Fixed #23957 -- Started deprecation toward requiring session verification.

Thanks Carl Meyer for review.

1 files changed, 45 insertions, 0 deletions

diff --git a/tests/settings_tests/tests.py b/tests/settings_tests/tests.py
index b2681f4317..c87f6b6204 100644
--- a/tests/settings_tests/tests.py
+++ b/tests/settings_tests/tests.py
@@ -10,6 +10,7 @@ from django.http import HttpRequest
 from django.test import (SimpleTestCase, TransactionTestCase, TestCase,
     modify_settings, override_settings, signals)
 from django.utils import six
+from django.utils.encoding import force_text
 
 
 @modify_settings(ITEMS={
@@ -464,3 +465,47 @@ class TestTupleSettings(unittest.TestCase):
             finally:
                 del sys.modules['fake_settings_module']
                 delattr(settings_module, setting)
+
+
+class TestSessionVerification(unittest.TestCase):
+
+    def setUp(self):
+        self.settings_module = ModuleType('fake_settings_module')
+        self.settings_module.SECRET_KEY = 'foo'
+
+    def tearDown(self):
+        if 'fake_settings_module' in sys.modules:
+            del sys.modules['fake_settings_module']
+
+    def test_session_verification_deprecation_no_verification(self):
+        self.settings_module.MIDDLEWARE_CLASSES = ['django.contrib.auth.middleware.AuthenticationMiddleware']
+        sys.modules['fake_settings_module'] = self.settings_module
+        with warnings.catch_warnings(record=True) as warn:
+            warnings.filterwarnings('always')
+            Settings('fake_settings_module')
+        self.assertEqual(
+            force_text(warn[0].message),
+            "Session verification will become mandatory in Django 2.0. "
+            "Please add 'django.contrib.auth.middleware.SessionAuthenticationMiddleware' "
+            "to your MIDDLEWARE_CLASSES setting when you are ready to opt-in after "
+            "reading the upgrade considerations in the 1.8 release notes.",
+        )
+
+    def test_session_verification_deprecation_both(self):
+        self.settings_module.MIDDLEWARE_CLASSES = [
+            'django.contrib.auth.middleware.AuthenticationMiddleware',
+            'django.contrib.auth.middleware.SessionAuthenticationMiddleware',
+        ]
+        sys.modules['fake_settings_module'] = self.settings_module
+        with warnings.catch_warnings(record=True) as warn:
+            warnings.filterwarnings('always')
+            Settings('fake_settings_module')
+        self.assertEqual(len(warn), 0)
+
+    def test_session_verification_deprecation_neither(self):
+        self.settings_module.MIDDLEWARE_CLASSES = []
+        sys.modules['fake_settings_module'] = self.settings_module
+        with warnings.catch_warnings(record=True) as warn:
+            warnings.filterwarnings('always')
+            Settings('fake_settings_module')
+        self.assertEqual(len(warn), 0)