wagtail 7.1.1__py3-none-any.whl → 7.1.3__py3-none-any.whl

wagtail/admin/templates/wagtailadmin/generic/form.html

@@ -6,7 +6,9 @@
     {% if breadcrumbs_items %}
         <div class="nice-padding w-mt-8">
             <h2 class="w-relative w-h1" id="header-title">
-                {% icon classname="w-absolute w-top-1 -w-left-11 w-max-w-[1em] w-max-h-[1em]" name=header_icon %}
+                {% if header_icon %}
+                    {% icon classname="w-absolute w-top-1 -w-left-11 w-max-w-[1em] w-max-h-[1em]" name=header_icon %}
+                {% endif %}
                 {{ page_subtitle|default:page_title }}
             </h2>
         </div>

wagtail/admin/templates/wagtailadmin/userbar/base.html

@@ -5,7 +5,8 @@
     <aside {% if request.in_preview_panel %}hidden{% endif %}>
         <div class="w-userbar w-userbar--{{ position|default:'bottom-right' }} {% admin_theme_classname %}" data-wagtail-userbar data-wagtail-userbar-origin="{{ origin|default:"" }}" part="userbar">
             {% block css %}
-                <link rel="stylesheet" href="{% absolute_static 'wagtailadmin/css/core.css' %}">
+                {% versioned_static 'wagtailadmin/css/core.css' as core_css_url %}
+                <link rel="stylesheet" href="{% build_absolute_url core_css_url %}">
                 {# For headless userbar: the contents of the hook also need absolute URLs #}
                 {% hook_output 'insert_global_admin_css' %}
             {% endblock %}
@@ -44,7 +45,9 @@
 </template>
 <wagtail-userbar></wagtail-userbar>
 {% block js %}
-    <script src="{% absolute_static 'wagtailadmin/js/vendor.js' %}"></script>
-    <script src="{% absolute_static 'wagtailadmin/js/userbar.js' %}"></script>
+    {% versioned_static 'wagtailadmin/js/vendor.js' as vendor_js_url %}
+    {% versioned_static 'wagtailadmin/js/userbar.js' as userbar_js_url %}
+    <script src="{% build_absolute_url vendor_js_url %}"></script>
+    <script src="{% build_absolute_url userbar_js_url %}"></script>
 {% endblock %}
 <!-- end Wagtail user bar embed code -->

wagtail/admin/templates/wagtailadmin/userbar/item_admin.html

@@ -2,8 +2,8 @@
 {% load i18n wagtailadmin_tags %}
 
 {% block item_content %}
-    {% base_url_setting default="" as base_url %}
-    <a href="{{ base_url }}{% url 'wagtailadmin_home' %}" target="_parent" role="menuitem">
+    {% url 'wagtailadmin_home' as admin_home_url %}
+    <a href="{% build_absolute_url admin_home_url %}" target="_parent" role="menuitem">
         {% icon name="key" classname="w-action-icon" %}
         {% trans 'Go to Wagtail admin' %}
     </a>

wagtail/admin/templates/wagtailadmin/userbar/item_page_add.html

@@ -2,8 +2,8 @@
 {% load i18n wagtailadmin_tags %}
 
 {% block item_content %}
-    {% base_url_setting default="" as base_url %}
-    <a href="{{ base_url }}{% url 'wagtailadmin_pages:add_subpage' self.page.id %}" target="_parent" role="menuitem">
+    {% url 'wagtailadmin_pages:add_subpage' self.page.id as add_url %}
+    <a href="{% build_absolute_url add_url %}" target="_parent" role="menuitem">
         {% icon name="plus" classname="w-action-icon" %}
         {% trans 'Add a child page' %}
     </a>

wagtail/admin/templates/wagtailadmin/userbar/item_page_edit.html

@@ -2,8 +2,8 @@
 {% load i18n wagtailadmin_tags %}
 
 {% block item_content %}
-    {% base_url_setting default="" as base_url %}
-    <a href="{{ base_url }}{% url 'wagtailadmin_pages:edit' self.page.id %}" target="_parent" role="menuitem">
+    {% url 'wagtailadmin_pages:edit' self.page.id as edit_url %}
+    <a href="{% build_absolute_url edit_url %}" target="_parent" role="menuitem">
         {% icon name="edit" classname="w-action-icon" %}
         {% trans 'Edit this page' %}
     </a>

