After completing the 'Security' Extension tutorial it is still possible to view a draft post (draft_post_detail.html) without being logged in if the User navigates the to post via the address bar, because the post_detail() method is not protected by the @login_required decorator. I think it's important for people to understand that just because you can't navigate from the home page, the url itself may still be vulnerable to unauthorised access. So, I've added a section at the end of the security Extension to include validation for published vs draft posts.
At some point in the past icons used in the main tutorial were changed from glyphicons to .svg files downloaded from bootstrap, but seems this had not been reflected in the corresponding sections of the Extensions tutorial. So, I've updated references to that code from the main tutorial, and replaced the new icon instructions included in the Extension tutorial.
Updated code block formatting to be more consistent with main tutorial where the file name is listed directly above the code block.
Hope this is helpful :-)
Lauren Benson
Berlin, Germany
PS: this is my first ever pull request so I hope I did it ok :-)
After completing the 'Security' Extension tutorial it is still possible to view a draft post (draft_post_detail.html) without being logged in if the User navigates the to post via the address bar, because the post_detail() method is not protected by the @login_required decorator. I think it's important for people to understand that just because you can't navigate from the home page, the url itself may still be vulnerable to unauthorised access. So, I've added a section at the end of the security Extension to include validation for published vs draft posts.
At some point in the past icons used in the main tutorial were changed from glyphicons to .svg files downloaded from bootstrap, but seems this had not been reflected in the corresponding sections of the Extensions tutorial. So, I've updated references to that code from the main tutorial, and replaced the new icon instructions included in the Extension tutorial.
Updated code block formatting to be more consistent with main tutorial where the file name is listed directly above the code block.
Hope this is helpful :-)
Lauren Benson Berlin, Germany
PS: this is my first ever pull request so I hope I did it ok :-)