From 316de3a8a314162e3d6ec081344eabca3a4d91b9 Mon Sep 17 00:00:00 2001
From: Alexander Akhmetov
Date: Mon, 26 Aug 2013 20:05:36 +0400
Subject: Added max_paginate_by parameter

---
 rest_framework/generics.py              | 10 +++++--
 rest_framework/settings.py              |  1 +
 rest_framework/tests/test_pagination.py | 46 +++++++++++++++++++++++++++++++++
 3 files changed, 55 insertions(+), 2 deletions(-)

(limited to 'rest_framework')

diff --git a/rest_framework/generics.py b/rest_framework/generics.py
index 5ecf6310..33affee8 100644
--- a/rest_framework/generics.py
+++ b/rest_framework/generics.py
@@ -56,6 +56,7 @@ class GenericAPIView(views.APIView):
     # Pagination settings
     paginate_by = api_settings.PAGINATE_BY
     paginate_by_param = api_settings.PAGINATE_BY_PARAM
+    max_paginate_by = api_settings.MAX_PAGINATE_BY
     pagination_serializer_class = api_settings.DEFAULT_PAGINATION_SERIALIZER_CLASS
     page_kwarg = 'page'
 
@@ -207,11 +208,16 @@ class GenericAPIView(views.APIView):
         if self.paginate_by_param:
             query_params = self.request.QUERY_PARAMS
             try:
-                return int(query_params[self.paginate_by_param])
+                paginate_by_param = int(query_params[self.paginate_by_param])
             except (KeyError, ValueError):
                 pass
+            else:
+                if self.max_paginate_by:
+                    return min(self.max_paginate_by, paginate_by_param)
+                else:
+                    return paginate_by_param
 
-        return self.paginate_by
+        return min(self.max_paginate_by, self.paginate_by) or self.paginate_by
 
     def get_serializer_class(self):
         """
diff --git a/rest_framework/settings.py b/rest_framework/settings.py
index 7d25e513..b8e40bfa 100644
--- a/rest_framework/settings.py
+++ b/rest_framework/settings.py
@@ -68,6 +68,7 @@ DEFAULTS = {
     # Pagination
     'PAGINATE_BY': None,
     'PAGINATE_BY_PARAM': None,
+    'MAX_PAGINATE_BY': None,
 
     # View configuration
     'VIEW_NAME_FUNCTION': 'rest_framework.views.get_view_name',
diff --git a/rest_framework/tests/test_pagination.py b/rest_framework/tests/test_pagination.py
index 85d4640e..cbed1604 100644
--- a/rest_framework/tests/test_pagination.py
+++ b/rest_framework/tests/test_pagination.py
@@ -42,6 +42,16 @@ class PaginateByParamView(generics.ListAPIView):
     paginate_by_param = 'page_size'
 
 
+class MaxPaginateByView(generics.ListAPIView):
+    """
+    View for testing custom max_paginate_by usage
+    """
+    model = BasicModel
+    paginate_by = 5
+    max_paginate_by = 3
+    paginate_by_param = 'page_size'
+
+
 class IntegrationTestPagination(TestCase):
     """
     Integration tests for paginated list views.
@@ -313,6 +323,42 @@ class TestCustomPaginateByParam(TestCase):
         self.assertEqual(response.data['results'], self.data[:5])
 
 
+class TestMaxPaginateByParam(TestCase):
+    """
+    Tests for list views with max_paginate_by kwarg
+    """
+
+    def setUp(self):
+        """
+        Create 13 BasicModel instances.
+        """
+        for i in range(13):
+            BasicModel(text=i).save()
+        self.objects = BasicModel.objects
+        self.data = [
+            {'id': obj.id, 'text': obj.text}
+            for obj in self.objects.all()
+        ]
+        self.view = MaxPaginateByView.as_view()
+
+    def test_max_paginate_by(self):
+        """
+        If max_paginate_by is set and it less than paginate_by, new kwarg should limit requests for review.
+        """
+        request = factory.get('/?page_size=10')
+        response = self.view(request).render()
+        self.assertEqual(response.data['count'], 13)
+        self.assertEqual(response.data['results'], self.data[:3])
+
+    def test_max_paginate_by_without_page_size_param(self):
+        """
+        If max_paginate_by is set, new kwarg should limit requests for review.
+        """
+        request = factory.get('/')
+        response = self.view(request).render()
+        self.assertEqual(response.data['results'], self.data[:3])
+
+
 ### Tests for context in pagination serializers
 
