old_contents: # -*- coding: utf-8 -*-
  # vim: tabstop=4 shiftwidth=4 softtabstop=4
  #
  # Copyright (C) 2015-2018 GEM Foundation
  #
  # OpenQuake is free software: you can redistribute it and/or modify it
  # under the terms of the GNU Affero General Public License as published
  # by the Free Software Foundation, either version 3 of the License, or
  # (at your option) any later version.
  #
  # OpenQuake is distributed in the hope that it will be useful,
  # but WITHOUT ANY WARRANTY; without even the implied warranty of
  # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  # GNU Affero General Public License for more details.
  #
  # You should have received a copy of the GNU Affero General Public License
  # along with OpenQuake. If not, see <http://www.gnu.org/licenses/>.
  
  import re
  
  from django.conf import settings
  from django.http import HttpResponseRedirect, HttpResponseForbidden
  
  EXEMPT_URLS = [re.compile(settings.LOGIN_URL.lstrip('/'))]
  if hasattr(settings, 'LOGIN_EXEMPT_URLS'):
      EXEMPT_URLS += [re.compile(expr.lstrip('/')) for expr in
                      settings.LOGIN_EXEMPT_URLS]
  
  
  class LoginRequiredMiddleware:
      """
      Middleware that requires a user to be authenticated to view any page other
      than LOGIN_URL. Exemptions to this requirement can be specified in
      settings via a list of regular expressions in LOGIN_EXEMPT_URLS.
  
      Requires authentication middleware and template context processors to be
      loaded. You'll get an error if they aren't.
      """
  
      def __init__(self, get_response):
          self.get_response = get_response
  
      def __call__(self, request):
          return self.get_response(request)
  
      def process_request(self, request):
          assert hasattr(request, 'user'), "The Login Required middleware\
   requires authentication middleware to be installed. Edit your\
   MIDDLEWARE_CLASSES setting to insert\
   'django.contrib.auth.middlware.AuthenticationMiddleware'. If that doesn't\
   work, ensure your TEMPLATE_CONTEXT_PROCESSORS setting includes\
   'django.core.context_processors.auth'."
          if not request.user.is_authenticated():
              path = request.path_info.lstrip('/')
              if not any(m.match(path) for m in EXEMPT_URLS):
                  # The programmatic API (under '/v1/') should not return a
                  # redirect to the login page, but it should return an HTTP 403
                  # response code, so the API consumer (like QGIS) can manage
                  # the error properly
                  if path.startswith('v1/'):
                      return HttpResponseForbidden()
                  else:
                      return HttpResponseRedirect(settings.LOGIN_URL)
  
new_contents: # -*- coding: utf-8 -*-
  # vim: tabstop=4 shiftwidth=4 softtabstop=4
  #
  # Copyright (C) 2015-2018 GEM Foundation
  #
  # OpenQuake is free software: you can redistribute it and/or modify it
  # under the terms of the GNU Affero General Public License as published
  # by the Free Software Foundation, either version 3 of the License, or
  # (at your option) any later version.
  #
  # OpenQuake is distributed in the hope that it will be useful,
  # but WITHOUT ANY WARRANTY; without even the implied warranty of
  # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  # GNU Affero General Public License for more details.
  #
  # You should have received a copy of the GNU Affero General Public License
  # along with OpenQuake. If not, see <http://www.gnu.org/licenses/>.
  
  import re
  
  from django.conf import settings
  from django.http import HttpResponseRedirect, HttpResponseForbidden
  
  EXEMPT_URLS = [re.compile(settings.LOGIN_URL.lstrip('/'))]
  if hasattr(settings, 'LOGIN_EXEMPT_URLS'):
      EXEMPT_URLS += [re.compile(expr.lstrip('/')) for expr in
                      settings.LOGIN_EXEMPT_URLS]
  
  
  class LoginRequiredMiddleware:
      """
      Middleware that requires a user to be authenticated to view any page other
      than LOGIN_URL. Exemptions to this requirement can be specified in
      settings via a list of regular expressions in LOGIN_EXEMPT_URLS.
  
      Requires authentication middleware and template context processors to be
      loaded. You'll get an error if they aren't.
      """
  
      def __init__(self, get_response):
          self.get_response = get_response
  
      def __call__(self, request):
          assert hasattr(request, 'user'), "The Login Required middleware\
   requires authentication middleware to be installed. Edit your\
   MIDDLEWARE_CLASSES setting to insert\
   'django.contrib.auth.middlware.AuthenticationMiddleware'. If that doesn't\
   work, ensure your TEMPLATE_CONTEXT_PROCESSORS setting includes\
   'django.core.context_processors.auth'."
          if not request.user.is_authenticated:
              path = request.path_info.lstrip('/')
              if not any(m.match(path) for m in EXEMPT_URLS):
                  # The programmatic API (under '/v1/') should not return a
                  # redirect to the login page, but it should return an HTTP 403
                  # response code, so the API consumer (like QGIS) can manage
                  # the error properly
                  if path.startswith('v1/'):
                      return HttpResponseForbidden()
                  else:
                      return HttpResponseRedirect(settings.LOGIN_URL)
  
          return self.get_response(request)
  
subject: Fix a stash issue in middleware code