Page 94 - order of logic

[topiaruss]

This is a nit, but in Example 8.3, it would be better to check permissions before leaking information about presence/absence of a certain sprinkle pk, via the 404.

I'd write:

request = check_sprinkles(request)
sprinkle = get_object_or_404(Sprinkle, pk=pk)

I do accept that this is not the focus of this section, but perhaps this highlights a topic that might be mentioned elsewhere -- preventing probing of address/data spaces, wherever possible. As it happens example 8.4 does not exhibit the leakage, perhaps underlining an additional benefit of CBV - separation of concerns into narrowly defined methods. In this case only permissions testing is needed in the dispatch override. Data access is defined presumably correctly in the superclass, and one would hope the order of operations would be correct (object or 404 only after dispatch()).

[pydanny]

:ship:

It doesn't matter if this is the main focus of the section, you nevertheless raise a good point.