Drop deprecated functionality scheduled for removal in Oscar 2.1

docs/source/releases/v2.0.rst

@@ -345,5 +345,5 @@ Deprecated features
 - ``catalogue.managers.BrowsableProductManager`` is deprecated.  Use
   ``Product.objects.browsable()`` instead.
 
-- ``catalogue.Product.browseable`` is deprecated. Use
-  ``Product.objects.browseable()`` instead.
+- ``catalogue.Product.browsable`` is deprecated. Use
+  ``Product.objects.browsable()`` instead.

docs/source/releases/v2.1.rst

@@ -115,6 +115,27 @@ Bug fixes
 Removal of deprecated features
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
+- Support for verifying order hashes using an insecure MD5 algorithm generated
+  by Oscar 1.5 and below has been dropped. The ``OSCAR_DEPRECATED_ORDER_VERIFY_KEY``
+  setting is no longer used. Order verification hashes generated by Oscar 1.5
+  and lower will no longer validate.
+
+- ``offer.Range.contains()`` has been removed. Use ``contains_product()`` instead.
+
+- ``catalogue.managers.ProductManager`` has been removed.  Use
+  ``catalogue.managers.ProductQuerySet.as_manager()`` instead.
+
+- ``catalogue.managers.BrowsableProductManager`` has been removed.  Use
+  ``Product.objects.browsable()`` instead.
+
+- ``catalogue.Product.browsable`` has been removed. Use
+  ``Product.objects.browsable()`` instead.
+
+- Invalid URLs supplied to ``OSCAR_DASHBOARD_NAVIGATION`` are no longer ignored.
+  URLs that cannot be resolved will now result in a ``NoReverseMatch`` exception.
+  URLs that are not provided by a subclass of ``oscar.core.application.OscarDashboardConfig``
+  will result in a ``KeyError``.
+
 Minor changes
 ~~~~~~~~~~~~~
 

src/oscar/apps/catalogue/abstract_models.py

@@ -30,7 +30,6 @@ from oscar.models.fields import AutoSlugField, NullCharField
 from oscar.models.fields.slugfield import SlugField
 from oscar.utils.models import get_image_upload_path
 
-BrowsableProductManager = get_class('catalogue.managers', 'BrowsableProductManager')
 CategoryQuerySet, ProductQuerySet = get_classes(
     'catalogue.managers', ['CategoryQuerySet', 'ProductQuerySet'])
 ProductAttributesContainer = get_class(
@@ -425,9 +424,6 @@ class AbstractProduct(models.Model):
             "or not"))
 
     objects = ProductQuerySet.as_manager()
-    # browsable property is deprecated and will be removed in Oscar 2.1
-    # Use Product.objects.browsable() instead.
-    browsable = BrowsableProductManager()
 
     class Meta:
         abstract = True

src/oscar/apps/catalogue/managers.py

@@ -5,7 +5,6 @@ from django.db.models import Exists, OuterRef
 from django.db.models.constants import LOOKUP_SEP
 from treebeard.mp_tree import MP_NodeQuerySet
 
-from oscar.core.decorators import deprecated
 from oscar.core.loading import get_model
 
 
@@ -117,36 +116,6 @@ class ProductQuerySet(models.query.QuerySet):
         return self.filter(parent=None)
 
 
-@deprecated
-class ProductManager(models.Manager):
-    """
-    Deprecated. Use ProductQuerySet.as_manager() instead.
-    """
-
-    def get_queryset(self):
-        return ProductQuerySet(self.model, using=self._db)
-
-    def browsable(self):
-        return self.get_queryset().browsable()
-
-    def base_queryset(self):
-        return self.get_queryset().base_queryset()
-
-
-class BrowsableProductManager(ProductManager):
-    """
-    Deprecated. Use Product.objects.browsable() instead.
-
-    The @deprecated decorator isn't applied to the class, because doing
-    so would log warnings, and we still initialise this class
-    in the Product.browsable for backward compatibility.