 class CustomField(serializers.Field):
-- 
cgit v1.2.3


From dce47a11d3d65a697ea8aa322455d626190bc1e5 Mon Sep 17 00:00:00 2001
From: Tom Christie
Date: Tue, 27 Aug 2013 12:32:13 +0100
Subject: Move settings into more sensible ordering

---
 rest_framework/settings.py | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

(limited to 'rest_framework')

diff --git a/rest_framework/settings.py b/rest_framework/settings.py
index 7d25e513..2ee15ac7 100644
--- a/rest_framework/settings.py
+++ b/rest_framework/settings.py
@@ -48,7 +48,6 @@ DEFAULTS = {
     ),
     'DEFAULT_THROTTLE_CLASSES': (
     ),
-
     'DEFAULT_CONTENT_NEGOTIATION_CLASS':
         'rest_framework.negotiation.DefaultContentNegotiation',
 
@@ -69,14 +68,14 @@ DEFAULTS = {
     'PAGINATE_BY': None,
     'PAGINATE_BY_PARAM': None,
 
-    # View configuration
-    'VIEW_NAME_FUNCTION': 'rest_framework.views.get_view_name',
-    'VIEW_DESCRIPTION_FUNCTION': 'rest_framework.views.get_view_description',
-
     # Authentication
     'UNAUTHENTICATED_USER': 'django.contrib.auth.models.AnonymousUser',
     'UNAUTHENTICATED_TOKEN': None,
 
+    # View configuration
+    'VIEW_NAME_FUNCTION': 'rest_framework.views.get_view_name',
+    'VIEW_DESCRIPTION_FUNCTION': 'rest_framework.views.get_view_description',
+
     # Testing
     'TEST_REQUEST_RENDERER_CLASSES': (
         'rest_framework.renderers.MultiPartRenderer',
-- 
cgit v1.2.3


From b430503fa657330b606a9c632ea0decc4254163e Mon Sep 17 00:00:00 2001
From: Tom Christie
Date: Tue, 27 Aug 2013 12:32:33 +0100
Subject: Move exception handler out of main view

---
 rest_framework/views.py | 79 +++++++++++++++++++++++++++++++++++--------------
 1 file changed, 57 insertions(+), 22 deletions(-)

(limited to 'rest_framework')

diff --git a/rest_framework/views.py b/rest_framework/views.py
index 727a9f95..7cb71ccf 100644
--- a/rest_framework/views.py
+++ b/rest_framework/views.py
@@ -15,8 +15,14 @@ from rest_framework.settings import api_settings
 from rest_framework.utils import formatting
 
 
-def get_view_name(cls, suffix=None):
-    name = cls.__name__
+def get_view_name(view_cls, suffix=None):
+    """
+    Given a view class, return a textual name to represent the view.
+    This name is used in the browsable API, and in OPTIONS responses.
+
+    This function is the default for the `VIEW_NAME_FUNCTION` setting.
+    """
+    name = view_cls.__name__
     name = formatting.remove_trailing_string(name, 'View')
     name = formatting.remove_trailing_string(name, 'ViewSet')
     name = formatting.camelcase_to_spaces(name)
@@ -25,14 +31,53 @@ def get_view_name(cls, suffix=None):
 
     return name
 
-def get_view_description(cls, html=False):
-    description = cls.__doc__ or ''
+def get_view_description(view_cls, html=False):
+    """
+    Given a view class, return a textual description to represent the view.
+    This name is used in the browsable API, and in OPTIONS responses.
+
+    This function is the default for the `VIEW_DESCRIPTION_FUNCTION` setting.
+    """
+    description = view_cls.__doc__ or ''
     description = formatting.dedent(smart_text(description))
     if html:
         return formatting.markup_description(description)
     return description
 