wagtail/admin/templates/wagtailadmin/userbar/item_page_explore.html

@@ -2,8 +2,8 @@
 {% load i18n wagtailadmin_tags %}
 
 {% block item_content %}
-    {% base_url_setting default="" as base_url %}
-    <a href="{{ base_url }}{% url 'wagtailadmin_explore' self.parent_page.id %}" target="_parent" role="menuitem">
+    {% url 'wagtailadmin_explore' self.parent_page.id as explore_url %}
+    <a href="{% build_absolute_url explore_url %}" target="_parent" role="menuitem">
         {% icon name="folder-open-inverse" classname="w-action-icon" %}
         {% trans 'Show in Explorer' %}
     </a>

wagtail/admin/templatetags/wagtailadmin_tags.py

@@ -206,6 +206,33 @@ def admin_url_name(obj, action):
     return obj.snippet_viewset.get_url_name(action)
 
 
+@register.simple_tag(takes_context=True)
+def build_absolute_url(context, url):
+    """
+    Usage: {% build_absolute_url url %}
+    Returns the absolute URL of the given URL based on the request's host.
+    If the request doesn't exist in the context, falls back to
+    WAGTAILADMIN_BASE_URL as the base URL.
+    If the given URL is already absolute, or the request is a dummy preview
+    request, returns it unchanged.
+    """
+    request = context.get("request")
+    # If request is not found in the context, e.g. in notification emails,
+    # fall back to WAGTAILADMIN_BASE_URL.
+    if not request:
+        return urljoin(get_admin_base_url(), url)
+    # With a dummy preview request, the host has been overwritten to be the page
+    # Site's host, which may not have been configured correctly. We don't want
+    # to fall back to WAGTAILADMIN_BASE_URL either, as that may be different
+    # from the original request's host in multi-site instances and may result in
+    # users having to log in again. So we just return the URL unchanged.
+    if getattr(request, "is_dummy", False):
+        return url
+    # Rewrite relative URLs to absolute URLs based on the request's host, but
+    # leave absolute URLs unchanged.
+    return request.build_absolute_uri(url)
+
+
 @register.simple_tag
 def latest_str(obj):
     """

wagtail/admin/tests/pages/test_preview.py

@@ -1,6 +1,7 @@
 import datetime
 from functools import wraps
 
+from django.contrib.auth.models import Permission
 from django.test import TestCase, override_settings
 from django.urls import reverse
 from django.utils import timezone
@@ -358,6 +359,47 @@ class TestPreview(WagtailTestUtils, TestCase):
         self.assertTemplateUsed(response, "tests/event_page.html")
         self.assertContains(response, "Placeholder title")
 
+    def test_preview_on_create_without_permissions(self):
+        # Remove privileges from user
+        self.user.is_superuser = False
+        self.user.user_permissions.add(
+            Permission.objects.get(
+                content_type__app_label="wagtailadmin", codename="access_admin"
+            )
+        )
+        self.user.save()
+
+        preview_url = reverse(
+            "wagtailadmin_pages:preview_on_add",
+            args=("tests", "eventpage", self.home_page.id),
+        )
+
+        response = self.client.post(
+            preview_url,
+            self.post_data,
+        )
+        self.assertEqual(response.status_code, 302)
+        self.assertRedirects(response, reverse("wagtailadmin_home"))
+
+    def test_preview_on_create_get_without_permissions(self):
+        # Remove privileges from user
+        self.user.is_superuser = False
+        self.user.user_permissions.add(
+            Permission.objects.get(
+                content_type__app_label="wagtailadmin", codename="access_admin"
+            )
+        )
+        self.user.save()
+
+        preview_url = reverse(
+            "wagtailadmin_pages:preview_on_add",
+            args=("tests", "eventpage", self.home_page.id),
+        )
+
+        response = self.client.get(preview_url)
+        self.assertEqual(response.status_code, 302)
+        self.assertRedirects(response, reverse("wagtailadmin_home"))
+
     def test_preview_on_edit_with_m2m_field(self):
         preview_url = reverse(
             "wagtailadmin_pages:preview_on_edit", args=(self.event_page.id,)
@@ -414,6 +456,36 @@ class TestPreview(WagtailTestUtils, TestCase):
         self.assertContains(response, "<li>Parties</li>")
         self.assertContains(response, "<li>Holidays</li>")
 
