This implements ldh_middleware#66 (Only allow cart numbers)

cart/views.py

 from django import forms
 from django.conf import settings
-from registration.backends.simple.views import RegistrationView
-from ldapregister.forms import RegistrationForm
+from django.http import HttpResponseRedirect
+from django.urls import reverse
+
 from captcha.fields import CaptchaField
 from cart.models import ChosenReward
+from ldapregister.forms import RegistrationForm
+from registration.backends.simple.views import RegistrationView
 
 
 class CartRegistrationForm(RegistrationForm):
@@ -15,6 +18,13 @@ class CartRegistrationView(RegistrationView):
     # success_url = None
     template_name = 'cart/registration_form.html'
 
+    def get(self, *args, **kwargs):
+        valid_numbers = getattr(settings, 'WOO_VALID_CART_NUMBERS').split(',')
+        self.reward = kwargs.get('reward', None)
+        if self.reward not in valid_numbers:
+            return HttpResponseRedirect(reverse('register_reward', args=(valid_numbers[0],)))
+        return super().get(*args, **kwargs)
+
     def post(self, *args, **kwargs):
         self.reward = kwargs.get('reward', None)
         return super().post(*args, **kwargs)

middleware/settings.py

@@ -148,6 +148,7 @@ WOO_QUERY_STRING_AUTH = config("WOO_QUERY_STRING_AUTH", cast=bool)  # required f
 WOO_CART_PATH = config("WOO_CART_PATH")
 WOO_CONSUMER_KEY = secret_config("WOO_CONSUMER_KEY")
 WOO_CONSUMER_SECRET = secret_config("WOO_CONSUMER_SECRET")
+WOO_VALID_CART_NUMBERS = config("WOO_VALID_CART_NUMBERS")
 
 #
 # WOOSUB1 PARSER

middleware/urls.py

@@ -44,6 +44,6 @@ urlpatterns = [
     url(r'^download/', include('django_agpl.urls')),
     url(r'^jslicense/$', purist.views.jslicense, name='jslicense'),
     url(r'^captcha/', include('captcha.urls')),
-    url(r'^cart/(?P<reward>\d+)/$', CartRegistrationView.as_view()),
+    url(r'^cart/(?P<reward>\d+)/$', CartRegistrationView.as_view(), name="register_reward"),
 ]