Repository: django/django
File: tests/test_client/tests.py (Python)

Code before:

        # Get the page without logging in. Should result in 302.
        response = self.client.get("/permission_protected_view/")
        self.assertRedirects(
            response, "/accounts/login/?next=/permission_protected_view/"
        )

        # Log in
        login = self.client.login(username="testclient", password="password")
        self.assertTrue(login, "Could not log in")

        # Log in with wrong permissions. Should result in 302.
        response = self.client.get("/permission_protected_view/")
        self.assertRedirects(
            response, "/accounts/login/?next=/permission_protected_view/"
        )

        # Get the REAL permission using standard Django ORM
        permission = Permission.objects.get(
            content_type__app_label="auth", codename="add_user"
        )
        self.u1.user_permissions.add(permission)

        # Log in to refresh the session with the new permission
        self.client.login(username="testclient", password="password")

        # Request the page again. The standard permission engine
        # will now grant access.
        response = self.client.get("/permission_protected_view/")
        self.assertEqual(response.status_code, 200)
        self.assertEqual(response.context["user"].username, "testclient")

    def test_view_with_permissions_exception(self):
        """
        Request a page that is protected with @permission_required but raises
        an exception.
        """

        # Get the page without logging in. Should result in 403.
        response = self.client.get("/permission_protected_view_exception/")
        self.assertEqual(response.status_code, 403)

        # Log in
        login = self.client.login(username="testclient", password="password")
        self.assertTrue(login, "Could not log in")

        # Log in with wrong permissions. Should result in 403.
        response = self.client.get("/permission_protected_view_exception/")
        self.assertEqual(response.status_code, 403)

    def test_view_with_method_permissions(self):

Review comment (security):
Permissions are not stored in the session but checked at run time. I suspect you don't need to log in again at all here.


```suggestion
```

Code after:

        # Get the page without logging in. Should result in 302.
        response = self.client.get("/permission_protected_view/")
        self.assertRedirects(
            response, "/accounts/login/?next=/permission_protected_view/"
        )

        # Log in
        login = self.client.login(username="testclient", password="password")
        self.assertTrue(login, "Could not log in")

        # Log in with wrong permissions. Should result in 302.
        response = self.client.get("/permission_protected_view/")
        self.assertRedirects(
            response, "/accounts/login/?next=/permission_protected_view/"
        )

        permission = Permission.objects.get(
            content_type__app_label="auth", codename="add_user"
        )
        self.u1.user_permissions.add(permission)

        # Request the page again. Access is granted.
        response = self.client.get("/permission_protected_view/")
        self.assertEqual(response.status_code, 200)
        self.assertEqual(response.context["user"].username, "testclient")

    def test_view_with_permissions_exception(self):
        """
        Request a page that is protected with @permission_required but raises
        an exception.
        """

        # Get the page without logging in. Should result in 403.
        response = self.client.get("/permission_protected_view_exception/")
        self.assertEqual(response.status_code, 403)

        # Log in
        login = self.client.login(username="testclient", password="password")
        self.assertTrue(login, "Could not log in")

        # Log in with wrong permissions. Should result in 403.
        response = self.client.get("/permission_protected_view_exception/")
        self.assertEqual(response.status_code, 403)

    def test_view_with_method_permissions(self):
        "Request a page that is protected with a @permission_required method"

        # Get the page without logging in. Should result in 302.
        response = self.client.get("/permission_protected_method_view/")
        self.assertRedirects(