+        soup = self.get_soup(response.content)
+        userbar = soup.select_one("wagtail-userbar")
+        self.assertIsNotNone(userbar)
+        template = soup.select_one("#wagtail-userbar-template")
+        self.assertIsNotNone(template)
+
+        # Previews use a dummy request object, so the userbar should use
+        # relative URLs to avoid using the wrong host.
+        admin_url = reverse("wagtailadmin_home")
+        admin_link = template.select_one(f'a[href$="{admin_url}"]')
+        self.assertIsNotNone(admin_link)
+        self.assertEqual(admin_link["href"], admin_url)
+
+        css_links = soup.select("link[rel='stylesheet']")
+        self.assertEqual(
+            [link.get("href") for link in css_links],
+            [
+                versioned_static("wagtailadmin/css/core.css"),
+                "/path/to/my/custom.css",
+            ],
+        )
+        scripts = soup.select("script[src]")
+        self.assertEqual(
+            [script.get("src") for script in scripts],
+            [
+                versioned_static("wagtailadmin/js/vendor.js"),
+                versioned_static("wagtailadmin/js/userbar.js"),
+            ],
+        )
+
     def test_preview_on_edit_with_valid_then_invalid_data(self):
         preview_url = reverse(
             "wagtailadmin_pages:preview_on_edit", args=(self.event_page.id,)
@@ -557,6 +629,45 @@ class TestPreview(WagtailTestUtils, TestCase):
             response = self.client.get(preview_url)
             self.assertEqual(response.status_code, 200)
 
+    def test_preview_on_edit_without_permissions(self):
+        # Remove privileges from user
+        self.user.is_superuser = False
+        self.user.user_permissions.add(
+            Permission.objects.get(
+                content_type__app_label="wagtailadmin", codename="access_admin"
+            )
+        )
+        self.user.save()
+
+        preview_url = reverse(
+            "wagtailadmin_pages:preview_on_edit", args=(self.event_page.id,)
+        )
+
+        response = self.client.post(
+            preview_url,
+            self.post_data,
+        )
+        self.assertEqual(response.status_code, 302)
+        self.assertRedirects(response, reverse("wagtailadmin_home"))
+
+    def test_preview_on_edit_get_without_permissions(self):
+        # Remove privileges from user
+        self.user.is_superuser = False
+        self.user.user_permissions.add(
+            Permission.objects.get(
+                content_type__app_label="wagtailadmin", codename="access_admin"
+            )
+        )
+        self.user.save()
+
+        preview_url = reverse(
+            "wagtailadmin_pages:preview_on_edit", args=(self.event_page.id,)
+        )
+
+        response = self.client.get(preview_url)
+        self.assertEqual(response.status_code, 302)
+        self.assertRedirects(response, reverse("wagtailadmin_home"))
+
     def test_preview_on_create_clear_preview_data(self):
         preview_session_key = "wagtail-preview-tests-eventpage-{}".format(
             self.home_page.id

wagtail/admin/tests/test_userbar.py

@@ -1,6 +1,5 @@
 import json
 
-from django.conf import settings
 from django.contrib.auth.models import AnonymousUser, Permission
 from django.template import Context, Template
 from django.test import TestCase, override_settings
@@ -9,7 +8,7 @@ from django.utils import translation
 from django.utils.translation import gettext
 
