[core] Directly fails with 403 in embedded mode if not logged-in
Avoid the 402 redirect to login page.
Only the login page will be accessible.
e.g.
@@ -35,7 +35,7 @@ from django.contrib.auth.middleware import RemoteUserMiddleware
from django.contrib.auth.models import User
from django.core import exceptions, urlresolvers
import django.db
-from django.http import HttpResponseNotAllowed
+from django.http import HttpResponseNotAllowed, HttpResponseForbidden
from django.core.urlresolvers import resolve
from django.http import HttpResponseRedirect, HttpResponse
from django.utils.translation import ugettext as _
@@ -44,6 +44,7 @@ import django.views.static
import desktop.views
import desktop.conf
+from desktop.conf import IS_EMBEDDED
from desktop.context_processors import get_app_name
from desktop.lib import apputil, i18n, fsmanager
from desktop.lib.django_util import render, render_json
@@ -326,6 +327,9 @@ class LoginAndPermissionMiddleware(object):
response = HttpResponse("/* login required */", content_type="text/javascript")
response[MIDDLEWARE_HEADER] = 'LOGIN_REQUIRED'
return response
+ else:
+ if IS_EMBEDDED.get():
+ return HttpResponseForbidden()
else:
return HttpResponseRedirect("%s?%s=%s" % (settings.LOGIN_URL, REDIRECT_FIELD_NAME, urlquote(request.get_full_path())))
