limit course reload to localhost or user.is_staff

lms/djangoapps/lms_migration/migrate.py

@@ -38,11 +38,16 @@ def manage_modulestores(request,reload_dir=None):
     
     if LOCAL_DEBUG:
         html += '<h3>IP address: %s ' % ip
+        log.debug('request from ip=%s' % ip)
 
     if not (ip in ALLOWED_IPS or 'any' in ALLOWED_IPS):
-        html += 'Permission denied'
-        html += "</body></html>"
-        return HttpResponse(html)    
+        if request.user and request.user.is_staff:
+            log.debug('request allowed because user=%s is staff' % request.user)
+        else:
+            html += 'Permission denied'
+            html += "</body></html>"
+            log.debug('request denied, ALLOWED_IPS=%s' % ALLOWED_IPS)
+            return HttpResponse(html)    
 
     #----------------------------------------
     # reload course if specified

lms/envs/dev.py

@@ -62,7 +62,7 @@ SECRET_KEY = '85920908f28904ed733fe576320db18cabd7b6cd'
 MITX_FEATURES['ENABLE_LMS_MIGRATION'] = True
 MITX_FEATURES['ACCESS_REQUIRE_STAFF_FOR_COURSE'] = True
 
-LMS_MIGRATION_ALLOWED_IPS = ['any']
+LMS_MIGRATION_ALLOWED_IPS = ['127.0.0.1']
 
 ################################ OpenID Auth #################################
 MITX_FEATURES['AUTH_USE_OPENID'] = True