Page create view now checks PageModel.can_create_at method

Fixes #2892

wagtail/wagtailadmin/views/pages.py

@@ -176,6 +176,9 @@ def create(request, content_type_app_name, content_type_model_name, parent_page_
     if page_class not in parent_page.creatable_subpage_models():
         raise PermissionDenied
 
+    if not page_class.can_create_at(parent_page):
+        raise PermissionDenied
+
     page = page_class(owner=request.user)
     edit_handler_class = page_class.get_edit_handler()
     form_class = edit_handler_class.get_form_class(page_class)

wagtail/wagtailcore/tests/test_page_model.py

@@ -8,6 +8,7 @@ from django.contrib.auth import get_user_model
 from django.contrib.auth.models import AnonymousUser
 from django.contrib.contenttypes.models import ContentType
 from django.core.exceptions import ValidationError
+from django.core.urlresolvers import reverse
 from django.http import Http404, HttpRequest
 from django.test import Client, TestCase
 from django.test.client import RequestFactory
@@ -1056,6 +1057,36 @@ class TestIssue1216(TestCase):
         self.assertEqual(new_christmas_event.url_path, expected_url_path)
 
 
+class TestIssue2892(TestCase, WagtailTestUtils):
+    """
+    Issue 756 reports that page can be created using a direct url,
+    even if can_create_at returns False.
+    """
+
+    fixtures = ['test.json']
+
+    def test_singleton_page_creation(self):
+        self.login()
+
+        root_page = Page.objects.get(url_path='/home/')
+        add_url = reverse('wagtailadmin_pages:add', args=[
+            SingletonPage._meta.app_label, SingletonPage._meta.model_name, root_page.pk])
+
+        # A single singleton page should be creatable
+        self.assertTrue(SingletonPage.can_create_at(root_page))
+        response = self.client.get(add_url)
+        self.assertEqual(response.status_code, 200)
+
+        # Create a singleton page
+        root_page.add_child(instance=SingletonPage(
+            title='singleton', slug='singleton'))
+
+        # A second singleton page should not be creatable
+        self.assertFalse(SingletonPage.can_create_at(root_page))
+        response = self.client.get(add_url)
+        self.assertEqual(response.status_code, 403)
+
+
 class TestIsCreatable(TestCase):
     def test_is_creatable_default(self):
         """By default, pages should be creatable"""