SECURITY_UNAUTHORIZED_VIEW doesn't default to None

[nalzok]

Hi there!

The document says SECURITY_UNAUTHORIZED_VIEW defaults to None, but actually it's default to lambda: None.

def _get_unauthorized_view():
    view = utils.get_url(utils.config_value('UNAUTHORIZED_VIEW'))
    if view:
        if callable(view):
            view = view()
        else:
            try:
                view = url_for(view)
            except BuildError:
                view = None
        utils.do_flash(*utils.get_message('UNAUTHORIZED'))
        return redirect(view or request.referrer or '/')
    abort(403)

Since lambda: None is interpreted as true, by default _get_unauthorized_view() won't abort(403), but the docs says it should.

[jirikuncar]

@sunqingyao thank you reporting. Indeed it looks like an inconsistency between docs and code. Do you prefer the default to abort(403) or redirect to referrer or /?

[nalzok]

Personally I prefer a simple abort(403), because

1. URLs to protected views shouldn’t be presented to users without certain roles at the first place, so under normal circumstances, a user won’t get a 403 error.
2. Redirecting without a proper message can be confusing, whereas 403 always means Unauthorized.
3. This makes testing easier: just assert resp.status_code to be 403.

[jirikuncar]

Let's change the lambda: None to None then.

[nalzok]

Great! :smiles: