Language: Python
Label: safe
CWE: CWE-306 \u2014 Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Code:
    def test_get_object_with_constrained_permission(self):
        obj_perm = ObjectPermission(
            name="Test permission",
            constraints={"pk": self.file_proxy_1.pk},
            actions=["view"],
        )
        obj_perm.save()
        obj_perm.users.add(self.user)
        obj_perm.object_types.add(ContentType.objects.get_for_model(FileProxy))
        for url in self.urls:
            with self.subTest(url):
                response = self.client.get(url)
                self.assertHttpStatus(response, 200)
        for url in [
            f"{reverse('db_file_storage.download_file')}?name={self.file_proxy_2.file.name}",
            f"{reverse('db_file_storage.get_file')}?name={self.file_proxy_2.file.name}",
        ]:
            with self.subTest(url):
                response = self.client.get(url)
                self.assertHttpStatus(response, 404)