-    """
-
-    @deprecated
-    def get_queryset(self):
-        return super().get_queryset().browsable()
-
-
 class CategoryQuerySet(MP_NodeQuerySet):
 
     def browsable(self):

src/oscar/apps/customer/alerts/utils.py

@@ -37,7 +37,7 @@ class AlertsDispatcher:
         availability and send out email alerts when a product is
         available to buy.
         """
-        products = Product.browsable.filter(productalert__status=ProductAlert.ACTIVE).distinct()
+        products = Product.objects.browsable().filter(productalert__status=ProductAlert.ACTIVE).distinct()
         self.dispatcher.logger.info("Found %d products with active alerts", products.count())
         for product in products:
             self.send_product_alert_email_for_user(product)

src/oscar/apps/dashboard/nav.py

@@ -1,13 +1,11 @@
 import logging
-import warnings
 from functools import lru_cache
 
 from django.apps import apps
 from django.core.exceptions import ImproperlyConfigured
-from django.urls import NoReverseMatch, resolve, reverse
+from django.urls import resolve, reverse
 
 from oscar.core.application import OscarDashboardConfig
-from oscar.utils.deprecation import RemovedInOscar21Warning
 from oscar.views.decorators import check_permissions
 
 logger = logging.getLogger('oscar.dashboard')
@@ -99,33 +97,10 @@ def default_access_fn(user, url_name, url_args=None, url_kwargs=None):
     if url_name is None:  # it's a heading
         return True
 
-    try:
-        url = reverse(url_name, args=url_args, kwargs=url_kwargs)
-    except NoReverseMatch:
-        logger.exception('Invalid URL name {}'.format(url_name))
-        warnings.warn(
-            'Invalid URL names supplied to oscar.dashboard.nav.default_access_fn'
-            'will throw an exception in Oscar 2.1',
-            RemovedInOscar21Warning,
-            stacklevel=2
-        )
-        return False
-
+    url = reverse(url_name, args=url_args, kwargs=url_kwargs)
     url_match = resolve(url)
     url_name = url_match.url_name
-    try:
-        app_config_instance = _dashboard_url_names_to_config()[url_name]
-    except KeyError:
-        logger.error(
-            "{} is not a valid dashboard URL".format(url_match.view_name)
-        )
-        warnings.warn(
-            'Invalid URL names supplied to oscar.dashboard.nav.default_access_fn'
-            'will throw an exception in Oscar 2.1',
-            RemovedInOscar21Warning,
-            stacklevel=2
-        )
-        return False
+    app_config_instance = _dashboard_url_names_to_config()[url_name]
 
     permissions = app_config_instance.get_permissions(url_name)
 

src/oscar/apps/offer/abstract_models.py

@@ -15,7 +15,6 @@ from django.utils.timezone import get_current_timezone, now
 from django.utils.translation import gettext_lazy as _
 
 from oscar.core.compat import AUTH_USER_MODEL
-from oscar.core.decorators import deprecated
 from oscar.core.loading import (
     cached_import_string, get_class, get_classes, get_model)
 from oscar.models import fields
@@ -874,11 +873,6 @@ class AbstractRange(models.Model):
             return self.proxy.contains_product(product)
         return self.product_queryset.filter(id=product.id).exists()
 
-    # Deprecated alias
-    @deprecated
-    def contains(self, product):
-        return self.contains_product(product)
-
     def invalidate_cached_queryset(self):
         try:
             del self.product_queryset

src/oscar/apps/order/abstract_models.py

@@ -1,11 +1,8 @@
-import hashlib
 import logging
-import warnings
 from collections import OrderedDict
 from decimal import Decimal as D
 
 from django.conf import settings
-from django.core.exceptions import ImproperlyConfigured
 from django.core.signing import BadSignature, Signer
 from django.db import models
 from django.db.models import Sum
@@ -21,7 +18,6 @@ from oscar.core.compat import AUTH_USER_MODEL
 from oscar.core.loading import get_model
 from oscar.core.utils import get_default_currency
 from oscar.models.fields import AutoSlugField
-from oscar.utils.deprecation import RemovedInOscar21Warning
 
 from . import exceptions
 
@@ -314,38 +310,11 @@ class AbstractOrder(models.Model):
         signer = Signer(salt='oscar.apps.order.Order')
         return signer.sign(self.number)
 
-    def check_deprecated_verification_hash(self, hash_to_check):
-        """
-        Backward compatible check for MD5 hashes that were generated in
-        Oscar 1.5 and lower.
