView(WagtailTestUtils, TestCase):
     def setUp(self):

wagtail/admin/ui/editing_sessions.py

@@ -0,0 +1,47 @@
+from django.conf import settings
+
+from wagtail.admin.ui.components import Component
+
+
+class EditingSessionsModule(Component):
+    template_name = "wagtailadmin/shared/editing_sessions/module.html"
+
+    def __init__(
+        self,
+        current_session,
+        ping_url,
+        release_url,
+        other_sessions,
+        revision_id=None,
+    ):
+        self.current_session = current_session
+        self.ping_url = ping_url
+        self.release_url = release_url
+        self.sessions_list = EditingSessionsList(current_session, other_sessions)
+        self.revision_id = revision_id
+
+    def get_context_data(self, parent_context):
+        ping_interval = getattr(
+            settings,
+            "WAGTAIL_EDITING_SESSION_PING_INTERVAL",
+            10000,
+        )
+        return {
+            "current_session": self.current_session,
+            "ping_url": self.ping_url,
+            "release_url": self.release_url,
+            "ping_interval": str(ping_interval),  # avoid the need to | unlocalize
+            "sessions_list": self.sessions_list,
+            "revision_id": self.revision_id,
+        }
+
+
+class EditingSessionsList(Component):
+    template_name = "wagtailadmin/shared/editing_sessions/list.html"
+
+    def __init__(self, current_session, other_sessions):
+        self.current_session = current_session
+        self.sessions = other_sessions
+
+    def get_context_data(self, parent_context):
+        return {"current_session": self.current_session, "sessions": self.sessions}

wagtail/admin/urls/__init__.py

@@ -1,5 +1,4 @@
 import functools
-import hashlib
 
 from django.conf import settings
 from django.http import Http404
@@ -13,6 +12,7 @@ from wagtail import hooks
 from wagtail.admin.api import urls as api_urls
 from wagtail.admin.auth import require_admin_access
 from wagtail.admin.urls import collections as wagtailadmin_collections_urls
+from wagtail.admin.urls import editing_sessions as wagtailadmin_editing_sessions_urls
 from wagtail.admin.urls import pages as wagtailadmin_pages_urls
 from wagtail.admin.urls import password_reset as wagtailadmin_password_reset_urls
 from wagtail.admin.urls import reports as wagtailadmin_reports_urls
@@ -111,6 +111,13 @@ urlpatterns = [
         dismissibles.DismissiblesView.as_view(),
         name="wagtailadmin_dismissibles",
     ),
+    path(
+        "editing-sessions/",
+        include(
+            wagtailadmin_editing_sessions_urls,
+            namespace="wagtailadmin_editing_sessions",
+        ),
+    ),
 ]
 
 
@@ -124,23 +131,10 @@ for fn in hooks.get_hooks("register_admin_urls"):
 # Add "wagtailadmin.access_admin" permission check
 urlpatterns = decorate_urlpatterns(urlpatterns, require_admin_access)
 
-sprite_hash = None
-
-
-def get_sprite_hash():
-    global sprite_hash
-    if not sprite_hash:
-        content = str(home.sprite(None).content, "utf-8")
-        # SECRET_KEY is used to prevent exposing the Wagtail version
-        sprite_hash = hashlib.sha1(
-            (content + settings.SECRET_KEY).encode("utf-8")
-        ).hexdigest()[:8]
-    return sprite_hash
-
 
 # These url patterns do not require an authenticated admin user
 urlpatterns += [
-    path(f"sprite-{get_sprite_hash()}/", home.sprite, name="wagtailadmin_sprite"),
+    path("sprite/", home.sprite, name="wagtailadmin_sprite"),
     path("login/", account.LoginView.as_view(), name="wagtailadmin_login"),
     # Password reset
     path("password_reset/", include(wagtailadmin_password_reset_urls)),

