Merge "Authenticate before Authorization" into stable/train

1 files changed, 3 insertions, 3 deletions

diff --git a/horizon/base.py b/horizon/base.py
index 50efee407..2cdace254 100644
--- a/horizon/base.py
+++ b/horizon/base.py
@@ -573,13 +573,13 @@ class Dashboard(Registry, HorizonComponent):
         urlpatterns.append(
             url(r'', _wrapped_include(default_panel._decorated_urls)))
 
-        # Require login if not public.
-        if not self.public:
-            _decorate_urlconf(urlpatterns, require_auth)
         # Apply access controls to all views in the patterns
         permissions = getattr(self, 'permissions', [])
         _decorate_urlconf(urlpatterns, require_perms, permissions)
         _decorate_urlconf(urlpatterns, _current_component, dashboard=self)
+        # Require login if not public.
+        if not self.public:
+            _decorate_urlconf(urlpatterns, require_auth)
 
         # Return the three arguments to django.conf.urls.include
         return urlpatterns, self.slug, self.slug