-
-        This must explicitly be enabled by setting OSCAR_DEPRECATED_ORDER_VERIFY_KEY,
-        which must not be equal to SECRET_KEY - i.e., the project must
-        have changed its SECRET_KEY since this change was applied.
-        """
-        old_verification_key = getattr(settings, 'OSCAR_DEPRECATED_ORDER_VERIFY_KEY', None)
-        if old_verification_key is None:
-            return False
-
-        warnings.warn('Use of OSCAR_DEPRECATED_ORDER_VERIFY_KEY is deprecated', RemovedInOscar21Warning, stacklevel=2)
-
-        if old_verification_key == settings.SECRET_KEY:
-            raise ImproperlyConfigured(
-                'OSCAR_DEPRECATED_ORDER_VERIFY_KEY cannot be equal to SECRET_KEY')
-
-        logger.warning('Using insecure md5 hashing for order URL hash verification.')
-        string_to_hash = '%s%s' % (self.number, old_verification_key)
-        order_hash = hashlib.md5(string_to_hash.encode('utf8')).hexdigest()
-        return constant_time_compare(order_hash, hash_to_check)
-
     def check_verification_hash(self, hash_to_check):
         """
         Checks the received verification hash against this order number.
         Returns False if the verification failed, True otherwise.
         """
-        if self.check_deprecated_verification_hash(hash_to_check):
-            return True
-
         signer = Signer(salt='oscar.apps.order.Order')
         try:
             signed_number = signer.unsign(hash_to_check)

src/oscar/apps/search/search_indexes.py

@@ -37,10 +37,10 @@ class ProductIndex(indexes.SearchIndex, indexes.Indexable):
 
     def index_queryset(self, using=None):
         # Only index browsable products (not each individual child product)
-        return self.get_model().browsable.order_by('-date_updated')
+        return self.get_model().objects.browsable().order_by('-date_updated')
 
     def read_queryset(self, using=None):
-        return self.get_model().browsable.base_queryset()
+        return self.get_model().objects.browsable().base_queryset()
 
     def prepare_product_class(self, obj):
         return obj.get_product_class().name

src/oscar/core/decorators.py

@@ -1,6 +1,6 @@
 import warnings
 
-from oscar.utils.deprecation import RemovedInOscar21Warning
+from oscar.utils.deprecation import RemovedInOscar22Warning
 
 
 def deprecated(obj):
@@ -10,7 +10,7 @@ def deprecated(obj):
         return _deprecated_func(f=obj)
 
 
-def _deprecated_func(f, warn_cls=RemovedInOscar21Warning):
+def _deprecated_func(f, warn_cls=RemovedInOscar22Warning):
     def _deprecated(*args, **kwargs):
         message = "Method '%s' is deprecated and will be " \
             "removed in the next version of django-oscar" \
@@ -20,7 +20,7 @@ def _deprecated_func(f, warn_cls=RemovedInOscar21Warning):
     return _deprecated
 
 
-def _deprecated_cls(cls, warn_cls=RemovedInOscar21Warning):
+def _deprecated_cls(cls, warn_cls=RemovedInOscar22Warning):
     class Deprecated(cls):
         def __init__(self, *args, **kwargs):
             message = "Class '%s' is deprecated and will be " \

src/oscar/utils/deprecation.py

@@ -1,6 +1,2 @@
-class RemovedInOscar21Warning(DeprecationWarning):
-    pass
-
-
 class RemovedInOscar22Warning(DeprecationWarning):
     pass

tests/integration/catalogue/test_product.py

@@ -71,12 +71,6 @@ class TopLevelProductTests(ProductTests):
             product_class=self.product_class, title="Kopfhörer")
         self.assertEqual(set([product]), set(Product.objects.browsable()))
 
-    def test_top_level_products_are_part_of_browsable_deprecated(self):
-        # Test for deprecated Product.browsable.
