fix block uploader tests

dashboard_viewer/dashboard_viewer/settings.py

@@ -337,7 +337,5 @@ def constance_updated(key, old_value, **_):
             "Only include the hostname part of the URL."
         )
 
-    X_FRAME_OPTIONS = f"ALLOW-FROM https://{MAIN_APPLICATION_HOST}/"
-
 # required since django 3.2
 DEFAULT_AUTO_FIELD = "django.db.models.AutoField"

dashboard_viewer/uploader/decorators.py

@@ -2,6 +2,7 @@
 
 from django.conf import settings
 from django.http import HttpResponseForbidden
+from django.views.decorators.clickjacking import xframe_options_exempt
 from django.views.decorators.csrf import csrf_exempt
 
 
@@ -13,6 +14,8 @@ def uploader_decorator(view_func):
     Else don't do any verification
     """
     wrapped_view = csrf_exempt(view_func)
+    wrapped_view = xframe_options_exempt(wrapped_view)
+
     if not settings.SINGLE_APPLICATION_MODE:
 
         def check_host(request, *args, **kwargs):

dashboard_viewer/uploader/tests.py

@@ -46,19 +46,11 @@ def test_not_block_if_correct_host(self):
         response = self.client.get("/uploader/test/", HTTP_HOST="mainapp.host.com")
 
         self.assertEqual(200, response.status_code)
-        self.assertTrue(response.has_header("X-Frame-Options"))
-        self.assertEqual(
-            "ALLOW-FROM HTTPS://MAINAPP.HOST.COM/", response["X-Frame-Options"]
-        )
 
     def test_not_block_other_urls(self):
         response = self.client.get("/admin/login/", HTTP_HOST="thisapp.host.com")
 
         self.assertEqual(200, response.status_code)
-        self.assertTrue(response.has_header("X-Frame-Options"))
-        self.assertEqual(
-            "ALLOW-FROM HTTPS://MAINAPP.HOST.COM/", response["X-Frame-Options"]
-        )
 
 
 class UploaderNonRestrictedAccess(TestCase):
@@ -74,8 +66,6 @@ def test_not_block_if_single_application(self):
         response = self.client.get("/uploader/test/", HTTP_HOST="some.domain.com")
 
         self.assertEqual(200, response.status_code)
-        if response.has_header("X-Frame-Options"):
-            self.assertNotIn("ALLOW-FROM ", response.get("X-Frame-Options"))
 
 
 class DataSourceCreator:

dashboard_viewer/uploader/views.py

@@ -6,7 +6,6 @@
 from django.http import JsonResponse
 from django.shortcuts import get_object_or_404, redirect, render
 from django.utils.html import format_html, mark_safe
-from django.views.decorators.clickjacking import xframe_options_exempt
 from rest_framework.response import Response
 from rest_framework.viewsets import GenericViewSet
 
@@ -20,7 +19,6 @@
 
 
 @uploader_decorator
-@xframe_options_exempt
 def upload_achilles_results(request, *args, **kwargs):
     data_source = kwargs.get("data_source")
     try:
@@ -155,7 +153,6 @@ def _leave_valid_fields_values_only(request, initial, aux_form):
 
 
 @uploader_decorator
-@xframe_options_exempt
 def create_data_source(request, *_, **kwargs):
     data_source = kwargs.get("data_source")
     if request.method == "GET":
@@ -237,7 +234,6 @@ def create_data_source(request, *_, **kwargs):
 
 
 @uploader_decorator
-@xframe_options_exempt
 def edit_data_source(request, *_, **kwargs):
     data_source = kwargs.get("data_source")
     try: