stop auth. in some areas (bug 624905)

apps/amo/middleware.py

@@ -8,6 +8,8 @@ import time
 import urllib
 
 from django.conf import settings
+from django.contrib.auth.middleware import AuthenticationMiddleware
+from django.contrib.auth.models import AnonymousUser
 from django.contrib.sessions.middleware import SessionMiddleware
 from django.http import HttpResponsePermanentRedirect
 from django.middleware import common
@@ -111,6 +113,18 @@ class NoVarySessionMiddleware(SessionMiddleware):
         return new_response
 
 
+class AMOAuthenticationMiddleware(AuthenticationMiddleware):
+    def process_request(self, request):
+        prefixes = request.path.split('/')
+        if (len(prefixes) > 1 and prefixes[1]
+            in settings.NO_AUTHENTICATION_PREFIX):
+            request.user = AnonymousUser()
+            return
+
+        return (super(AMOAuthenticationMiddleware, self)
+                .process_request(request))
+
+
 class RemoveSlashMiddleware(object):
     """
     Middleware that tries to remove a trailing slash if there was a 404.

settings.py

@@ -219,7 +219,7 @@ MIDDLEWARE_CLASSES = (
     'amo.middleware.CommonMiddleware',
     'amo.middleware.NoVarySessionMiddleware',
     'django.contrib.messages.middleware.MessageMiddleware',
-    'django.contrib.auth.middleware.AuthenticationMiddleware',
+    'amo.middleware.AMOAuthenticationMiddleware',
     'django.middleware.csrf.CsrfViewMiddleware',
 
     'cake.middleware.CakeCookieMiddleware',
@@ -233,6 +233,11 @@ MIDDLEWARE_CLASSES = (
     'commonware.middleware.HidePasswordOnException',
 )
 
+# URLs that start with this values have an anymous user.
+NO_AUTHENTICATION_PREFIX = (
+    'update',
+)
+
 # Auth
 AUTHENTICATION_BACKENDS = (
     'users.backends.AmoUserBackend',