 
+def exception_handler(exc):
+    """
+    Returns the response that should be used for any given exception.
+
+    By default we handle the REST framework `APIException`, and also
+    Django's builtin `Http404` and `PermissionDenied` exceptions.
+
+    Any unhandled exceptions may return `None`, which will cause a 500 error
+    to be raised.
+    """
+    if isinstance(exc, exceptions.APIException):
+        headers = {}
+        if getattr(exc, 'auth_header', None):
+            headers['WWW-Authenticate'] = exc.auth_header
+        if getattr(exc, 'wait', None):
+            headers['X-Throttle-Wait-Seconds'] = '%d' % exc.wait
+
+        return Response({'detail': exc.detail},
+                        status=exc.status_code,
+                        headers=headers)
+
+    elif isinstance(exc, Http404):
+        return Response({'detail': 'Not found'},
+                        status=status.HTTP_404_NOT_FOUND)
+
+    elif isinstance(exc, PermissionDenied):
+        return Response({'detail': 'Permission denied'},
+                        status=status.HTTP_403_FORBIDDEN)
+
+    # Note: Unhandled exceptions will raise a 500 error.
+    return None
+
+
 class APIView(View):
     settings = api_settings
 
@@ -303,33 +348,23 @@ class APIView(View):
         Handle any exception that occurs, by returning an appropriate response,
         or re-raising the error.
         """
-        if isinstance(exc, exceptions.Throttled) and exc.wait is not None:
-            # Throttle wait header
-            self.headers['X-Throttle-Wait-Seconds'] = '%d' % exc.wait
-
         if isinstance(exc, (exceptions.NotAuthenticated,
                             exceptions.AuthenticationFailed)):
             # WWW-Authenticate header for 401 responses, else coerce to 403
             auth_header = self.get_authenticate_header(self.request)
 
             if auth_header:
-                self.headers['WWW-Authenticate'] = auth_header
+                exc.auth_header = auth_header
             else:
                 exc.status_code = status.HTTP_403_FORBIDDEN
 
-        if isinstance(exc, exceptions.APIException):
-            return Response({'detail': exc.detail},
-                            status=exc.status_code,
-                            exception=True)
-        elif isinstance(exc, Http404):
-            return Response({'detail': 'Not found'},
-                            status=status.HTTP_404_NOT_FOUND,
-                            exception=True)
-        elif isinstance(exc, PermissionDenied):
-            return Response({'detail': 'Permission denied'},
-                            status=status.HTTP_403_FORBIDDEN,
-                            exception=True)
-        raise
+        response = exception_handler(exc)
+
+        if response is None:
+            raise
+
+        response.exception = True
+        return response
 
     # Note: session based authentication is explicitly CSRF validated,
     # all other authentication is CSRF exempt.
-- 
cgit v1.2.3


From b54cbd292c5680f4de0e028ff1cb2a9ab1cd34ff Mon Sep 17 00:00:00 2001
From: Tom Christie
Date: Tue, 27 Aug 2013 12:36:06 +0100
Subject: Use view.settings for API settings, to make testing easier.

---
 rest_framework/views.py | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

(limited to 'rest_framework')

diff --git a/rest_framework/views.py b/rest_framework/views.py
index 7cb71ccf..4cff0422 100644
--- a/rest_framework/views.py
+++ b/rest_framework/views.py
@@ -79,8 +79,8 @@ def exception_handler(exc):
 
 
 class APIView(View):
-    settings = api_settings
 
+    # The following policies may be set at either globally, or per-view.
     renderer_classes = api_settings.DEFAULT_RENDERER_CLASSES
     parser_classes = api_settings.DEFAULT_PARSER_CLASSES
     authentication_classes = api_settings.DEFAULT_AUTHENTICATION_CLASSES
@@ -88,6 +88,9 @@ class APIView(View):
     permission_classes = api_settings.DEFAULT_PERMISSION_CLASSES
     content_negotiation_class = api_settings.DEFAULT_CONTENT_NEGOTIATION_CLASS
 