 from wagtail import hooks
-from wagtail.admin.templatetags.wagtailadmin_tags import absolute_static
+from wagtail.admin.staticfiles import versioned_static
 from wagtail.admin.userbar import AccessibilityItem, Userbar
 from wagtail.coreutils import get_dummy_request
 from wagtail.models import PAGE_TEMPLATE_VAR, Locale, Page, Site
@@ -67,7 +66,7 @@ class TestUserbarTag(WagtailTestUtils, TestCase):
                 # Wagtail admin core CSS should be linked with absolute URL to
                 # ensure it works when loaded from a different domain
                 # (e.g. headless frontend)
-                absolute_static("wagtailadmin/css/core.css"),
+                f"http://localhost{versioned_static('wagtailadmin/css/core.css')}",
                 # Custom CSS must be changed appropriately if necessary
                 "/path/to/my/custom.css",
             ],
@@ -80,8 +79,8 @@ class TestUserbarTag(WagtailTestUtils, TestCase):
                 # Wagtail vendor and userbar JS should be linked with absolute
                 # URL to ensure it works when loaded from a different domain
                 # (e.g. headless frontend)
-                absolute_static("wagtailadmin/js/vendor.js"),
-                absolute_static("wagtailadmin/js/userbar.js"),
+                f"http://localhost{versioned_static('wagtailadmin/js/vendor.js')}",
+                f"http://localhost{versioned_static('wagtailadmin/js/userbar.js')}",
             ],
         )
 
@@ -136,9 +135,7 @@ class TestUserbarTag(WagtailTestUtils, TestCase):
         # Should render the "Go to Wagtail admin" link using an absolute URL
         soup = self.get_soup(content)
         admin_url = reverse("wagtailadmin_home")
-        admin_link = soup.select_one(
-            f"a[href='{settings.WAGTAILADMIN_BASE_URL}{admin_url}']"
-        )
+        admin_link = soup.select_one(f"a[href='http://localhost{admin_url}']")
         self.assertIsNotNone(admin_link)
         self.assertEqual(admin_link.text.strip(), "Go to Wagtail admin")
 
@@ -156,16 +153,12 @@ class TestUserbarTag(WagtailTestUtils, TestCase):
         soup = self.get_soup(content)
 
         edit_url = reverse("wagtailadmin_pages:edit", args=(self.homepage.id,))
-        edit_link = soup.select_one(
-            f"a[href='{settings.WAGTAILADMIN_BASE_URL}{edit_url}']"
-        )
+        edit_link = soup.select_one(f"a[href='http://localhost{edit_url}']")
         self.assertIsNotNone(edit_link)
         self.assertEqual(edit_link.text.strip(), "Edit this page")
 
         explore_url = reverse("wagtailadmin_explore", args=(self.parent_page.id,))
-        explore_link = soup.select_one(
-            f"a[href='{settings.WAGTAILADMIN_BASE_URL}{explore_url}']"
-        )
+        explore_link = soup.select_one(f"a[href='http://localhost{explore_url}']")
         self.assertIsNotNone(explore_link)
         self.assertEqual(explore_link.text.strip(), "Show in Explorer")
 
@@ -185,16 +178,12 @@ class TestUserbarTag(WagtailTestUtils, TestCase):
         soup = self.get_soup(content)
 
         edit_url = reverse("wagtailadmin_pages:edit", args=(self.homepage.id,))
-        edit_link = soup.select_one(
-            f"a[href='{settings.WAGTAILADMIN_BASE_URL}{edit_url}']"
-        )
+        edit_link = soup.select_one(f"a[href='http://localhost{edit_url}']")
         self.assertIsNotNone(edit_link)
         self.assertEqual(edit_link.text.strip(), "Edit this page")
 
         explore_url = reverse("wagtailadmin_explore", args=(self.parent_page.id,))
-        explore_link = soup.select_one(
-            f"a[href='{settings.WAGTAILADMIN_BASE_URL}{explore_url}']"
-        )
+        explore_link = soup.select_one(f"a[href='http://localhost{explore_url}']")
         self.assertIsNotNone(explore_link)
         self.assertEqual(explore_link.text.strip(), "Show in Explorer")
 
