{"action":"closed","issue":{"url":"https://api.github.com/repos/joshuakarjala/django-hunger/issues/40","labels_url":"https://api.github.com/repos/joshuakarjala/django-hunger/issues/40/labels{/name}","comments_url":"https://api.github.com/repos/joshuakarjala/django-hunger/issues/40/comments","events_url":"https://api.github.com/repos/joshuakarjala/django-hunger/issues/40/events","html_url":"https://github.com/joshuakarjala/django-hunger/issues/40","id":23790347,"number":40,"title":"Should hunger.views.InviteView be blacklisted.","user":{"login":"airtonix","id":61225,"avatar_url":"https://avatars.githubusercontent.com/u/61225?v=3","gravatar_id":"","url":"https://api.github.com/users/airtonix","html_url":"https://github.com/airtonix","followers_url":"https://api.github.com/users/airtonix/followers","following_url":"https://api.github.com/users/airtonix/following{/other_user}","gists_url":"https://api.github.com/users/airtonix/gists{/gist_id}","starred_url":"https://api.github.com/users/airtonix/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/airtonix/subscriptions","organizations_url":"https://api.github.com/users/airtonix/orgs","repos_url":"https://api.github.com/users/airtonix/repos","events_url":"https://api.github.com/users/airtonix/events{/privacy}","received_events_url":"https://api.github.com/users/airtonix/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2013-12-05T14:35:18Z","updated_at":"2015-01-06T00:25:14Z","closed_at":"2015-01-06T00:25:14Z","body":"RIght now the middleware hardcodes a list of modules to whitelist.\r\n\r\nPersonally I think you should be moving this outside the middleware class to some getattr setup, thus allowing project integrators to at least do something about the InviteView being available to non beta users.\r\n\r\nhttps://github.com/joshuakarjala/django-hunger/blob/master/hunger/middleware.py#L55-L59\r\n\r\n\r\nI'm integrating this into yet another project and I'm using django-allauth, which allows me to take your new approach to \"Get users signed up and authenticated and invite them deeper into the site later.\"\r\n\r\nThe problem is that you can find yourself in the situation where : \r\n1. you would be logged in as a beta user, \r\n2. be sitting on `/beta/invite` \r\n3. have the server is restarted out from underneath you,\r\n4. either reload or submit the form to find yourself logged out but still on the invite form page.\r\n\r\nThis is because the invite form is whitelisted, the middleware never redirects non beta users away from it."}}