core: fix default for UNAUTHORIZED_VIEW

flask_security/core.py

@@ -72,7 +72,7 @@
     'POST_CONFIRM_VIEW': None,
     'POST_RESET_VIEW': None,
     'POST_CHANGE_VIEW': None,
-    'UNAUTHORIZED_VIEW': lambda: None,
+    'UNAUTHORIZED_VIEW': None,
     'FORGOT_PASSWORD_TEMPLATE': 'security/forgot_password.html',
     'LOGIN_USER_TEMPLATE': 'security/login_user.html',
     'REGISTER_USER_TEMPLATE': 'security/register_user.html',

flask_security/decorators.py

@@ -43,7 +43,7 @@ def _get_unauthorized_response(text=None, headers=None):
 
 
 def _get_unauthorized_view():
-    view = utils.get_url(utils.config_value('UNAUTHORIZED_VIEW'))
+    view = utils.config_value('UNAUTHORIZED_VIEW')
     if view:
         if callable(view):
             view = view()

tests/test_common.py

@@ -8,6 +8,8 @@
 
 import base64
 
+import pytest
+
 from utils import authenticate, json_authenticate, logout
 
 try:
@@ -130,9 +132,10 @@ def test_authorized_access(client):
 def test_unauthorized_access(client, get_message):
     authenticate(client, "joe@lp.com")
     response = client.get("/admin", follow_redirects=True)
-    assert get_message('UNAUTHORIZED') in response.data
+    assert response.status_code == 403
 
 
+@pytest.mark.settings(unauthorized_view=lambda: None)
 def test_unauthorized_access_with_referrer(client, get_message):
     authenticate(client, 'joe@lp.com')
     response = client.get('/admin', headers={'referer': '/admin'})
@@ -152,6 +155,7 @@ def test_unauthorized_access_with_referrer(client, get_message):
     assert response.data.count(get_message('UNAUTHORIZED')) == 1
 
 
+@pytest.mark.settings(unauthorized_view='/')
 def test_roles_accepted(client):
     for user in ("matt@lp.com", "joe@lp.com"):
         authenticate(client, user)
@@ -164,11 +168,13 @@ def test_roles_accepted(client):
     assert b'Home Page' in response.data
 
 
+@pytest.mark.settings(unauthorized_view='/')
 def test_unauthenticated_role_required(client, get_message):
     response = client.get('/admin', follow_redirects=True)
     assert get_message('UNAUTHORIZED') in response.data
 
 
+@pytest.mark.settings(unauthorized_view='/')
 def test_multiple_role_required(client):
     for user in ("matt@lp.com", "joe@lp.com"):
         authenticate(client, user)