@@ -221,9 +210,7 @@ class TestUserbarTag(WagtailTestUtils, TestCase):
         # The explore link should still be visible
         soup = self.get_soup(content)
         explore_url = reverse("wagtailadmin_explore", args=(self.parent_page.id,))
-        explore_link = soup.select_one(
-            f"a[href='{settings.WAGTAILADMIN_BASE_URL}{explore_url}']"
-        )
+        explore_link = soup.select_one(f"a[href='http://localhost{explore_url}']")
         self.assertIsNotNone(explore_link)
         self.assertEqual(explore_link.text.strip(), "Show in Explorer")
 
@@ -718,7 +705,7 @@ class TestUserbarAddLink(WagtailTestUtils, TestCase):
         self.assertEqual(response.status_code, 200)
 
         # page allows subpages, so the 'add page' button should show
-        expected_url = settings.WAGTAILADMIN_BASE_URL + (
+        expected_url = self.request.build_absolute_uri(
             reverse("wagtailadmin_pages:add_subpage", args=(self.event_index.id,))
         )
         needle = f"""
@@ -762,7 +749,7 @@ class TestUserbarComponent(WagtailTestUtils, TestCase):
         items = soup.select("li")
         self.assertEqual(len(items), 2)
 
-        admin_url = f"{settings.WAGTAILADMIN_BASE_URL}{reverse('wagtailadmin_home')}"
+        admin_url = f"http://localhost{reverse('wagtailadmin_home')}"
         admin_item = items[0]
         admin_link = admin_item.select_one("a")
         self.assertIsNotNone(admin_link)
@@ -780,11 +767,18 @@ class TestUserbarComponent(WagtailTestUtils, TestCase):
     def test_render_no_request(self):
         rendered = Userbar().render_html({})
         soup = self.get_soup(rendered)
+        # Without a request provided, URLs should fall back to the
+        # WAGTAILADMIN_BASE_URL setting
+        base_url = "http://testserver"
+
+        userbar = soup.select_one("[data-wagtail-userbar]")
+        self.assertIsNotNone(userbar)
+        self.assertEqual(userbar.get("data-wagtail-userbar-origin"), base_url)
 
         items = soup.select("li")
         self.assertEqual(len(items), 2)
 
-        admin_url = f"{settings.WAGTAILADMIN_BASE_URL}{reverse('wagtailadmin_home')}"
+        admin_url = f"{base_url}{reverse('wagtailadmin_home')}"
         admin_item = items[0]
         admin_link = admin_item.select_one("a")
         self.assertIsNotNone(admin_link)
@@ -799,21 +793,44 @@ class TestUserbarComponent(WagtailTestUtils, TestCase):
             "Issues found | Accessibility",
         )
 
+        css_links = soup.select("link[rel='stylesheet']")
+        self.assertEqual(
+            [link.get("href") for link in css_links],
+            [
+                # Wagtail admin core CSS should be linked with absolute URL to
+                # ensure it works when loaded from a different domain
+                # (e.g. headless frontend)
+                f"{base_url}{versioned_static('wagtailadmin/css/core.css')}",
+                # Custom CSS must be changed appropriately if necessary
+                "/path/to/my/custom.css",
+            ],
+        )
+
+        scripts = soup.select("script[src]")
+        self.assertEqual(
+            [script.get("src") for script in scripts],
+            [
+                # Wagtail vendor and userbar JS should be linked with absolute
+                # URL to ensure it works when loaded from a different domain
+                # (e.g. headless frontend)
+                f"{base_url}{versioned_static('wagtailadmin/js/vendor.js')}",
+                f"{base_url}{versioned_static('wagtailadmin/js/userbar.js')}",
+            ],
+        )
+
     def test_render_minimal(self):
         rendered = Userbar().render_html({"request": self.request})
         soup = self.get_soup(rendered)
 
         userbar = soup.select_one("[data-wagtail-userbar]")
         self.assertIsNotNone(userbar)
-        self.assertEqual(
-            userbar.get("data-wagtail-userbar-origin"),
-            settings.WAGTAILADMIN_BASE_URL,
-        )
+        # The origin should be based on the request's scheme and host information
+        self.assertEqual(userbar.get("data-wagtail-userbar-origin"), "http://localhost")
 
         items = soup.select("li")
         self.assertEqual(len(items), 2)
 