wagtail/admin/urls/editing_sessions.py

@@ -0,0 +1,17 @@
+from django.urls import path
+
+from wagtail.admin.views.editing_sessions import ping, release
+
+app_name = "wagtailadmin_editing_sessions"
+urlpatterns = [
+    path(
+        "ping/<str:app_label>/<str:model_name>/<str:object_id>/<int:session_id>/",
+        ping,
+        name="ping",
+    ),
+    path(
+        "release/<int:session_id>/",
+        release,
+        name="release",
+    ),
+]

wagtail/admin/urls/reports.py

@@ -11,11 +11,43 @@ from wagtail.admin.views.reports.workflows import WorkflowTasksView, WorkflowVie
 app_name = "wagtailadmin_reports"
 urlpatterns = [
     path("locked/", LockedPagesView.as_view(), name="locked_pages"),
+    path(
+        "locked/results/",
+        LockedPagesView.as_view(results_only=True),
+        name="locked_pages_results",
+    ),
     path("workflow/", WorkflowView.as_view(), name="workflow"),
+    path(
+        "workflow/results/",
+        WorkflowView.as_view(results_only=True),
+        name="workflow_results",
+    ),
     path("workflow_tasks/", WorkflowTasksView.as_view(), name="workflow_tasks"),
+    path(
+        "workflow_tasks/results/",
+        WorkflowTasksView.as_view(results_only=True),
+        name="workflow_tasks_results",
+    ),
     path("site-history/", LogEntriesView.as_view(), name="site_history"),
+    path(
+        "site-history/results/",
+        LogEntriesView.as_view(results_only=True),
+        name="site_history_results",
+    ),
     path("aging-pages/", AgingPagesView.as_view(), name="aging_pages"),
     path(
-        "page-types-usage/", PageTypesUsageReportView.as_view(), name="page_types_usage"
+        "aging-pages/results/",
+        AgingPagesView.as_view(results_only=True),
+        name="aging_pages_results",
+    ),
+    path(
+        "page-types-usage/",
+        PageTypesUsageReportView.as_view(),
+        name="page_types_usage",
+    ),
+    path(
+        "page-types-usage/results/",
+        PageTypesUsageReportView.as_view(results_only=True),
+        name="page_types_usage_results",
     ),
 ]

wagtail/admin/userbar.py

@@ -63,30 +63,71 @@ class AccessibilityItem(BaseItem):
     #: For more details, see `Axe documentation <https://github.com/dequelabs/axe-core/blob/master/doc/API.md#options-parameter-examples>`__.
     axe_rules = {}
 