-        product = Product.objects.create(
-            product_class=self.product_class, title="Kopfhörer")
-        self.assertEqual(set([product]), set(Product.browsable.all()))
-
 
 class ChildProductTests(ProductTests):
 
@@ -110,13 +104,6 @@ class ChildProductTests(ProductTests):
             structure=Product.CHILD)
         self.assertEqual(set([self.parent]), set(Product.objects.browsable()))
 
-    def test_child_products_are_not_part_of_browsable_deprecated(self):
-        # Test for deprecated Product.browsable
-        Product.objects.create(
-            product_class=self.product_class, parent=self.parent,
-            structure=Product.CHILD)
-        self.assertEqual(set([self.parent]), set(Product.browsable.all()))
-
 
 class TestAChildProduct(TestCase):
 

tests/integration/dashboard/test_nav.py

@@ -1,5 +1,6 @@
 from django.test import TestCase
 from django.urls import reverse
+from django.urls.exceptions import NoReverseMatch
 
 from oscar.apps.dashboard.menu import get_nodes
 from oscar.apps.dashboard.nav import default_access_fn
@@ -22,11 +23,13 @@ class DashboardAccessFunctionTestCase(TestCase):
         self.assertFalse(default_access_fn(self.non_staff_user, 'dashboard:index'))
 
     def test_default_access_fn_invalid_url_name(self):
-        self.assertFalse(default_access_fn(self.staff_user, 'invalid_module:index'))
+        with self.assertRaises(NoReverseMatch):
+            default_access_fn(self.staff_user, 'invalid_module:index')
 
     def test_default_access_non_dashboard_url_name(self):
         assert reverse('search:search')
-        self.assertFalse(default_access_fn(self.staff_user, 'search:search'))
+        with self.assertRaises(KeyError):
+            default_access_fn(self.staff_user, 'search:search')
 
 
 class DashboardNavTestCase(TestCase):

tests/integration/order/test_models.py

@@ -2,7 +2,6 @@ from datetime import datetime, timedelta
 from decimal import Decimal as D
 from unittest import mock
 
-from django.core.exceptions import ImproperlyConfigured
 from django.test import TestCase, override_settings
 from django.utils import timezone
 from django.utils.translation import gettext_lazy as _
@@ -431,29 +430,3 @@ class OrderTests(TestCase):
         order = OrderFactory(number='111000')
         # Hash is valid, but it is for a different order number
         self.assertFalse(order.check_verification_hash('222000:knvoMB1KAiJu8meWtGce00Y88j4'))
-
-    @override_settings(OSCAR_DEPRECATED_ORDER_VERIFY_KEY='deprecated_order_hash_secret')
-    def test_check_deprecated_hash_verification(self):
-        order = OrderFactory(number='100001')
-        # Check that check_deprecated_verification_hash validates the hash
-        self.assertTrue(
-            order.check_deprecated_verification_hash('3efd0339e8c789447469f37851cbaaaf')
-        )
-        # Check that check_verification_hash calls it correctly
-        self.assertTrue(order.check_verification_hash('3efd0339e8c789447469f37851cbaaaf'))
-
-    def test_check_deprecated_hash_verification_without_old_key(self):
-        order = OrderFactory(number='100001')
-        # Check that check_deprecated_verification_hash validates the hash
-        self.assertFalse(
-            order.check_deprecated_verification_hash('3efd0339e8c789447469f37851cbaaaf')
-        )
-
-    @override_settings(
-        OSCAR_DEPRECATED_ORDER_VERIFY_KEY='deprecated_order_hash_secret',
-        SECRET_KEY='deprecated_order_hash_secret')
-    def test_check_deprecated_hash_verification_old_key_matches_new(self):
-        order = OrderFactory(number='100001')
-        # OSCAR_DEPRECATED_ORDER_VERIFY_KEY must not be equal to SECRET_KEY.
-        with self.assertRaises(ImproperlyConfigured):
-            order.check_deprecated_verification_hash('3efd0339e8c789447469f37851cbaaaf')