-        admin_url = f"{settings.WAGTAILADMIN_BASE_URL}{reverse('wagtailadmin_home')}"
+        admin_url = f"http://localhost{reverse('wagtailadmin_home')}"
         admin_item = items[0]
         admin_link = admin_item.select_one("a")
         self.assertIsNotNone(admin_link)
@@ -844,7 +861,7 @@ class TestUserbarComponent(WagtailTestUtils, TestCase):
         self.assertEqual(len(links), 4)
         self.assertEqual(
             [link.get("href") for link in links],
-            [f"{settings.WAGTAILADMIN_BASE_URL}{url}" for url in expected_urls],
+            [f"http://localhost{url}" for url in expected_urls],
         )
 
         accessibility_button = soup.select_one("li button")
@@ -855,8 +872,8 @@ class TestUserbarComponent(WagtailTestUtils, TestCase):
         )
 
     @override_settings(WAGTAILADMIN_BASE_URL=None)
-    def test_render_without_admin_base_url_setting(self):
-        rendered = Userbar().render_html({"request": self.request})
+    def test_render_without_request_and_admin_base_url_setting(self):
+        rendered = Userbar().render_html({})
         soup = self.get_soup(rendered)
 
         userbar = soup.select_one("[data-wagtail-userbar]")
@@ -868,7 +885,8 @@ class TestUserbarComponent(WagtailTestUtils, TestCase):
         items = soup.select("li")
         self.assertEqual(len(items), 2)
 
-        # Becomes the root-relative URL since WAGTAILADMIN_BASE_URL is None
+        # Becomes the root-relative URL since no request is provided
+        # and WAGTAILADMIN_BASE_URL is None
         admin_url = reverse("wagtailadmin_home")
         admin_item = items[0]
         admin_link = admin_item.select_one("a")
@@ -883,3 +901,25 @@ class TestUserbarComponent(WagtailTestUtils, TestCase):
             button.get_text(separator=" | ", strip=True).strip(),
             "Issues found | Accessibility",
         )
+
+        css_links = soup.select("link[rel='stylesheet']")
+        self.assertEqual(
+            [link.get("href") for link in css_links],
+            [
+                # Cannot build absolute URL without a request and
+                # WAGTAILADMIN_BASE_URL, so should be root-relative
+                versioned_static("wagtailadmin/css/core.css"),
+                "/path/to/my/custom.css",
+            ],
+        )
+
+        scripts = soup.select("script[src]")
+        self.assertEqual(
+            [script.get("src") for script in scripts],
+            [
+                # Cannot build absolute URL without a request and
+                # WAGTAILADMIN_BASE_URL, so should be root-relative
+                versioned_static("wagtailadmin/js/vendor.js"),
+                versioned_static("wagtailadmin/js/userbar.js"),
+            ],
+        )

wagtail/admin/tests/test_views_generic.py

@@ -2,6 +2,7 @@ from django.contrib.admin.utils import quote
 from django.test import TestCase
 from django.urls import reverse
 
+from wagtail.test.testapp.models import ModelWithStringTypePrimaryKey
 from wagtail.test.utils import WagtailTestUtils
 
 
@@ -37,6 +38,39 @@ class TestGenericIndexViewWithoutModel(WagtailTestUtils, TestCase):
         self.assertEqual(response_object_count, 4)
 
 
+class TestGenericCreateView(WagtailTestUtils, TestCase):
+    fixtures = ["test.json"]
+
+    def get(self, params={}):
+        return self.client.get(reverse("testapp_generic_create"), params)
+
+    def test_get_create_view(self):
+        response = self.get()
+        self.assertEqual(response.status_code, 200)
+        soup = self.get_soup(response.content)
+        h2 = soup.select_one("main h2")
+        self.assertIsNotNone(h2)
+        self.assertEqual(h2.text.strip(), "Model with string type primary key")
+        form = soup.select_one("main form")
+        self.assertIsNotNone(form)
+        id_input = form.select_one("input[name='custom_id']")
+        self.assertIsNotNone(id_input)
+        self.assertEqual(id_input.get("type"), "text")
+        content_input = form.select_one("input[name='content']")
+        self.assertIsNotNone(content_input)
+
+    def test_post_create_view(self):
+        post_data = {
+            "custom_id": "string-pk-3",
+            "content": "third modelwithstringtypeprimarykey model",
+        }
+        response = self.client.post(reverse("testapp_generic_create"), post_data)
+        self.assertEqual(response.status_code, 302)  # Redirect to index view
+        self.assertTrue(
+            ModelWithStringTypePrimaryKey.objects.filter(pk="string-pk-3").exists()
+        )
+
+
 class TestGenericEditView(WagtailTestUtils, TestCase):
     fixtures = ["test.json"]
 