+    # Allow dependancy injection of other settings to make testing easier.
+    settings = api_settings
+
     @classmethod
     def as_view(cls, **initkwargs):
         """
@@ -178,7 +181,7 @@ class APIView(View):
         Return the view name, as used in OPTIONS responses and in the
         browsable API.
         """
-        func = api_settings.VIEW_NAME_FUNCTION
+        func = self.settings.VIEW_NAME_FUNCTION
         return func(self.__class__, getattr(self, 'suffix', None))
 
     def get_view_description(self, html=False):
@@ -186,7 +189,7 @@ class APIView(View):
         Return some descriptive text for the view, as used in OPTIONS responses
         and in the browsable API.
         """
-        func = api_settings.VIEW_DESCRIPTION_FUNCTION
+        func = self.settings.VIEW_DESCRIPTION_FUNCTION
         return func(self.__class__, html)
 
     # API policy instantiation methods
-- 
cgit v1.2.3


From 7fb3f078f0973acc1d108d8c617b26b6845599f7 Mon Sep 17 00:00:00 2001
From: Alexander Akhmetov
Date: Tue, 27 Aug 2013 17:38:41 +0400
Subject: fix for python3

---
 rest_framework/generics.py | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

(limited to 'rest_framework')

diff --git a/rest_framework/generics.py b/rest_framework/generics.py
index 33affee8..ce6c462a 100644
--- a/rest_framework/generics.py
+++ b/rest_framework/generics.py
@@ -212,12 +212,15 @@ class GenericAPIView(views.APIView):
             except (KeyError, ValueError):
                 pass
             else:
-                if self.max_paginate_by:
+                if self.max_paginate_by is not None:
                     return min(self.max_paginate_by, paginate_by_param)
                 else:
                     return paginate_by_param
 
-        return min(self.max_paginate_by, self.paginate_by) or self.paginate_by
+        if self.max_paginate_by:
+            return min(self.max_paginate_by, self.paginate_by)
+        else:
+            return self.paginate_by
 
     def get_serializer_class(self):
         """
-- 
cgit v1.2.3


From 4c53fb883fe719c3ca6244aeb8c405a24eb89a40 Mon Sep 17 00:00:00 2001
From: Tom Christie
Date: Wed, 28 Aug 2013 12:52:38 +0100
Subject: Tweak MAX_PAGINATE_BY behavior in edge case.

Always respect `paginate_by` settings if client does not specify page
size.  (Even if the developer has misconfigured, so that `paginate_by >
max`.)
---
 rest_framework/generics.py              | 20 ++++++++------------
 rest_framework/tests/test_pagination.py | 11 ++++++-----
 2 files changed, 14 insertions(+), 17 deletions(-)

(limited to 'rest_framework')

diff --git a/rest_framework/generics.py b/rest_framework/generics.py
index ce6c462a..14feed20 100644
--- a/rest_framework/generics.py
+++ b/rest_framework/generics.py
@@ -14,13 +14,15 @@ from rest_framework.settings import api_settings
 import warnings
 
 
-def strict_positive_int(integer_string):
+def strict_positive_int(integer_string, cutoff=None):
     """
     Cast a string to a strictly positive integer.
     """
     ret = int(integer_string)
     if ret <= 0:
         raise ValueError()
+    if cutoff:
+        ret = min(ret, cutoff)
     return ret
 
 def get_object_or_404(queryset, **filter_kwargs):
@@ -206,21 +208,15 @@ class GenericAPIView(views.APIView):
                           PendingDeprecationWarning, stacklevel=2)
 
         if self.paginate_by_param:
-            query_params = self.request.QUERY_PARAMS
             try:
-                paginate_by_param = int(query_params[self.paginate_by_param])
+                return strict_positive_int(
+                    self.request.QUERY_PARAMS[self.paginate_by_param],
+                    cutoff=self.max_paginate_by
+                )
             except (KeyError, ValueError):
                 pass
-            else:
-                if self.max_paginate_by is not None:
-                    return min(self.max_paginate_by, paginate_by_param)
-                else:
-                    return paginate_by_param
 
