From 74dd2e9de790ad983af2034d0e56297bb6deaa98 Mon Sep 17 00:00:00 2001
From: Gabriel Hurley <gabriel@strikeawe.com>
Date: Sun, 18 Mar 2012 22:17:30 -0700
Subject: [PATCH] Filter action respects HTTP method. Fixes bug 931272.

Change-Id: I1c292f741349a2e82a871432fbba0edd9d62044c
---
 horizon/tables/actions.py    |  6 +++++-
 horizon/tables/base.py       | 19 ++++++++++++-------
 horizon/tests/table_tests.py | 10 ++++++++++
 3 files changed, 27 insertions(+), 8 deletions(-)

diff --git a/horizon/tables/actions.py b/horizon/tables/actions.py
index 2988853a2..17f1f07b5 100644
--- a/horizon/tables/actions.py
+++ b/horizon/tables/actions.py
@@ -285,7 +285,11 @@ class FilterAction(BaseAction):
         A string representing the name of the request parameter used for the
         search term. Default: ``"q"``.
     """
-    method = "GET"
+    # TODO(gabriel): The method for a filter action should be a GET,
+    # but given the form structure of the table that's currently impossible.
+    # At some future date this needs to be reworked to get the filter action
+    # separated from the table's POST form.
+    method = "POST"
     name = "filter"
 
     def __init__(self, verbose_name=None, param_name=None):
diff --git a/horizon/tables/base.py b/horizon/tables/base.py
index 5786638be..e19f09f50 100644
--- a/horizon/tables/base.py
+++ b/horizon/tables/base.py
@@ -673,10 +673,6 @@ class DataTable(object):
         # Associate these actions with this table
         for action in self.base_actions.values():
             action.table = self
-        if self._meta._filter_action:
-            param_name = self._meta._filter_action.get_param_name()
-            q = self._meta.request.POST.get(param_name, '')
-            self._meta._filter_action.filter_string = q
 
     def __unicode__(self):
         return self._meta.verbose_name
@@ -706,11 +702,20 @@ class DataTable(object):
             self._filtered_data = self.data
             if self._meta.filter and self._meta._filter_action:
                 action = self._meta._filter_action
-                self._filtered_data = action.filter(self,
-                                                    self.data,
-                                                    action.filter_string)
+                filter_string = self.get_filter_string()
+                request_method = self._meta.request.method
+                if filter_string and request_method == action.method:
+                    self._filtered_data = action.filter(self,
+                                                        self.data,
+                                                        filter_string)
         return self._filtered_data
 
+    def get_filter_string(self):
+        filter_action = self._meta._filter_action
+        param_name = filter_action.get_param_name()
+        filter_string = self._meta.request.POST.get(param_name, '')
+        return filter_string
+
     def _populate_data_cache(self):
         self._data_cache = {}
         # Set up hash tables to store data points for each column
diff --git a/horizon/tests/table_tests.py b/horizon/tests/table_tests.py
index 6efda642a..373a1abac 100644
--- a/horizon/tests/table_tests.py
+++ b/horizon/tests/table_tests.py
@@ -502,6 +502,16 @@ class DataTableTests(test.TestCase):
         self.assertQuerysetEqual(self.table.filtered_data,
                                  ['<FakeObject: object_2>'])
 
+        # Ensure fitering respects the request method, e.g. no filter here
+        req = self.factory.get('/my_url/', {action_string: '2'})
+        self.table = MyTable(req, TEST_DATA)
+        handled = self.table.maybe_handle()
+        self.assertEqual(handled, None)
+        self.assertQuerysetEqual(self.table.filtered_data,
+                                 ['<FakeObject: object_1>',
+                                  '<FakeObject: object_2>',
+                                  '<FakeObject: object_3>'])
+
         # Updating and preemptive actions
         params = {"table": "my_table", "action": "row_update", "obj_id": "1"}
         req = self.factory.get('/my_url/',