wagtail/admin/userbar.py

@@ -364,10 +364,15 @@ class Userbar(Component):
             # Remove any unrendered items
             rendered_items = [item for item in rendered_items if item]
 
+            if request:
+                origin = f"{request.scheme}://{request.get_host()}"
+            else:
+                origin = get_admin_base_url() or ""
+
             # Render the userbar items
             return {
                 "request": request,
-                "origin": get_admin_base_url(),
+                "origin": origin,
                 "items": rendered_items,
                 "position": self.position,
                 "page": self.object,

wagtail/admin/views/generic/preview.py

@@ -17,13 +17,16 @@ from wagtail.blocks.base import Block
 from wagtail.models import PreviewableMixin, RevisionMixin
 from wagtail.utils.decorators import xframe_options_sameorigin_override
 
+from .permissions import PermissionCheckedMixin
 
-class PreviewOnEdit(View):
+
+class PreviewOnEdit(PermissionCheckedMixin, View):
     model = None
     form_class = None
     http_method_names = ("post", "get", "delete")
     preview_expiration_timeout = 60 * 60 * 24  # seconds
     session_key_prefix = "wagtail-preview-"
+    permission_required = "change"
 
     def setup(self, request, *args, **kwargs):
         super().setup(request, *args, **kwargs)
@@ -54,6 +57,8 @@ class PreviewOnEdit(View):
 
     def get_object(self):
         obj = get_object_or_404(self.model, pk=unquote(str(self.kwargs["pk"])))
+        if not self.user_has_permission_for_instance(self.permission_required, obj):
+            raise PermissionDenied
         if isinstance(obj, RevisionMixin):
             obj = obj.get_latest_revision_as_object()
         return obj
@@ -136,6 +141,8 @@ class PreviewOnEdit(View):
 
 
 class PreviewOnCreate(PreviewOnEdit):
+    permission_required = "add"
+
     @property
     def session_key(self):
         app_label = self.model._meta.app_label

wagtail/admin/views/pages/preview.py

@@ -30,9 +30,13 @@ class PreviewOnEdit(GenericPreviewOnEdit):
         return "{}{}".format(self.session_key_prefix, self.kwargs["page_id"])
 
     def get_object(self):
-        return get_object_or_404(
+        page = get_object_or_404(
             Page, id=self.kwargs["page_id"]
         ).get_latest_revision_as_object()
+        page_perms = page.permissions_for_user(self.request.user)
+        if not page_perms.can_edit():
+            raise PermissionDenied
+        return page
 
     def get_form(self, query_dict):
         form_class = self.object.get_edit_handler().get_form_class()
@@ -87,6 +91,11 @@ class PreviewOnCreate(PreviewOnEdit):
 
         page = content_type.model_class()()
         parent_page = get_object_or_404(Page, id=parent_page_id).specific
+
+        parent_page_perms = parent_page.permissions_for_user(self.request.user)
+        if not parent_page_perms.can_add_subpage():
+            raise PermissionDenied
+
         # We need to populate treebeard's path / depth fields in order to
         # pass validation. We can't make these 100% consistent with the rest
         # of the tree without making actual database changes (such as

wagtail/blocks/struct_block.py

@@ -427,7 +427,8 @@ class StructBlockAdapter(Adapter):
         if block.meta.form_template:
             meta["formTemplate"] = block.render_form_template()
 
-        if block.meta.label_format:
+        # Check specifically for None to allow for empty string
+        if block.meta.label_format is not None:
             meta["labelFormat"] = block.meta.label_format
 
         return [