-        if self.max_paginate_by:
-            return min(self.max_paginate_by, self.paginate_by)
-        else:
-            return self.paginate_by
+        return self.paginate_by
 
     def get_serializer_class(self):
         """
diff --git a/rest_framework/tests/test_pagination.py b/rest_framework/tests/test_pagination.py
index cbed1604..4170d4b6 100644
--- a/rest_framework/tests/test_pagination.py
+++ b/rest_framework/tests/test_pagination.py
@@ -47,8 +47,8 @@ class MaxPaginateByView(generics.ListAPIView):
     View for testing custom max_paginate_by usage
     """
     model = BasicModel
-    paginate_by = 5
-    max_paginate_by = 3
+    paginate_by = 3
+    max_paginate_by = 5
     paginate_by_param = 'page_size'
 
 
@@ -343,16 +343,17 @@ class TestMaxPaginateByParam(TestCase):
 
     def test_max_paginate_by(self):
         """
-        If max_paginate_by is set and it less than paginate_by, new kwarg should limit requests for review.
+        If max_paginate_by is set, it should limit page size for the view.
         """
         request = factory.get('/?page_size=10')
         response = self.view(request).render()
         self.assertEqual(response.data['count'], 13)
-        self.assertEqual(response.data['results'], self.data[:3])
+        self.assertEqual(response.data['results'], self.data[:5])
 
     def test_max_paginate_by_without_page_size_param(self):
         """
-        If max_paginate_by is set, new kwarg should limit requests for review.
+        If max_paginate_by is set, but client does not specifiy page_size,
+        standard `paginate_by` behavior should be used.
         """
         request = factory.get('/')
         response = self.view(request).render()
-- 
cgit v1.2.3


From 97b52156cc0e96c2edb7e1b176838bfd9c22321a Mon Sep 17 00:00:00 2001
From: Tom Christie
Date: Wed, 28 Aug 2013 13:34:14 +0100
Subject: Added `.cache` attribute on throttles.

Closes #1066.  More localised than a new settings key, and more
flexible in that different throttles can use different behavior.
Thanks to @chicheng for the report! :)
---
 rest_framework/throttling.py | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

(limited to 'rest_framework')

diff --git a/rest_framework/throttling.py b/rest_framework/throttling.py
index 65b45593..8943f22c 100644
--- a/rest_framework/throttling.py
+++ b/rest_framework/throttling.py
@@ -2,7 +2,7 @@
 Provides various throttling policies.
 """
 from __future__ import unicode_literals
-from django.core.cache import cache
+from django.core.cache import cache as default_cache
 from django.core.exceptions import ImproperlyConfigured
 from rest_framework.settings import api_settings
 import time
@@ -39,6 +39,7 @@ class SimpleRateThrottle(BaseThrottle):
     Previous request information used for throttling is stored in the cache.
     """
 
+    cache = default_cache
     timer = time.time
     cache_format = 'throtte_%(scope)s_%(ident)s'
     scope = None
@@ -99,7 +100,7 @@ class SimpleRateThrottle(BaseThrottle):
         if self.key is None:
             return True
 
-        self.history = cache.get(self.key, [])
+        self.history = self.cache.get(self.key, [])
         self.now = self.timer()
 
         # Drop any requests from the history which have now passed the
@@ -116,7 +117,7 @@ class SimpleRateThrottle(BaseThrottle):
         into the cache.
         """
         self.history.insert(0, self.now)
-        cache.set(self.key, self.history, self.duration)
+        self.cache.set(self.key, self.history, self.duration)
         return True
 
     def throttle_failure(self):
-- 
cgit v1.2.3


From 2d5e14a8d39a53c8a2e6d28fb8ae7debb5fbd388 Mon Sep 17 00:00:00 2001
From: Tom Christie
Date: Wed, 28 Aug 2013 15:32:41 +0100
Subject: Throttles now use HTTP_X_FORWARDED_FOR, falling back to REMOTE_ADDR
 to identify anonymous requests

---
 rest_framework/throttling.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

(limited to 'rest_framework')

diff --git a/rest_framework/throttling.py b/rest_framework/throttling.py
index 8943f22c..a946d837 100644
--- a/rest_framework/throttling.py
+++ b/rest_framework/throttling.py
@@ -152,7 +152,9 @@ class AnonRateThrottle(SimpleRateThrottle):
         if request.user.is_authenticated():
             return None  # Only throttle unauthenticated requests.
 
