Fix axes lockout not working

We use django-axes to lock out IP addresses after a set number of
attempts at logging in, and separately we use django-reversion to
record change history. As part of the history tracking, the default
behaviour of django-reversion is to wrap all POST requests in
"with transaction.atomic()", with the result that if an exception is
raised any changes get rolled back; unfortunately when authentication
fails for the final time, axes updates the database and then raises
PermissionDenied - with the result that the database changes are rolled
back, and the user's IP is not locked out, in fact it can never be
locked out. To work around this, disable the atomic mode on
ReversionMiddleware using a subclass. (I don't like having to do this,
but this is the quickest solution for now.)

Signed-off-by: Paul Eggleton <paul.eggleton@linux.intel.com>

docker/settings.py

@@ -100,7 +100,7 @@ MIDDLEWARE_CLASSES = (
     'django.contrib.auth.middleware.AuthenticationMiddleware',
     'django.contrib.messages.middleware.MessageMiddleware',
     'django.middleware.clickjacking.XFrameOptionsMiddleware',
-    'reversion.middleware.RevisionMiddleware',
+    'layerindex.middleware.NonAtomicRevisionMiddleware',
 )
 
 # We allow CORS calls from everybody

layerindex/middleware.py

@@ -0,0 +1,15 @@
+# layerindex-web - middleware definitions
+#
+# Copyright (C) 2019 Intel Corporation
+#
+# Licensed under the MIT license, see COPYING.MIT for details
+
+from django.utils.deprecation import MiddlewareMixin
+from django.http import HttpResponseRedirect
+from django.core.urlresolvers import reverse
+from reversion.middleware import RevisionMiddleware
+import settings
+import re
+
+class NonAtomicRevisionMiddleware(RevisionMiddleware):
+    atomic = False

settings.py

@@ -100,7 +100,7 @@ MIDDLEWARE_CLASSES = (
     'django.contrib.auth.middleware.AuthenticationMiddleware',
     'django.contrib.messages.middleware.MessageMiddleware',
     'django.middleware.clickjacking.XFrameOptionsMiddleware',
-    'reversion.middleware.RevisionMiddleware',
+    'layerindex.middleware.NonAtomicRevisionMiddleware',
 )
 
 # We allow CORS calls from everybody