post: allow using submitted data in url substitution (#17172)

combo/data/models.py

@@ -14,6 +14,7 @@
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+import copy
 import feedparser
 import hashlib
 import json
@@ -894,19 +895,23 @@ class JsonCellBase(CellBase):
         error_message = self.actions[action].get('error-message')
         logger = logging.getLogger(__name__)
 
-        context = RequestContext(request, {'request': request, 'synchronous': True})
-        try:
-            url = utils.get_templated_url(self.actions[action]['url'], context)
-        except utils.UnknownTemplateVariableError:
-            logger.warning('unknown variable in URL (%s)', self.actions[action]['url'])
-            raise PostException(error_message)
-
         content = {}
         for key, value in request.POST.items():
             if key == 'action':
                 continue
             content[key] = value
 
+        context_dict = copy.copy(content)
+        context_dict['request'] = request
+        context_dict['synchronous'] = True
+        context = RequestContext(request, context_dict)
+
+        try:
+            url = utils.get_templated_url(self.actions[action]['url'], context)
+        except utils.UnknownTemplateVariableError:
+            logger.warning('unknown variable in URL (%s)', self.actions[action]['url'])
+            raise PostException(error_message)
+
         json_response = utils.requests.post(url,
                 headers={'Accept': 'application/json'},
                 remote_service='auto',

tests/test_public.py

@@ -376,3 +376,10 @@ def test_post_cell(app):
                 resp2 = resp.form.submit(headers={'x-requested-with': 'XMLHttpRequest'})
                 assert resp2.content.startswith('<form')
                 assert resp2.headers['x-error-message'] == 'Failed to create stuff.'
+
+            # check variable substitution in URL
+            with mock.patch('combo.utils.requests.post') as requests_post:
+                settings.JSON_CELL_TYPES['test-post-cell']['actions']['create'] = {
+                        'url': 'http://test-post-cell/[value]/delete'}
+                resp2 = resp.form.submit()
+                assert requests_post.call_args[0][0] == 'http://test-post-cell/plop/delete'