title: Security issues with a middleware screener page
body: <p>While my startup is in dark mode I want all access except access to / to go to a screener page where users have enter a password given to them by a representative. I've come up with the following simple middleware to perform the task. Just to be clear, this is intended to ensure that users agree to keep the site in confidence before they are allowed to browse around rather than for use as a security system or .htaccess clone. However I would like to prevent them seeing any public pages (i.e those which are not decorated with @login_required) without knowing the screener password. The password_check function uses Django Auth to generate the hash of the input password to check against a db value.</p>
  
  <p>Any thoughts/circumvention techniques that you guys can see? One idea I had was to change the login function to push the LicenceKey into the newly logged in users session, rather than giving logged in users an exemption. However since they can only create a new session by logging in, and logging in requires agreeing to the screener, it seems redundant.</p>
  
  <p>Feedback appreciated.</p>
  
  <p>The middleware looks like this:</p>
  
  <pre><code>from django.http import HttpResponseRedirect
  from django.core.urlresolvers import reverse
  import re
  
  class LicenceScreener(object):
      SCREENER_PATH = reverse("licence")
      INDEX_PATH = reverse("index")
      LICENCE_KEY = "commercial_licence"
      def process_request(self, request):
          """ Redirect any access not to the index page to a commercial access screener page
              When the screener form is submitted, request.session[LICENCE_KEY] is set.
          """
          if not LicenceScreener.LICENCE_KEY in request.session \
              and not request.user.is_authenticated() \
              and LicenceScreener.SCREENER_PATH != request.path\
              and LicenceScreener.INDEX_PATH != request.path:
                  return HttpResponseRedirect(self.SCREENER_PATH)
  </code></pre>
  
  <p>And the view looks like this:</p>
  
  <pre><code>def licence(request):
      c = RequestContext(request, {}  )
      if request.method == 'POST':
          form = LicenceAgreementForm(request.POST)
          if form.is_valid():
              if password_check(form.cleaned_data["password"]):
                  request.session[LicenceScreener.LICENCE_KEY] = True
                  return HttpResponseRedirect(reverse("real-index"))
              else:
                  form._errors["password"] = form.error_class([_("Sorry that password is incorrect")])    
      else:
          form = LicenceAgreementForm()  
      c["form"] = form        
      return render_to_response('licence.html',c)
  </code></pre>
  
  <p>EDIT 1. Removed the Regexes as suggested by Tobu</p>