-        ident = request.META.get('REMOTE_ADDR', None)
+        ident = request.META.get('HTTP_X_FORWARDED_FOR')
+        if ident is None:
+            ident = request.META.get('REMOTE_ADDR')
 
         return self.cache_format % {
             'scope': self.scope,
-- 
cgit v1.2.3


From 11071499a777ecfee6edfb7e92ecf9a12d35eeb7 Mon Sep 17 00:00:00 2001
From: Mathieu Pillard
Date: Thu, 29 Aug 2013 18:10:47 +0200
Subject: Make ChoiceField.from_native() follow IntegerField behaviour on empty
 values

---
 rest_framework/fields.py            | 5 +++++
 rest_framework/tests/test_fields.py | 8 ++++++++
 2 files changed, 13 insertions(+)

(limited to 'rest_framework')

diff --git a/rest_framework/fields.py b/rest_framework/fields.py
index 3e0ca1a1..210c2537 100644
--- a/rest_framework/fields.py
+++ b/rest_framework/fields.py
@@ -514,6 +514,11 @@ class ChoiceField(WritableField):
                     return True
         return False
 
+    def from_native(self, value):
+        if value in validators.EMPTY_VALUES:
+            return None
+        return super(ChoiceField, self).from_native(value)
+
 
 class EmailField(CharField):
     type_name = 'EmailField'
diff --git a/rest_framework/tests/test_fields.py b/rest_framework/tests/test_fields.py
index ebccba7d..34fbab9c 100644
--- a/rest_framework/tests/test_fields.py
+++ b/rest_framework/tests/test_fields.py
@@ -688,6 +688,14 @@ class ChoiceFieldTests(TestCase):
         f = serializers.ChoiceField(required=False, choices=self.SAMPLE_CHOICES)
         self.assertEqual(f.choices, models.fields.BLANK_CHOICE_DASH + self.SAMPLE_CHOICES)
 
+    def test_from_native_empty(self):
+        """
+        Make sure from_native() returns None on empty param.
+        """
+        f = serializers.ChoiceField(choices=self.SAMPLE_CHOICES)
+        result = f.from_native('')
+        self.assertEqual(result, None)
+
 
 class EmailFieldTests(TestCase):
     """
-- 
cgit v1.2.3


From 02b6836ee88498861521dfff743467b0456ad109 Mon Sep 17 00:00:00 2001
From: Tom Christie
Date: Thu, 29 Aug 2013 20:51:51 +0100
Subject: Fix breadcrumb view names

---
 rest_framework/utils/breadcrumbs.py | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

(limited to 'rest_framework')

diff --git a/rest_framework/utils/breadcrumbs.py b/rest_framework/utils/breadcrumbs.py
index 0384faba..e6690d17 100644
--- a/rest_framework/utils/breadcrumbs.py
+++ b/rest_framework/utils/breadcrumbs.py
@@ -8,8 +8,11 @@ def get_breadcrumbs(url):
     tuple of (name, url).
     """
 
+    from rest_framework.settings import api_settings
     from rest_framework.views import APIView
 
+    view_name_func = api_settings.VIEW_NAME_FUNCTION
+
     def breadcrumbs_recursive(url, breadcrumbs_list, prefix, seen):
         """
         Add tuples of (name, url) to the breadcrumbs list,
@@ -28,8 +31,8 @@ def get_breadcrumbs(url):
                 # Don't list the same view twice in a row.
                 # Probably an optional trailing slash.
                 if not seen or seen[-1] != view:
-                    instance = view.cls()
-                    name = instance.get_view_name()
+                    suffix = getattr(view, 'suffix', None)
+                    name = view_name_func(cls, suffix)
                     breadcrumbs_list.insert(0, (name, prefix + url))
                     seen.append(view)
 
-- 
cgit v1.2.3