+    #: A list to add custom Axe rules or override their properties,
+    #: alongside with ``axe_custom_checks``. Includes Wagtail’s custom rules.
+    #: For more details, see `Axe documentation <https://github.com/dequelabs/axe-core/blob/master/doc/API.md#api-name-axeconfigure>`_.
+    axe_custom_rules = [
+        {
+            "id": "alt-text-quality",
+            "impact": "serious",
+            "selector": "img[alt]",
+            "tags": ["best-practice"],
+            "any": ["check-image-alt-text"],
+            # If omitted, defaults to True and overrides configs in `axe_run_only`.
+            "enabled": True,
+        },
+    ]
+
+    #: A list to add custom Axe checks or override their properties.
+    #: Should be used in conjunction with ``axe_custom_rules``.
+    #: For more details, see `Axe documentation <https://github.com/dequelabs/axe-core/blob/master/doc/API.md#api-name-axeconfigure>`_.
+    axe_custom_checks = [
+        {
+            "id": "check-image-alt-text",
+            "options": {"pattern": "\\.(avif|gif|jpg|jpeg|png|svg|webp)$|_"},
+        },
+    ]
+
     #: A dictionary that maps axe-core rule IDs to custom translatable strings
     #: to use as the error messages. If an enabled rule does not exist in this
     #: dictionary, Axe's error message for the rule will be used as fallback.
     axe_messages = {
-        "button-name": _(
-            "Button text is empty. Use meaningful text for screen reader users."
-        ),
-        "empty-heading": _(
-            "Empty heading found. Use meaningful text for screen reader users."
-        ),
-        "empty-table-header": _(
-            "Table header text is empty. Use meaningful text for screen reader users."
-        ),
-        "frame-title": _(
-            "Empty frame title found. Use a meaningful title for screen reader users."
-        ),
-        "heading-order": _("Incorrect heading hierarchy. Avoid skipping levels."),
-        "input-button-name": _(
-            "Input button text is empty. Use meaningful text for screen reader users."
-        ),
-        "link-name": _(
-            "Link text is empty. Use meaningful text for screen reader users."
-        ),
-        "p-as-heading": _("Misusing paragraphs as headings. Use proper heading tags."),
+        "button-name": {
+            "error_name": _("Button text is empty"),
+            "help_text": _("Use meaningful text for screen reader users"),
+        },
+        "empty-heading": {
+            "error_name": _("Empty heading found"),
+            "help_text": _("Use meaningful text for screen reader users"),
+        },
+        "empty-table-header": {
+            "error_name": _("Table header text is empty"),
+            "help_text": _("Use meaningful text for screen reader users"),
+        },
+        "frame-title": {
+            "error_name": _("Empty frame title found"),
+            "help_text": _("Use a meaningful title for screen reader users"),
+        },
+        "heading-order": {
+            "error_name": _("Incorrect heading hierarchy"),
+            "help_text": _("Avoid skipping levels"),
+        },
+        "input-button-name": {
+            "error_name": _("Input button text is empty"),
+            "help_text": _("Use meaningful text for screen reader users"),
+        },
+        "link-name": {
+            "error_name": _("Link text is empty"),
+            "help_text": _("Use meaningful text for screen reader users"),
+        },
+        "p-as-heading": {
+            "error_name": _("Misusing paragraphs as headings"),
+            "help_text": _("Use proper heading tags"),
+        },
+        "alt-text-quality": {
+            "error_name": _("Image alt text has inappropriate pattern"),
+            "help_text": _("Use meaningful text"),
+        },
     }
 
     def get_axe_include(self, request):
@@ -105,6 +146,14 @@ class AccessibilityItem(BaseItem):
         """Returns a dictionary that maps axe-core rule IDs to a dictionary of rule options."""
         return self.axe_rules
 
+    def get_axe_custom_rules(self, request):
+        """List of rule objects per axe.run API."""
+        return self.axe_custom_rules
+
+    def get_axe_custom_checks(self, request):
+        """List of check objects per axe.run API, without evaluate function."""
+        return self.axe_custom_checks
+
     def get_axe_messages(self, request):
         """Returns a dictionary that maps axe-core rule IDs to custom translatable strings."""
         return self.axe_messages
@@ -139,11 +188,19 @@ class AccessibilityItem(BaseItem):
             options.pop("runOnly")
         return options
 
+    def get_axe_spec(self, request):
+        """Returns spec for Axe, including custom rules and custom checks"""
+        return {
+            "rules": self.get_axe_custom_rules(request),
+            "checks": self.get_axe_custom_checks(request),
+        }
+
     def get_axe_configuration(self, request):
         return {
             "context": self.get_axe_context(request),
             "options": self.get_axe_options(request),
             "messages": self.get_axe_messages(request),
+            "spec": self.get_axe_spec(request),
         }
 
     def get_context_data(self, request):

wagtail/admin/views/chooser.py

@@ -1,11 +1,13 @@
 import re
-import urllib.parse as urlparse
+from collections import defaultdict
+from urllib.parse import parse_qs, quote, urlencode, urlsplit
 
 from django.conf import settings
 from django.core.paginator import InvalidPage, Paginator
 from django.http import Http404
 from django.shortcuts import get_object_or_404
 from django.template.response import TemplateResponse
+from django.urls import NoReverseMatch
 from django.urls.base import reverse
 from django.utils.translation import gettext_lazy as _
 from django.views.generic.base import View
@@ -629,29 +631,57 @@ class ExternalLinkView(BaseLinkFormView):
             if sites is None:
                 sites = Site.get_site_root_paths()
 
