• 
      

    Allow access to public Local Sites by anonymous users.

    Review Request #5357 — Created Jan. 30, 2014 and submitted — Latest diff uploaded

    Information

    Review Board
    release-1.7.x

    Reviewers

    Allow access to public Local Sites by anonymous users.

    Local Sites were recently given a flag to control whether they could be
    publicly accessed. This still required the user to be logged in, though.

    This change allows access to public Local Sites by anonymous users, when
    anonymous access is turned on for the installation.

    A large part of this change is just cleaning up reviews/views.py. Nearly
    all the functions either did their own LocalSite checks or assumed
    _find_review_request would do it. We now consolidate the logic in a
    decorator.

    The new logic works like this:

    • If the user is anonymous, and the site is private, they will get
      redirected to the Login page.

    • If the user is anonymous, and the site is public, they will be able
      to access the page's view (which still may deny them for other
      reasons, of course).

    • If the user is logged in, and the site is private, and they don't
      have access, they will get a Permission Denied error.

    • If the user is logged in, and the site is public, they will be able
      to access the page's view.

    There's also a better experience for the dashboard. Now, whether using
    LocalSites or not, anonymous users will get redirected to the All Review
    Requests page instead of the Dashboard by default. Either page will then
    be able to do their own checks, showing a Permission Denied or login box
    as appropriate, given the settings.

    Tested each of the above scenarios.

    Tested all affected pages and didn't see any problems.