Language: Python
Label: vulnerable
CWE: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Code:
def test_complete_admin_task(client, admin_factory, admin_task_factory):
    admin = admin_factory()
    client.force_login(admin)

    task1 = admin_task_factory(assigned_to=admin)
    task2 = admin_task_factory(assigned_to=admin)

    url = reverse("admin_tasks:mine")
    response = client.get(url)

    assert task1.name in response.content.decode()
    # Checked button is not visible because tasks are still open
    assert "btn-success" not in response.content.decode()

    url = reverse("admin_tasks:detail", args=[task1.id])
    response = client.get(url)

    complete_url = reverse("admin_tasks:completed", args=[task1.id])
    assert "Complete" in response.content.decode()
    assert complete_url in response.content.decode()

    response = client.get(complete_url, follow=True)
    task1.refresh_from_db()
    task2.refresh_from_db()

    assert "Complete" not in response.content.decode()
    assert "completed" in response.content.decode()
    assert "disabled" in response.content.decode()
    # Cannot add new comment
    assert "div_id_content" not in response.content.decode()
    # Complete url is still there to make it open again
    assert complete_url in response.content.decode()

    assert task1.completed
    assert not task2.completed

    url = reverse("admin_tasks:mine")
    response = client.get(url)
    # Check button is now visible
    assert "btn-success" in response.content.decode()