+            try:
+                # The serve view might not be routed to the root path of the domain,
+                # e.g. /pages/, so we need to account for the path to the serve view
+                serve_path = reverse("wagtail_serve", args=("",))
+            except NoReverseMatch:
+                serve_path = None
+
             match_relative_paths = submitted_url.startswith("/") and len(sites) == 1
             # We should only match relative urls if there's only a single site
             # Otherwise this could get very annoying accidentally matching coincidentally
             # named pages on different sites
 
+            possible_sites = defaultdict(list)
+
             if match_relative_paths:
-                possible_sites = [
-                    (pk, url_without_query) for pk, path, url, language_code in sites
-                ]
+                for pk, path, url, language_code in sites:
+                    possible_sites[pk].append(url_without_query)
+
+                    # If the submitted URL is prefixed with the serve path,
+                    # also consider it without the serve path so we can match
+                    # the page using Page.route()
+                    if serve_path and url_without_query.startswith(serve_path):
+                        possible_sites[pk].append(
+                            url_without_query[len(serve_path) - 1 :]
+                        )
             else:
-                possible_sites = [
-                    (pk, url_without_query[len(url) :])
-                    for pk, path, url, language_code in sites
-                    if submitted_url.startswith(url)
-                ]
+                for pk, path, url, language_code in sites:
+                    if not submitted_url.startswith(url):
+                        continue
+                    possible_sites[pk].append(url_without_query[len(url) :])
+
+                    # If the submitted URL is prefixed with the serve path,
+                    # also consider it without the serve path so we can match
+                    # the page using Page.route()
+                    if serve_path and url_without_query.startswith(url + serve_path):
+                        possible_sites[pk].append(
+                            url_without_query[len(url) + len(serve_path) - 1 :]
+                        )
 
             # Loop over possible sites to identify a page match
-            for pk, url in possible_sites:
-                try:
-                    route = Site.objects.get(pk=pk).root_page.specific.route(
-                        request,
-                        [component for component in url.split("/") if component],
-                    )
+            for pk, possible_urls in possible_sites.items():
+                site = Site.objects.select_related("root_page").get(pk=pk)
+                root_page = site.root_page.specific
+                for url in possible_urls:
+                    try:
+                        route = root_page.route(
+                            request,
+                            [component for component in url.split("/") if component],
+                        )
+                    except Http404:
+                        continue
 
                     matched_page = route.page.specific
 
@@ -704,9 +734,6 @@ class ExternalLinkView(BaseLinkFormView):
                             },
                         )
 
-                except Http404:
-                    continue
-
             # Otherwise, with no internal matches, fall back to an external url
             return self.render_chosen_response(result)
         else:  # form invalid
@@ -748,9 +775,9 @@ class EmailLinkView(BaseLinkFormView):
             "subject": self.form.cleaned_data["subject"],
             "body": self.form.cleaned_data["body"],
         }
-        encoded_params = urlparse.urlencode(
+        encoded_params = urlencode(
             {k: v for k, v in params.items() if v is not None and v != ""},
-            quote_via=urlparse.quote,
+            quote_via=quote,
         )
 
         url = "mailto:" + self.form.cleaned_data["email_address"]
@@ -781,11 +808,11 @@ class EmailLinkView(BaseLinkFormView):
     def parse_email_link(self, mailto):
         result = {}
 
-        mail_result = urlparse.urlparse(mailto)
+        mail_result = urlsplit(mailto)
 
         result["email"] = mail_result.path
 
-        query = urlparse.parse_qs(mail_result.query)
+        query = parse_qs(mail_result.query)
         result["subject"] = query["subject"][0] if "subject" in query else ""
         result["body"] = query["body"][0] if "body" in query else ""
 

wagtail/admin/views/collections.py

@@ -138,17 +138,6 @@ class Edit(EditView):
             instance.move(self.form.cleaned_data["parent"], "sorted-child")
         return instance
 
-    def get_context_data(self, **kwargs):
-        context = super().get_context_data(**kwargs)
-        context["can_delete"] = (
-            self.permission_policy.instances_user_has_permission_for(
-                self.request.user, "delete"
-            )
-            .filter(pk=self.object.pk)
-            .first()
-        )
-        return context
-
 
 class Delete(DeleteView):
     permission_policy = collection_permission_policy